When a Chatbot Becomes a Search Engine: Lessons from the Commission’s Latest DSA Designations

ChatGPT is now a search engine. At least, that's how Brussels sees it.

On 31 August, the European Commission designated ChatGPT as a Very Large Online Search Engine (VLOSE) under the Digital Services Act (the DSA), and named Reddit and Roblox as Very Large Online Platforms (VLOPs). All three had self-reported crossing the 45 million average monthly EU user threshold that triggers the DSA's top supervisory tier; ChatGPT by some distance (OpenAI reported around 159 million monthly users for its search function), Reddit at 57.2 million, and Roblox scraping over the line at roughly 46.6 million.

The Reddit and Roblox designations follow familiar logic: both enable users to disseminate third-party content to the public at scale, squarely engaging the DSA's VLOP category. The significant development is ChatGPT.

The Commission has concluded that ChatGPT is what it calls a "hybrid service": a generative AI system that, because it can search the web in response to user prompts, functions as an online search engine for the purposes of the DSA. That is a first for any AI assistant, and the implications reach well beyond OpenAI. VLOSEs face systemic risk assessment obligations, independent annual audits, and advertising transparency requirements that most generative AI products have not previously confronted, at least not under this particular regime. Any other AI assistant with live web-search or retrieval features will be reading this designation closely.

What the designation requires

All three services now have four months from notification (so until January 2027) to comply with the full VLOP/VLOSE obligation set under the DSA. The core requirements include:

• Systemic risk assessments covering the dissemination of illegal content, negative effects on minors, harm to users' physical and mental well-being, risks to fundamental rights, threats to electoral processes, and impacts on public security.
• Independent audits conducted by accredited third parties, verifying the adequacy of those assessments and the mitigation measures adopted.
• Enhanced transparency reporting, including obligations around recommender system transparency and, for VLOSEs, advertising transparency.
• Researcher data access, enabling vetted independent researchers to scrutinise systemic risks.

Non-compliance with the requirements of the designation carries fines of up to 6% of global annual turnover. The designation brings the running total of designated VLOPs and VLOSEs to 28.

Implications for advisers

The EU Artifical Intelligence Act (AI Act) is not the only rulebook in play. OpenAI already carries obligations under the AI Act, including, depending on the classification of its models, duties relating to risk management, transparency, and the provision of technical documentation for general-purpose AI models. The DSA designation layers a parallel set of obligations on top (content moderation, recommender system transparency, researcher data access) that do not map neatly onto the AI Act framework. Identifying where the two regimes converge and where they impose distinct or potentially conflicting requirements will be substantive work for in-house teams, not a box-ticking exercise.

This is a live category, not a static list. Executive Vice-President Henna Virkkunen's statement accompanying the designation was explicit: the Commission "will not hesitate to designate any platform that meets the threshold for enhanced supervision under the Digital Services Act." Any service with retrieval, ranking, or recommendation features and a substantial EU footprint should treat designation as a question of "when," not "if," and begin systemic risk assessment groundwork now rather than in the third month of a four-month compliance window.

The functional test matters more than the label. The Commission's approach turns on what a service does, not what it calls itself. A chatbot with web-search capabilities is a search engine. An immersive gaming platform that enables users to share content at scale is subject to the same obligations as a social network. This round of designations is a pointed reminder that the VLOP/VLOSE threshold catches services that do not think of themselves as "platforms" in the traditional sense.

Getting ahead of the curve

In our experience advising US technology companies on EU regulatory exposure, the recurring pattern is that the compliance conversation starts too late, often because no one flagged that a product's features had drifted into VLOP or VLOSE territory until user figures were already public. Given the Commission's tone in this round, that is a risky posture. If a product's search, recommendation, or discovery features are approaching the threshold, the time to begin the assessment is now. Four months moves faster than it sounds.

If you would like to discuss how current or future regulations impact what you do with please contact Olivia Ward, Lucy Pegler, Martin Cook, Hamish Corner or any other member in our Technology team. 

This article was written by Olivia Ward.