On August 31, 2026, the European Commission designated ChatGPT, Reddit, and Roblox as very large services under the Digital Services Act (DSA). The classification wasn't based on any specific violation, but on scale: each service reaches more than 45 million monthly users within the EU. ChatGPT was classified as a search engine because it functions as a hybrid service, answering user queries while also conducting web searches. Reddit and Roblox, meanwhile, qualify as online platforms because they publish content and games created by third parties. Four months after notification, all three companies will be required to continuously assess systemic risks across their entire services.
Not a Finding of Violation, But a Move to a Higher Tier Based on Scale
Article 33 of the DSA states that the European Commission may designate online platforms and search engines as "very large" once they reach 45 million or more monthly active users within the EU. All three services reported user numbers exceeding this threshold. The Commission's announcement does not constitute a ruling that any specific response, post, or game is illegal. It is also separate from any takedown order or fine.
All three companies were already subject to the DSA's general obligations. OpenAI provides channels for reporting illegal content and appealing moderation decisions, while Reddit and Roblox also offer reporting and appeals procedures for EU users. What changes with this designation is that, in addition to processing individual reports, companies must now regularly assess the broader impact of their service design and algorithms—and make the results available for audit.
The designation triggers additional obligations reserved for very large services. Under Article 33(6) of the DSA, these obligations take effect four months after providers are notified. The Commission's announcement calls for compliance by January 2027, meaning the designation has started the clock on legal compliance.
ChatGPT and Reddit are based in Ireland within the EU, while Roblox is based in the Netherlands. As a result, the Commission will supervise the first two services in cooperation with Ireland's Coimisiún na Meán, and Roblox in cooperation with the Netherlands' Authority for Consumers and Markets. With these three additions, the total number of DSA-designated very large online platforms and search engines now stands at 28.
How Far Above the 45 Million Threshold Each Service Stands
Comparing each company's EU user figures—disclosed for DSA compliance purposes—against the 45 million designation threshold reveals significant differences in margin. However, the measurement periods and scope are not uniform across companies. The comparison below focuses solely on how far each service exceeds the threshold, not on market share.
| Service | Reported Figure | Measurement Period | Margin Above 45 Million Threshold |
|---|---|---|---|
| ChatGPT Search | approx. 159.1 million | 6-month average through March 31, 2026 | approx. 3.54x, approx. 114.1 million above |
| up to 57.2 million | Average for Jan. 1–June 30, 2026 | up to approx. 1.27x, up to 12.2 million above | |
| Roblox | estimated 46.6 million | 6-month average through Aug. 13, 2026 | approx. 1.04x, 1.6 million above |
Roblox's figure of 46.6 million is the company's own estimate. Against the DSA's 45 million threshold, ChatGPT Search's approximately 159.1 million users represents roughly 3.54 times the threshold, exceeding it by about 114.1 million. Reddit's disclosed figure of up to 57.2 million represents up to roughly 1.27 times the threshold, exceeding it by up to 12.2 million. Roblox's 46.6 million represents about 1.04 times the threshold, exceeding it by just 1.6 million—the closest margin among the three. Notably, OpenAI's figure covers only ChatGPT's online search feature rather than ChatGPT as a whole, and Roblox has cautioned that its calculation method differs from its own DAU and regional metrics. This table therefore cannot be used to rank the three services by usage frequency or market strength.
Still, the legal trigger for designation is the same across all three. Whether the service type is an AI chatbot, a discussion forum, or a game-creation platform, reaching 45 million or more users in the EU and being designated by the Commission brings the same tier of oversight.
Risk Assessment and Audits Take Priority Over Takedown Counts
What becomes most burdensome under the higher tier isn't tallying how many pieces of content were removed, but identifying systemic risks generated by the service and its algorithms and verifying mitigation measures. Articles 34 and 35 of the DSA require assessment of the spread of illegal content and impacts on fundamental rights. This includes adverse effects on minors and users' physical and mental health, as well as impacts on electoral processes and public safety.
The scope of assessment extends beyond the mere presence of illegal content to include service design and features, related algorithms, and patterns of use. Companies must implement mitigation measures that are reasonable, proportionate, and effective in addressing identified risks. The DSA doesn't simply call for stricter moderation—it also requires assessing how mitigation measures themselves affect fundamental rights.
This obligation isn't something that can be satisfied by a one-time revision of published terms of service. Very large services must undergo an independent audit, at their own expense, at least once a year. Authorities, including the Commission, can request access to data necessary for oversight, and vetted researchers who meet certain conditions will also gain a data-access pathway for investigating systemic risks.
Independent audits and data access serve different roles. Audits periodically verify the mechanisms companies use to comply with obligations, while authority access is used to confirm information necessary for oversight. Adding a pathway for vetted researchers ensures that systemic risk investigation isn't confined solely to companies and regulators.
All three companies already had reporting and appeals channels before designation, but going forward they will need to explain the connection between product changes and risk assessments, and maintain records that auditors and authorities can trace. The Commission will gain authority to investigate the features and related systems underlying these services. If intentional or negligent violations are found, fines under Article 74 of the DSA can reach up to 6% of a company's total worldwide annual revenue from the previous fiscal year. However, the designation itself does not carry any fine.
What It Means to Classify ChatGPT as a Search Engine
ChatGPT's designation is a case where the DSA category was determined by function rather than by the service's name. The Commission cited the fact that ChatGPT, as an AI system, responds to user prompts and queries, and can search the web while doing so. As a result, it treats the service as a hybrid combining AI and online search.
It wasn't the label "generative AI" but the search functionality and scale of use that determined the regulatory tier. The regulatory entry point isn't determined by whatever product category a company claims for itself.
The classification of Reddit and Roblox is based on mechanisms through which users disseminate third-party content to the public. In ChatGPT's case, by contrast, at least the disclosed user figures apply specifically to "ChatGPT Search." Public documents alone cannot confirm exactly how far the additional obligations extend to cover the boundary between the ordinary conversational feature and the web search feature. How the targeted functions and measurement methods are defined during future risk assessments and audits will be the practical dividing line.
The Commission's announcement states that all three companies must comply with the additional obligations by January 2027, four months after notification. The legal starting point is each company's individual notification date, and the public statement does not specify an exact effective date. What will determine whether this designation actually changes product operations is which functions each company targets in its initial risk assessment, and how much verifiable data it presents in the independent audit.