The EU has designated ChatGPT a search engine because it searches the web

On August 31, the European Commission designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act. In its full announcement, the Commission calls ChatGPT a hybrid service because it engages with and responds to prompts and queries, including by searching the web. That combination brings ChatGPT into the online-search category.

ChatGPT reported 159.1 million average monthly active users in the EU over the six months ending March 31, 2026, according to the Commission register. Reddit reported 57.2 million and Roblox 46.6 million; the Commission placed both in the Very Large Online Platform category in the same announcement.

All three clear the 45 million threshold. ChatGPT's figure is more than three times that level. It now joins Google Search and Bing as the third VLOSE currently listed in the Commission's highest oversight tier. The Commission gives the three services four months, to January 2027, to comply with the additional rules.

The DSA definition covers the format, not the scope

Article 3(j) of the Digital Services Act defines an online search engine as an intermediary service where users submit queries to search, in principle, all websites or all websites in a particular language. The results can arrive “in any format.”

The output wording accommodates a generated paragraph as readily as a ranked page of blue links. The scope wording is less tidy because ChatGPT does not index all websites. It can retrieve pages and then compose a fresh answer from them, with wording that varies across users, languages, and repeated runs of the same prompt.

Auditing generated answers goes beyond URL removal

OpenAI must now apply the DSA's systemic risk assessment to ChatGPT's retrieval-plus-composition behaviour. The Commission names risks involving illegal content, minors, physical and mental wellbeing, fundamental rights, elections, and public security. Article 34, summarized in the Commission's Q&A for very large services, requires risk assessments at least annually and before deploying functionality likely to affect those risks. Article 35 obliges providers to adopt mitigation measures, while Article 37 mandates an independent compliance audit each year.

Article 42(4) requires providers to publish their risk assessment, mitigations, audit report, and response to audit recommendations. VLOPs and VLOSEs must also publish transparency reports at least every six months, with the first report carrying the additional requirements due no later than six months after designation. For ChatGPT, that puts the first enhanced report around the end of February 2027.

An audit of a generated-answer system would likely need evidence across prompts, languages, retrieved sources, model versions, and repeated runs. A URL-removal log alone would not show whether the system handles the same risk consistently across those conditions.

The designation is settled; compliance still has to be demonstrated

A Hacker News discussion questioned whether the DSA's requirements are specific enough to apply meaningfully to a chatbot. One useful distinction in the thread concerned the service layer. The designation applies to ChatGPT as a hosted service. It does not automatically place the same obligations on model weights that somebody runs privately or on a smaller host that has not crossed the threshold.

The Commission's notice is narrower than some online reaction suggests. It does not announce a fine, ban ChatGPT, or classify it as a social network. ChatGPT was already subject to the DSA's general obligations for search engines. The designation adds the largest-service tier and gives the Commission powers to examine the service's underlying functionality and, where applicable, related systems.

The classification, trigger, and timing are settled. ChatGPT combines prompt responses with web search, its reported audience clears the 45-million-user threshold, and the additional obligations apply by January 2027. OpenAI will have to demonstrate how its generated-answer system measures and mitigates systemic risk. As of September 1, its register entry still marks the designation decision as unavailable.