On 31 August 2026 the European Commission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms under the Digital Services Act. The striking classification is the first: a conversational assistant built on artificial intelligence enters the regulation on digital services not as a platform, but in the search-engine category, and with that it takes on the heaviest tier of obligations the text provides. The three services declared that they reach at least forty-five million average monthly users in the Union, the threshold that triggers designation, and they now have four months, that is by January 2027, to comply with the additional obligations.
The three designated services and the two categories
The distinction between the two categories is not nominal. The Digital Services Act classifies as very large online platforms and as very large online search engines the services that reach on average at least forty-five million active monthly recipients in the Union, ten per cent of its population, and subjects them to the regulation’s strictest regime. Reddit, a forum organised into discussion communities, and Roblox, a game and creation environment used largely by a young audience, fall within the notion of platform. ChatGPT has instead been assigned to search engines, the category designed for services that let users query, in principle, the whole set of websites starting from a question. It is the first time a generative artificial intelligence has been placed in that box.
An artificial intelligence inside the very-large-service regime
With this designation a service built on a general-purpose artificial intelligence model finds itself answering to two bodies of law at once. On one side the regulation on artificial intelligence, which governs general-purpose models and their providers; on the other the Digital Services Act, which now imposes on it the regime for very large services. The two frameworks pursue distinct aims, the safety and reliability of the model on the one hand, the management of the service’s systemic risks on the other, yet they bear on the same operator and on some of the same areas, starting with the protection of minors. The designation therefore does not arise in a legal vacuum: it adds to obligations already in force, with authorities and procedures that are in part different.
What the designation entails
Four months run from the notification of the designation, that is until January 2027, within which the three services must meet the additional obligations the Digital Services Act reserves for very large actors. The core of these obligations is the assessment of the systemic risks stemming from the service and its algorithmic systems and the adoption of measures apt to mitigate them. The regulation names the areas on which the assessment must focus: the dissemination of illegal content, the negative effects on minors, on users’ physical and mental well-being and on fundamental rights, the integrity of electoral processes and public security. To these are added the duty to undergo an independent audit and the duty to account transparently for the choices made. Supervision of these obligations falls directly to the Commission, which for very large services has its own powers of investigation and sanction, with fines that can reach six per cent of worldwide annual turnover. As observed elsewhere, under the Digital Services Act a fine is a stage, not the finish line: the aim of the machinery is compliance, not the penalty.
The protection of minors
Of the areas named, that of minors runs through all three designations. Roblox is an environment used largely by children and teenagers; ChatGPT is used by minors too, with the questions that follow for safety and well-being; Reddit hosts communities and content whose exposure to younger users has long drawn attention. This is not a new theme for the regulation: the protection of minors between default settings, design and prohibitions is one of the grounds on which the Digital Services Act and the regulation on artificial intelligence meet. The designation now brings that theme inside the most demanding regime, the one that requires risk to be measured before it materialises and the mitigating measures to be documented.
Critical profiles: the boundary of the designation
The designation raises more than one question of classification. Assigning a conversational assistant to the search-engine category is a choice the regulation does not address explicitly, because its definitions were written before these services took their current form: yet the box into which a service is placed determines which obligations apply, and on new ground the line between platform and search engine is far from obvious. There is then the coexistence of two regimes on the same operator: the provider of a general-purpose model already answers to the regulation on artificial intelligence and now also to the Digital Services Act, with procedures and authorities that will have to coordinate so as not to overlap. In the background lies the direction of travel: after the large social platforms and the services already designated, and after the structural intervention of the Digital Markets Act on large market operators, the net of very large services widens to artificial intelligence and to online gaming.
For the three services the designation opens a countdown with a precise date. By January 2027 they will have to submit the first assessment of systemic risks and the related mitigating measures, and from that point the Commission will be able to test their adequacy. For ChatGPT in particular, the knot the designation has tied remains to be undone: how the obligations of the regulation on digital services are to be reconciled with those, already in force, of the regulation on artificial intelligence. The answer lies not in the act of designation, but in the coming four months.
