The news
Primary press: Commission press release IP/26/1772, Brussels, 31 August 2026 (PDF updated 1 September 2026). Official PDF: IP_26_1772_EN.pdf.
Commission framing: ChatGPT is an AI system that engages with user prompts and queries, including by searching the web, and therefore qualifies as a hybrid online search engine under the DSA. Reddit and Roblox qualify as online platforms because users disseminate third-party content to the public.
Background line in the press release: the Commission has now designated 28 very large online platforms and search engines under the DSA.
Henna Virkkunen (Executive Vice-President for Tech Sovereignty, Security and Democracy), quoted in the release: the designations put ChatGPT, Reddit, and Roblox under a higher standard of scrutiny "in line with their large impact on our citizens and society."
Who is bound
| Service | DSA type | Provider (list page) | Avg monthly users (provider-reported)* | DSC |
|---|---|---|---|---|
| ChatGPT | VLOSE | OpenAI Ireland Limited | 159.1M | Ireland (Coimisiún na Meán) |
| VLOP | Reddit Netherlands B.V. | 57.2M | Netherlands (ACM) | |
| Roblox | VLOP | Roblox (EU legal rep in NL) | 46.6M | Netherlands (ACM) |
*As reported by the provider on the Commission's list of designated VLOPs and VLOSEs (page updated 31 August 2026), without prejudice to Commission methodology review.
Press release division of labour: Commission supervises DSA compliance in cooperation with Coimisiún na Meán for ChatGPT and ACM for Reddit and Roblox. The designation decision PDFs for these three are marked "decision not yet available" on the list page as of that update.
All three were already under general DSA obligations for online platforms / search engines. The designation is the upgrade to the very-large tier.
Systemic-risk clock (~January 2027)
DSA rule of thumb for VLOPs/VLOSEs: enhanced obligations apply from four months after notification of the designation decision (DSA enforcement overview).
The press release states the same clock in plain language: following notification, the services have four months, i.e. by January 2027, to comply with additional DSA obligations for VLOPs and VLOSEs. Named examples:
- assessing and mitigating systemic risks from the service and its algorithmic systems;
- risks related to illegal content dissemination;
- negative effects on minors;
- users' physical and mental well-being;
- fundamental rights;
- electoral processes;
- public security.
Exact calendar day inside January 2027 depends on the notification date on the designation decision. That decision PDF is not yet posted on the Commission list page. Treat "by January 2027" as the Commission's own rounding until the decision text is public. UNKNOWN: precise notification timestamp and any interim measures.
What the Commission gains immediately on designation language: investigative powers to assess functionalities behind these services and related systems, with shared supervision alongside the DSCs.
What this does NOT settle (vs AI Act pieces already live)
The Frontier already has a live dispatch on the OpenAI DSEwiki / Article 55 filing gap (eu-ai-act-dsewiki-incident-filing). Keep the instruments separate:
- DSA VLOSE ≠ AI Act systemic-risk GPAI. VLOSE is a DSA size-and-service designation for an online search engine. AI Act systemic-risk rules for general-purpose AI models are a different title, with different triggers, reporting channels, and fine bases.
- January 2027 DSA systemic-risk assessments ≠ Article 55 serious-incident findings. A VLOSE risk assessment under DSA Articles 34/35 (as applied to search engines) does not automatically classify DSEwiki or any other episode as an AI Act serious incident.
- GPAI Code of Practice clocks stay on their own rails. Five-day / fifteen-day Code clocks for specified cyber and serious-harm categories are not replaced by the DSA four-month designation clock.
- Receipt of an AI Act incident report is not decided here. Commission confirmation that OpenAI filed something over DSEwiki remains a separate fact pattern. Filing date and Article 55 classification remain UNKNOWN on that record.
- KIDS Act / age-stairs proposals (if advancing in parallel) are again separate legislative tracks. Do not fold them into this designation.
If counsel treats "ChatGPT is VLOSE" as closing the AI Act homework, that is a category error. It adds a DSA enhanced-obligations workstream with a ~January 2027 compliance target and Commission investigative reach. It does not relabel prior GPAI incident questions.
Operator read
- OpenAI Ireland: map ChatGPT product surfaces that look like search (web-browsing answers, citation flows, ranking-like retrieval) into DSA VLOSE systemic-risk methodology before the four-month mark.
- Reddit / Roblox operators: parallel VLOP workstreams under ACM cooperation; do not copy-paste a ChatGPT VLOSE memo.
- Buyers and enterprise counsel in the EU: ask vendors which legal regime a questionnaire is testing (DSA very-large tier vs AI Act GPAI). A single "we are designated" slide is not an answer.
- Watch the Commission list page for the missing designation decision PDFs. Until those post, notification day and any annexes remain UNKNOWN.