EU Designates ChatGPT, Reddit & Roblox for Heightened Oversight Under Digital Services Act

Key Takeaways

• EU Expands DSA Oversight: The European Commission designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms after each reported at least 45 million average monthly users in the EU.
• January Compliance Deadline: The three services have four months following notification, or until January 2027 according to the Commission, to comply with the additional DSA obligations for VLOPs and VLOSEs.
• Systemic Risk Assessments Required: The enhanced obligations include assessing and mitigating systemic risks involving illegal content, minors, physical and mental well-being, fundamental rights, electoral processes and public security.
• ChatGPT Classified as a Search Engine: The Commission considers ChatGPT a “hybrid service” that qualifies as an online search engine because it can respond to users’ prompts and queries, including by searching the web.
• Commission Gains Investigative Powers: The designation gives the Commission investigative authority to assess functionalities behind the services and, where applicable, related systems, working with regulators in Ireland and the Netherlands.

Deep Dive

The European Commission has added ChatGPT, Reddit and Roblox to the short list of digital services considered large enough to warrant the European Union’s highest level of scrutiny, giving the three companies until January to meet a more demanding set of obligations under the Digital Services Act.

The designations, announced Aug. 30 and updated the following day, follow disclosures from each service that it reaches at least 45 million average monthly users in the EU. That is the line the DSA draws between a large service and one whose scale, in the eyes of European regulators, creates risks that require a different kind of supervision.

ChatGPT has been designated a Very Large Online Search Engine, or VLOSE. Reddit and Roblox have been designated Very Large Online Platforms, or VLOPs.

The labels matter less than what comes with them. Within four months of being notified, the services will have to comply with additional DSA requirements that ask them to look beyond individual failures and examine the risks produced by their systems as a whole. The Commission specifically pointed to the dissemination of illegal content, harms to minors, effects on users’ physical and mental well-being, fundamental rights, electoral processes and public security.

For three services built for very different purposes, the regulatory logic is the same: once enough people use something, the consequences of how it works stop being confined to the people immediately involved.

“These new designations mean that ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society,” said Henna Virkkunen, the Commission’s executive vice president for tech sovereignty, security and democracy.

The Commission said it will also gain investigative powers to examine the functionalities behind the services and, where applicable, related systems. Oversight of ChatGPT and Reddit will be carried out in cooperation with Ireland’s Coimisiún na Meán, while the Commission will work with the Netherlands’ Authority for Consumers and Markets, or ACM, on Roblox. The two agencies are the Digital Services Coordinators for the countries where the respective services are established.

None of the three is entering the DSA regime for the first time. ChatGPT, Reddit and Roblox were already subject to the law’s general requirements for online platforms and search engines. Crossing the 45 million-user threshold changes the depth of the obligation and the intensity of the supervision.

ChatGPT Tests the Boundaries of an Older Category

Reddit and Roblox fit relatively neatly into the DSA’s conception of an online platform. Both allow users to make third-party content available to the public, even if what that means in practice looks very different on a discussion forum than it does inside a sprawling universe of user-created games. ChatGPT presents the more interesting classification problem.

The Commission describes it as an artificial intelligence system capable of engaging with and responding to prompts and queries, including by searching the web. That combination makes ChatGPT, in the Commission’s interpretation, a “hybrid service” that qualifies as an online search engine under the DSA.

It is an important distinction because ChatGPT does not behave like the search engines around which the category is easiest to understand. A traditional search engine points users toward information elsewhere. ChatGPT can search for information, but it can also absorb what it finds into an answer generated for the person asking the question. Search is one function inside a much broader system.

The DSA nevertheless has room for it. The Commission’s decision effectively places ChatGPT inside an existing regulatory framework on the basis of what the service does rather than insisting that its technology resemble the products that came before it.

That decision carries a practical consequence. The risks regulators examine will not necessarily end with the information ChatGPT retrieves. The Commission said its investigative powers extend to the functionalities behind designated services and, where applicable, related systems. The additional obligations themselves require assessment and mitigation of systemic risks stemming from a service and its algorithmic systems.

For AI providers, that is where the designation becomes more than a matter of classification. The DSA asks companies operating at sufficient scale to understand not merely whether a system can fail, but what happens when the same design choices, incentives or weaknesses are repeated across tens of millions of users.

Reddit and Roblox face that question from different directions. Reddit must contend with a platform organized around public discussion and user-created communities. Roblox must do so in an environment where users create, publish and play experiences made by other users, with the Commission explicitly identifying the protection of minors among the systemic risks covered by the enhanced DSA regime.

The three companies now have until January 2027 to translate those obligations into compliance programs capable of surviving regulatory examination.

Their addition brings the Commission’s count of designated very large online platforms and search engines to 28. That number will almost certainly matter less to the companies involved than the threshold behind it. Forty-five million monthly users is not simply a measure of popularity under the DSA. It is the point at which Brussels begins asking not only what a digital service provides to its users, but what a service of that size can do to the systems around them.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.