ChatGPT, Reddit, and Roblox Designated Under the DSA

On 31 August 2026, the European Commission designated ChatGPT as a Very Large Online Search Engine (VLOSE), and Reddit and Roblox as Very Large Online Platforms (VLOPs), under the Digital Services Act (DSA). All three companies declared they reach at least 45 million average monthly users in the EU, the threshold that triggers designation. ChatGPT’s designation is notable on its own: it’s the first standalone AI service to be classified this way, putting it under the same content-related scrutiny as established platforms and search engines.

Key Takeaways

• ChatGPT, Reddit, and Roblox now have until January 2027, four months from notification, to meet the DSA’s additional obligations for very large platforms and search engines.

• Those obligations center on systemic risk assessment: identifying and mitigating risks tied to illegal content, harm to minors, users’ physical and mental wellbeing, fundamental rights, electoral processes, and public security, backed by annual independent audits and public transparency reports.

• DSA non-compliance is expensive. The Commission’s first DSA fine, €120 million against X in December 2025, shows it actively enforces the obligations, and the maximum penalty for a breach is 6% of a company’s global annual turnover.

What Did the European Commission Announce?

The Commission designated ChatGPT as a VLOSE and Reddit and Roblox as VLOPs under the DSA. The distinction between the two categories comes down to function: the Commission classifies ChatGPT as a search engine for this purpose, while it treats Reddit and Roblox as online platforms because both let users publicly disseminate content posted by other users.

This addition brings the total list of designated VLOPs and VLOSEs to well over 20, alongside platforms like Google, Meta, LinkedIn, X, TikTok, AliExpress, Temu, Shein, Booking.com, and WhatsApp. The Commission maintains the full list and updates it as it makes new designations.

What Triggers a VLOP or VLOSE Designation?

Under Article 33 of the DSA, a platform or search engine crosses into VLOP or VLOSE territory once it reaches 45 million average monthly active users in the EU, roughly 10% of the EU’s population. Once a service self-reports or is found to meet that threshold, the Commission issues a formal designation decision, which starts a four-month clock for the service to comply with the extra obligations that come with the status.

What Extra Obligations Come With VLOP or VLOSE Status?

Once designated, a service takes on obligations that go well beyond the DSA’s baseline rules for smaller platforms.

What Does the Systemic Risk Assessment Requirement Cover?

VLOPs and VLOSEs have to identify, analyse, and assess systemic risks stemming from their service, including the spread of illegal content, negative effects on minors, risks to users’ physical and mental wellbeing, harm to fundamental rights, and risks to electoral processes and public security. The assessment has to account for how the platform’s terms and conditions, advertising systems, and recommender or algorithmic systems can drive those risks, alongside content moderation itself.

What Does the Independent Audit Requirement Involve?

Designated services must submit to an independent audit at their own expense at least once a year, covering how effectively they’re managing the systemic risks identified in their risk assessment. Within three months of receiving the audit report, the platform has to publish a report covering its risk assessment and the mitigation measures it has put in place.

What Happens If a Company Doesn’t Comply?

Non-compliance carries real financial exposure. The DSA sets a maximum fine of 6% of a company’s global annual turnover for failing to meet its obligations, with a separate cap of 1% for supplying incorrect, incomplete, or misleading information to the Commission or failing to submit to an inspection. The Commission can also impose periodic penalty payments of up to 5% of a company’s average daily worldwide turnover for continued non-compliance.

This isn’t theoretical. In December 2025, the Commission issued its first DSA fine, €120 million against X, for a misleading blue-checkmark verification system, an inadequate advertising repository, and blocking researchers from accessing public platform data. In the same announcement, TikTok avoided a fine over a similar advertising transparency issue by agreeing to binding commitments with the Commission instead, a reminder that cooperating early tends to produce a better outcome than waiting for enforcement.

Why Does This Matter Beyond These Three Companies?

ChatGPT’s designation as a VLOSE signals that standalone AI services aren’t outside the DSA’s reach simply because they don’t look like a traditional social platform or search engine. Any AI product, platform, or marketplace approaching the 45 million EU user mark should treat this designation as a preview of what’s coming: a formal systemic risk assessment obligation, annual independent audits, and public reporting requirements that go well beyond a standard privacy programme.

For businesses already managing GDPR obligations, it’s worth noting that a DSA systemic risk assessment and a GDPR Data Protection Impact Assessment (DPIA) aren’t interchangeable; a DPIA looks at risks to personal data specifically, while a systemic risk assessment looks more broadly at societal and platform-level risks tied to a service’s design. A platform nearing VLOP or VLOSE status will likely need both.

Conclusion

The DSA’s reach is expanding, and it’s no longer limited to the platforms most people would immediately think of as “social media.” ChatGPT’s designation as a VLOSE is the clearest signal yet that AI-driven services fall inside its scope once they hit scale, and the compliance deadline is real: January 2027, backed by fines that have already reached €120 million in practice.

GDPRLocal can help you assess where GDPR and DSA obligations overlap for your organisation, particularly around AI governance and risk assessment.

Frequently Asked Questions

What is a Very Large Online Platform (VLOP) under the DSA?

A VLOP is an online platform that reaches at least 45 million average monthly active users in the EU. Once designated, it takes on extra DSA obligations, including systemic risk assessments, annual independent audits, and public transparency reporting.

Why was ChatGPT classified as a search engine rather than a platform?

The Commission designated ChatGPT as a Very Large Online Search Engine because of the function it performs for users, rather than as a Very Large Online Platform, the category used for services like Reddit and Roblox that let users publicly share content created by other users.

How long do newly designated platforms have to comply with DSA obligations?

Four months from the date of the Commission’s designation decision. For ChatGPT, Reddit, and Roblox, designated on 31 August 2026, the compliance deadline is January 2027.

What are the penalties for failing to comply with the DSA?

Up to 6% of a company’s global annual turnover for breaching DSA obligations, with a lower 1% cap for providing misleading information or failing to submit to an inspection. The Commission can also impose ongoing daily penalty payments for continued non-compliance.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It is not a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.