The European Commission has fundamentally shifted the regulatory status of generative AI by designating ChatGPT as a Very Large Online Search Engine (VLOSE). This move marks the first time an AI chatbot has been categorized under the Digital Services Act (DSA) in this capacity, effectively treating the interface not just as a conversational tool, but as a primary gateway to information for millions of citizens.

The designation follows a disclosure from OpenAI revealing that ChatGPT search reached approximately 159.1 million average monthly recipients in the EU during the six-month period ending March 31, 2026. This figure dwarfs the 45 million user threshold required for the VLOSE and VLOP (Very Large Online Platform) designations, placing OpenAI in a new tier of legal accountability alongside the world's largest tech incumbents.

The shift toward algorithmic accountability

By classifying ChatGPT as a search engine, the EU is acknowledging the hybrid nature of modern AI. The Commission noted that because the system can engage with prompts and queries by searching the web, it functions as a search engine under the legal definitions of the DSA. This is not a finding of wrongdoing, but a recognition of scale and influence.

Alongside OpenAI, the Commission designated Reddit and Roblox as Very Large Online Platforms. While these services already adhered to general DSA obligations, their new status as VLOPs subjects them to a higher standard of scrutiny. Henna Virkkunen, EU executive vice-president for tech sovereignty, security and democracy, stated that these designations ensure the companies are held accountable in line with their large impact on society.

Strict mandates for systemic risk mitigation

The transition to VLOSE status brings a heavy set of obligations that OpenAI must fulfill within a four-month window, meaning full compliance is required by the end of December 2026. The focus of these rules is the identification and mitigation of systemic risks. Specifically, OpenAI must now assess how its algorithmic systems might contribute to the spread of illegal content or negatively impact the physical and mental well-being of users.

Particular attention is being paid to the protection of minors. Under the DSA, platforms are prohibited from targeting advertisements to minors or utilizing sensitive personal data—such as religion, sexual orientation, ethnicity, or political beliefs—for ad profiling. For an AI that learns from and interacts with users in highly personal ways, these boundaries create a significant operational constraint.

Transparency and the end of the black box

One of the most disruptive aspects of the VLOSE designation is the requirement for transparency. OpenAI can no longer keep its internal processes entirely proprietary if they impact systemic risk. The company is now mandated to:

The Commission will gain investigative powers to assess the functionalities behind these services and, where applicable, any related system.

This includes sharing data with the European Commission and national authorities. Furthermore, OpenAI must allow vetted researchers access to its data to conduct qualifying research on systemic risks. This move is designed to break the information asymmetry between the AI developers and the public regulators.

Audits and the role of national coordinators

Compliance will not be self-certified. The DSA requires VLOSEs to undergo an independent audit at least once a year. OpenAI will be forced to respond to the recommendations of these auditors, creating a permanent cycle of external oversight. This ensures that the risk mitigation strategies promised by the company are actually implemented in the code and the model's behavior.

The enforcement architecture is a collaborative effort. While the Commission provides overarching supervision, the actual coordination happens at the member-state level. For ChatGPT and Reddit, the Coimisiún na Meán in Ireland will serve as the Digital Services Coordinator. For Roblox, the Authority for Consumers and Markets (ACM) in the Netherlands will take the lead, reflecting where these companies are legally established within the EU.

Operational requirements for search and ads

Beyond risk and audits, the VLOSE designation impacts the user experience. If ChatGPT continues to integrate advertising or recommendation systems, it must offer a version of its recommender system that is not based on profiling. This means users must have a choice to interact with the AI without being tracked or categorized by an algorithm designed to maximize engagement or ad revenue.

Additionally, the company must maintain a public repository of advertisements. This level of transparency is intended to prevent covert influence campaigns and ensure that the commercial interests driving AI responses are visible to the end user. As ChatGPT evolves into a primary search tool, the EU is ensuring it follows the same rules as traditional search giants.

Global implications for US and UK enterprises

For entrepreneurs and business leaders in the USA and UK, this development serves as a critical bellwether for the future of AI governance. While the US currently lacks a federal equivalent to the DSA, the EU's approach often creates a Brussels Effect, where companies adopt the strictest global standard across all markets to simplify operations.

US-based AI startups should anticipate that once they hit a certain user threshold in Europe, they will move from a light-touch regulatory environment to a regime of mandatory audits and data sharing. In the UK, where the government has historically leaned toward a more pro-innovation, non-statutory framework, the contrast is becoming stark. However, any UK firm scaling into the EU market must now budget for the legal and technical overhead of DSA compliance.

The designation of ChatGPT as a VLOSE proves that the EU does not view AI as a separate category of technology, but as a tool that fits into existing categories of information dissemination. For global businesses, this means that the regulatory risk is no longer just about the AI Act's rules on high-risk systems, but also about the operational burdens of being a massive online platform. The era of the unregulated AI growth spurt is ending, replaced by a regime of documented risk and audited transparency.

FAQ

Sources: Searchenginejournal ·