ChatGPT is now a search engine, and Brussels wants proof it's safe

The European Commission has decided ChatGPT is no longer just a chatbot — it's now, officially, a 'very large online search engine.' The designation, reported for 31 August 2026 alongside matching orders for Reddit and Roblox, pulls all three under the EU's toughest platform rulebook, the Digital Services Act (DSA).

Under the DSA, any search engine or platform that reaches at least 45 million average monthly users or recipients in the EU gets bumped into the 'very large' category — and with it, a much heavier compliance load. ChatGPT reportedly cleared that bar comfortably, with OpenAI-reported figures putting average monthly EU recipients for its search function at 159.1 million over the six months ending 31 March 2026. Reddit self-reported 'no more than' 57.2 million average monthly EU users for H1 2026, and Roblox put its own figure at 46.6 million — both, per the article, self-estimated rather than Commission-verified.

As Henna Virkkunen, the Commission's Executive Vice-President for Tech Sovereignty, Security and Democracy, put it: "These new designations mean that ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society."

Designated services get four months from notification to fall in line with a fresh set of obligations. According to the reporting, that means identifying, assessing and mitigating systemic risks; submitting to annual independent audits; sharing data with the Commission, national authorities and vetted researchers; offering a recommender system that isn't built on profiling; and, where applicable, maintaining a public ad repository.

Worth saying plainly: none of this is a finding of wrongdoing. Designation and enforcement are described as separate processes — one is a classification based on scale, the other is what happens if a company falls short of the rules that classification brings.

The real shift here is in posture, not paperwork. Teams stop treating trust, safety and transparency as functions that review the finished product, and start treating them as constraints that shape it from the outset — continuous risk assessment instead of reactive firefighting, with documentation and governance to match.

The cost is speed, opacity and unilateral control: you can't optimise purely for engagement or rapid experimentation once those choices might create systemic risk, and some internal decisions and data become externally scrutinised. Put bluntly, the trade is this — 'move fast and explain later' becomes 'prove it's safe enough to move.'

It's worth keeping the DSA and the DMA in separate boxes — they are, per the reporting, distinct legal frameworks with different targets. A binding DMA decision reported for July 2026 reportedly allows chatbots that meet the DMA's search-engine definition to access Google's search data sharing — a different lever entirely from the DSA designations covered here.

On enforcement, the article reports cumulative DSA fines to date at 870 million euros, including a 550 million euro fine against AliExpress in July 2026. DSA violations can reportedly carry fines of up to 6% of a company's global annual revenue — a figure that puts some weight behind the word 'accountability.'

The clock on that four-month compliance window is now running, according to the reporting. And for what it's worth, the designation isn't necessarily permanent — a service can reportedly be pulled back out of the 'very large' bracket if it stays under the 45-million threshold for a full year. Whether ChatGPT, Reddit or Roblox will be shrinking anytime soon is, shall we say, not the way to bet.