ChatGPT, Reddit, and Roblox Face the EU’s Strictest Digital Services Act Rules

The European Commission has designated ChatGPT, Reddit, and Roblox under the strictest tier of the EU’s Digital Services Act (DSA). ChatGPT is now a Very Large Online Search Engine (VLOSE), while Reddit and Roblox are Very Large Online Platforms (VLOPs). The practical result is direct Commission supervision and a wider set of continuing duties focused on systemic risks, transparency, independent auditing, and researcher access. 12

What the designation means

The DSA applies its “very large” regime to online platforms and search engines that reach more than 45 million average monthly users in the EU. The threshold is based on user scale, while the service category depends on what the service does: Reddit and Roblox allow users to create and share content publicly, whereas ChatGPT’s search functionality lets users seek and receive information from the web. 14

All three services reported reaching at least the threshold. OpenAI’s reported figure for ChatGPT was 159.1 million average monthly active recipients in the EU, according to the Commission’s designated-services list. Roblox had reported roughly 48 million monthly EU users, while the available reporting confirms that Reddit also crossed the 45-million threshold without establishing a comparable exact figure in the sources provided. 71314

This is not simply a larger-platform label. VLOPs and VLOSEs already face the DSA’s general rules, but the designation adds the law’s most extensive risk-management and accountability requirements. 12

Why ChatGPT became a VLOSE

ChatGPT’s designation is significant because it is the first AI chatbot identified as a Very Large Online Search Engine. 4

The classification reflects the role of ChatGPT Search. The relevant question for the DSA is not only whether ChatGPT generates text, but whether its search feature functions as a way for users to request and receive information from the web. That places the service within the DSA’s search-engine framework when it also meets the user threshold. 14

The decision therefore establishes an important regulatory precedent: a generative-AI service can fall within the DSA’s top tier when its functionality and reach create the kind of broad public impact the law is designed to address.

The new obligations

ChatGPT, Reddit, and Roblox must address several additional requirements under the DSA.

Annual systemic-risk assessments

Each service must assess and publish an annual review of systemic risks linked to its operation. Relevant risks include the spread of illegal content, effects on fundamental rights and public discourse, risks to minors, and threats to public security. For ChatGPT, the analysis also raises questions about information retrieval and the effects of AI-generated responses. 1910

Risk mitigation

The companies must adopt proportionate measures to reduce the risks they identify. The DSA’s focus is therefore not limited to documenting possible harms: designated services must show how their systems, policies, and safeguards respond to those risks. 19

Independent audits

The services must undergo annual independent audits of their compliance and risk-management arrangements. These audits add an external review layer beyond a company’s own disclosures and internal assessments. 1610

Data access for regulators and researchers

The companies must provide the European Commission and vetted researchers with access to relevant data needed to evaluate systemic risks and compliance. This gives outside reviewers a route to examine how the services operate at scale, subject to the DSA’s access framework. 16

Who supervises the services?

The European Commission becomes the principal DSA supervisor for designated VLOPs and VLOSEs. It works with national Digital Services Coordinators and can request information, review compliance materials, inspect premises, require corrective action, and pursue formal investigations where appropriate. 12

That arrangement matters because supervision is no longer limited to the national authority in the country where a company has a legal presence. The Commission can assess the largest services through a coordinated EU-level process, including their systemic-risk assessments, mitigation measures, audit reports, and data-access arrangements. 12

When must they comply?

The three services have four months to comply with the additional obligations, with reporting from the Commission and European news organizations placing the deadline at the end of November 2026. 3710

The designation does not mean every obligation begins from scratch on the deadline. Rather, the four-month period gives the newly designated services time to implement the additional requirements that apply specifically to the DSA’s highest-impact category.

What are the possible penalties?

A serious infringement of the DSA can lead to a fine of up to 6% of a company’s worldwide annual turnover. 5910

The Commission’s supervisory powers also make compliance more consequential than a one-time disclosure exercise. It can seek information, examine a company’s safeguards and risk assessments, and demand corrective action. 12

Why the decision matters beyond these three services

The designation signals that EU digital regulation is being applied to services according to their function and societal reach, not only according to traditional categories such as social network, marketplace, or search engine. ChatGPT’s VLOSE status brings a mass-market generative-AI service into the same high-impact regulatory architecture used for the largest online services. 14

It also expands the practical scope of the DSA’s most demanding rules across online discussion, gaming, and AI-powered information retrieval. The common trigger is scale, but the risks regulators examine will differ by service: user-generated content and minors are central concerns for platforms such as Reddit and Roblox, while information quality, retrieval, and AI-generated answers are especially relevant to ChatGPT. 19

Finally, the designations are likely to intensify debate over how the EU regulates large technology companies headquartered outside the bloc. The Commission presents the DSA framework as technology-neutral and tied to services’ impact and user reach, while critics of EU digital regulation have argued that its compliance burden falls heavily on major technology companies. The immediate legal effect, however, is clear: ChatGPT, Reddit, and Roblox must now meet the DSA’s highest level of ongoing accountability in the EU. 17