The European Commission has included ChatGPT among the digital services subject to the highest level of surveillance under the Digital Services Act, designating the artificial intelligence tool as a very large online search engine in Brussels.
The regulatory status applies to digital services that exceed 45 million monthly active users within the European Union. Alongside ChatGPT, the executive body of the bloc has also subjected social discussion platform Reddit and online gaming platform Roblox to tighter legal obligations by classifying them as very large online platforms.
Figures released by European officials confirm that ChatGPT currently records 159.1 million monthly active users across the European Union. By comparison, Reddit reaches 57.2 million monthly users within the trade bloc, while Roblox registers 46.6 million monthly users.
All three tech companies have been given four months from official notification to comply with the extra statutory obligations set out in the legislation. The compliance window expires in January 2027, by which time the businesses must review how they identify, assess, and reduce risks linked to their services and algorithmic systems.
Risk assessment and systemic danger requirements
Under the mandate, the European Commission requires the platforms to address systemic risks stemming from their services and related algorithmic operations. Regulators specified that companies must target the dissemination of illegal content, potential negative effects on minors, harms to physical and mental health, threats to fundamental rights, risks to electoral processes, and dangers to public security.
The Digital Services Act serves as the single legal framework governing liability and accountability for digital intermediaries operating inside the European single market, including online search tools, social platforms, marketplaces, and network providers. Its primary goal is to foster a safer online ecosystem, safeguard human rights, and enforce accountability regarding digital advertising practices, content recommendation engines, and internal moderation choices.
Under the rulebook, child safety provisions are significantly expanded, including strict bans on certain commercial practices. The law prohibits targeted advertising directed at children and teenagers, as well as advertisement campaigns built on sensitive user profiles, including religious beliefs, sexual orientation, or ethnic background.
The legal framework also grants internet users greater protections regarding content moderation. Platforms are required to explain the specific reasons whenever they remove or restrict a user's post or account, and they must provide an accessible, official appeal mechanism for affected users to challenge those enforcement decisions.
Enhanced duties for major online services
As digital services scale in footprint and influence, their legal responsibilities under European oversight automatically escalate. Search engines and online platforms exceeding the 45 million user threshold are required to execute regular, formal risk evaluations, implement tangible risk-reduction measures, and undergo independent annual compliance audits.
The regulations mandate that designated services must open their data and systems to scrutiny by sharing information with supervisory authorities and vetted academic researchers. For OpenAI, the developer of ChatGPT based in San Francisco, California, the classification means the firm must increase transparency surrounding advertising practices, algorithms, and content moderation whenever such features form part of the service.
Preceding designations and financial penalties
The new designations expand an existing group of major tech services already brought under strict European supervision. The Commission previously designated Google Search, operated by Alphabet Inc., and Microsoft Bing as very large online search engines, while applying the rules to major platforms including Facebook, Instagram, TikTok, YouTube, X, Amazon, AliExpress, Apple App Store, and Booking.com.
Meta Platforms' messaging service WhatsApp was added to the oversight list in January 2026. However, regulatory monitoring for WhatsApp is restricted specifically to its public Channels feature rather than its private end-to-end encrypted messaging service.
The reclassification grants regulators in Brussels direct powers to monitor ongoing compliance and demand structural or operational changes if proposed risk-mitigation measures are deemed insufficient. In cases where non-compliance or infringement is established, the Digital Services Act empowers the Commission to issue financial penalties of up to 6 percent of a company's total annual global turnover.
