EU Designates ChatGPT as Very Large Online Search Engine Under Digital Services Act

The European Commission has officially designated OpenAI's ChatGPT as a Very Large Online Search Engine (VLOSE) under the Digital Services Act (DSA). This significant classification follows ChatGPT's declaration of exceeding 45 million average monthly users within the European Union, a threshold that triggers enhanced regulatory oversight. The move places ChatGPT in a category with traditional search engines, imposing new obligations on the AI chatbot regarding risk assessment, transparency, and data access.

Alongside ChatGPT, the Commission also designated Reddit and Roblox as Very Large Online Platforms (VLOPs), bringing the total number of entities under this heightened level of supervision to 28. For ChatGPT, the designation is particularly noteworthy as it marks the first time a conversational AI has been classified as a search engine. The Commission's decision highlights ChatGPT's functionality in answering prompts and queries, including by searching the web, thereby classifying it as a hybrid service.

This new designation means ChatGPT, Reddit, and Roblox must now conduct comprehensive risk assessments by the end of January 2027. These assessments must address systemic risks stemming from their services and algorithmic systems, focusing on areas such as illegal content, harm to minors, user well-being, fundamental rights, electoral processes, and public security. The scope of these assessments is broad, encompassing the potential for AI-driven influence operations and the dissemination of harmful content.

Beyond risk assessments, the designated entities will be subject to independent annual audits and will need to provide vetted researchers with access to their data. This increased transparency aims to provide regulators and security experts with a clearer understanding of how these powerful platforms operate at scale and how their algorithms impact users and society. The Commission will share supervisory duties with national Digital Services Coordinators, with Ireland's Coimisiún na Meán overseeing ChatGPT and Reddit, and the Netherlands Authority for Consumers and Markets overseeing Roblox.

Failure to comply with the DSA's requirements can result in substantial penalties, including fines of up to 6 percent of a company's global annual turnover. This regulatory action underscores the European Union's commitment to holding major digital platforms accountable for their societal impact and ensuring a safer online environment for its citizens. The classification of ChatGPT as a search engine signals a new era of regulation for AI technologies that integrate web search capabilities.

For cybersecurity professionals, this development means that AI services with live web search functionalities, large-scale user-generated content platforms, and immersive gaming environments are now firmly within the purview of Europe's platform regulation. The deadline of January 2027 for compliance with these enhanced requirements necessitates proactive engagement from affected companies to mitigate risks and ensure adherence to the new legal framework.

The implications of this designation extend to the broader cybersecurity landscape, particularly concerning the potential for AI-driven misinformation and manipulation. By treating ChatGPT as critical search infrastructure, regulators are acknowledging its significant role in shaping information access for millions of users and the associated risks if not properly managed. This move sets a precedent for how other AI services that interact with or process web data might be regulated in the future.