The European Commission brought ChatGPT under the strictest tier of the Digital Services Act on August 31, and the reporting since has settled into a familiar shape: Brussels cracks down on AI, OpenAI faces tough new rules, the regulatory hammer falls. Almost none of it has examined the thing that actually determines who else gets caught.
ChatGPT was not designated as an artificial intelligence service. It was designated a Very Large Online Search Engine, and the trigger was its live web-search function rather than the model behind it. That distinction is the entire story. The Commission did not need to invent a category for chatbots or wait for the AI Act’s heavier provisions to bite. It applied a functional test written in 2022 to a product that did not exist in its current form, found that the product performs search, and attached the obligations that follow. Any rival crossing 45 million monthly EU users with a live retrieval feature inherits the same treatment automatically.
The Numbers That Triggered It
ChatGPT reported roughly 159.1 million average monthly users in the EU over the six months ending March 2026, more than three and a half times the 45 million threshold that separates ordinary platforms from the systemic tier. It was designated alongside Reddit, at 57.2 million monthly users, and Roblox, at roughly 48 million. Both of those arrived as Very Large Online Platforms, the more familiar category that already covers the major social networks.
That brings the strictest DSA tier to 28 services. ChatGPT is the first standalone AI product on the list.
Supervision is split. Ireland’s Coimisiún na Meán takes ChatGPT and Reddit, the Netherlands’ Authority for Consumers and Markets takes Roblox, and the Commission retains its own enforcement powers over systemic risk.
What OpenAI Now Has To Do
Within four months of designation, OpenAI owes Brussels a compliance apparatus that most AI companies have never built:
- An annual systemic risk assessment covering illegal content, protection of minors, effects on physical and mental wellbeing, fundamental rights, electoral integrity and public security
- Independent third-party audits of that assessment and of its mitigation measures
- A public advertising repository
- Data access for vetted academic researchers studying systemic risk
The penalty ceiling is 6% of global annual turnover. For a company reported to have reached a valuation in the hundreds of billions, the fine is not the binding constraint. The researcher data-access obligation is. It forces OpenAI to hand outside academics a window into how the product actually behaves at scale, which is precisely the evidence base that has been missing from every argument about AI harms so far.
OpenAI also now sits under two regimes at once, coordinating model testing, product design and content safeguards across both the DSA and the AI Act. Those rulebooks were drafted by different people for different purposes, and reconciling them is going to be genuinely difficult rather than merely expensive.
The Capability Trigger Is the Real News
Here is what the coverage has largely missed, and what BusinessTech.News thinks is the correct read.
Brussels has quietly built a template that scales without further legislation. Because the designation keys off a capability, live web search, rather than an identity, “AI company,” it extends on its own terms. Google’s Gemini has search. Perplexity is search. Anthropic’s Claude has web retrieval. None of them are designated today, and the only thing standing between them and the same obligations is user count and time.
This is good regulatory design, and we will say so plainly even though the reflexive position in tech commentary is that any European rule is a tax on innovation. Brussels resisted the temptation to write a bespoke chatbot statute that would have been obsolete before it cleared translation. Instead it asked a narrow question with an answerable yes or no: does this product retrieve and rank the open web for users at scale? The answer for ChatGPT is obviously yes, whatever else the product also does.
The complaint worth taking seriously is not that the rule is unfair but that it is uneven in timing. OpenAI absorbs the compliance cost first and alone, while competitors with the same capability build for another year without an ad repository or an audit budget. That is a real competitive distortion, and the Commission created it by designating on user thresholds rather than on capability alone. If retrieval at scale is the risk, the threshold should catch the capability earlier, not reward the runner-up for being second.
What it should not do is retreat. The pressure to soften here will be considerable, and it will arrive dressed as concern for European competitiveness. OpenAI has already reshaped product under legal pressure once this year, shipping a teen version of ChatGPT after lawsuits rather than before them. Companies respond to enforceable deadlines. That is the argument for keeping this one.
Watch the four-month mark, and watch which of OpenAI’s competitors quietly starts building an ad repository before anyone makes them.