EU Puts ChatGPT, Reddit and Roblox Under Its Toughest Digital Rules
Brussels Tightens the Digital Net
Why the EU Just Put ChatGPT, Reddit and Roblox in Its Highest-Risk Digital Tier
The European Union has brought ChatGPT, Reddit and Roblox into the toughest tier of its Digital Services Act, dramatically increasing the regulatory scrutiny facing three of the internet’s fastest-growing services. ChatGPT has been designated a Very Large Online Search Engine, while Reddit and Roblox have been classified as Very Large Online Platforms.
The trigger is scale. Each service has declared that it reaches at least 45 million average monthly users in the European Union, crossing the threshold at which Brussels considers a digital service large enough to pose potential systemic risks to European users and society.
Why ChatGPT Is Being Treated as a Search Engine
The most striking part of the decision concerns ChatGPT. Rather than attempting to create a new regulatory category specifically for generative AI chatbots, the Commission has placed ChatGPT inside the Digital Services Act framework as a Very Large Online Search Engine.
The reasoning is rooted in what ChatGPT can now do. The service can answer users’ prompts while also searching information on the web, making it a hybrid service that falls within the EU definition of an online search engine. Reddit and Roblox are treated differently because they allow users to create, publish and distribute third-party content to the public.
That distinction matters because it shows how existing European digital legislation is beginning to stretch beyond the traditional Google-style search model. Generative AI systems increasingly sit between search engines, assistants, content platforms and recommendation systems, and Brussels is signalling that their technological novelty will not necessarily keep them outside laws written before their explosive growth.
What the ‘Very Large’ Designation Actually Means
The designation is not a finding that ChatGPT, Reddit or Roblox has broken European law. It is a consequence of their scale.
Under the DSA, services exceeding 45 million monthly users in the EU can be designated as Very Large Online Platforms or Very Large Online Search Engines. Once designated, they face additional obligations designed around the assumption that problems occurring on services of this size can have society-wide consequences rather than affecting only individual users.
The three services have four months following notification of their designations to meet the additional requirements. They were already subject to the general DSA obligations applying to relevant platforms and search services, but their new status brings them into the regulation’s highest level of oversight.
Algorithms, Children and Mental Wellbeing Come Under Scrutiny
The biggest change is the requirement to identify and mitigate what the EU calls systemic risks.
Those risks include the spread of illegal content, threats to fundamental rights, discrimination, consumer protection, public security and electoral processes. The framework also specifically examines the protection of children, gender-based violence, public health and possible negative effects on users’ physical and mental wellbeing.
That could prove particularly important for Roblox because of its large younger audience, but the obligations extend across all three designated services. For ChatGPT, questions about algorithmic behaviour, information retrieval and how users interact with AI-generated responses could increasingly become matters of regulatory examination rather than simply product design.
The Commission says mitigation could require companies to change how their services function, modify recommendation systems or devote additional internal resources to identifying and reducing systemic risks. The DSA therefore goes beyond demanding that companies publish policies: it can create pressure for changes to the actual architecture of products.
Auditors and Researchers Gain Greater Access
Designation also brings substantially greater transparency requirements.
Very large services must establish internal compliance functions and undergo independent audits at least once each year. They are expected to respond to auditors’ recommendations and provide information to regulators so compliance can be assessed.
Another potentially significant provision gives vetted researchers access to platform data where that research contributes to understanding systemic risks inside the EU. Europe has established a formal mechanism through which qualified researchers can seek information that would previously have remained within the companies themselves.
The largest platforms and search engines must also provide a recommender-system option that is not based on profiling where the relevant obligation applies, while advertising systems face enhanced transparency requirements including publicly accessible advertisement repositories.
The result is a regulatory model based not only on banning particular behaviour but on attempting to make powerful digital systems more inspectable from the outside.
Brussels Gains Powerful Investigative Tools
The designation also changes the balance of power between these companies and European regulators.
The European Commission can request information, seek access to relevant data and algorithms, conduct interviews and carry out inspections as part of investigations into potential DSA violations. It can also impose temporary measures where it believes there is an urgent risk of serious harm to users.
Those interim measures can potentially reach deep into how a service operates. The Commission gives examples including changes to recommendation systems or increased monitoring of particular material when proportionate to an identified risk.
Supervision will also involve national Digital Services Coordinators. Ireland’s Coimisiún na Meán is involved in relation to ChatGPT and Reddit, while the Netherlands’ Authority for Consumers and Markets has the corresponding role for Roblox.
The Potential Cost of Getting It Wrong
The financial consequences of serious non-compliance can be enormous.
Where the Commission establishes a breach of the Digital Services Act, fines can reach a maximum of 6% of a provider’s worldwide annual turnover. Separate penalties can also apply for failures such as supplying incorrect information or refusing to cooperate with investigative measures.
The headline figure does not mean a company automatically receives a 6% fine for an infringement. Penalties must take account of factors including the nature, gravity, recurrence and duration of the breach.
But the size of the maximum penalty gives Brussels genuine leverage. The larger the service becomes globally, the larger its theoretical financial exposure can become.
The EU has also demonstrated that the DSA is no longer merely a rulebook awaiting enforcement. Existing designated platforms have already faced investigations, compliance orders and financial penalties, meaning ChatGPT, Reddit and Roblox are entering a regime with an increasingly visible enforcement history.
Why This Matters Beyond Three Companies
The broader significance lies in how Europe is defining digital power.
A discussion forum, an immersive gaming platform and a generative AI assistant perform fundamentally different functions. Yet the EU has concluded that once digital services become large enough, their potential influence over information, users and society justifies a common layer of enhanced accountability.
ChatGPT may be the most consequential example. AI assistants are increasingly becoming gateways through which people obtain information rather than merely tools used to generate text. Treating ChatGPT as a search engine recognises that shift and suggests that regulators may increasingly judge AI products by what they actually do rather than the labels technology companies attach to them.
That could become an important precedent as competing AI assistants expand web search, shopping, recommendations, news discovery and agent-like functionality.
What Happens Next
For OpenAI, Reddit and Roblox, the immediate challenge is compliance. Within four months of notification they must satisfy the additional obligations associated with their new designation, including systemic-risk management and the heightened transparency and oversight requirements attached to the DSA’s largest services.
The more interesting question comes afterwards. Regulators will move from deciding that these services are powerful enough to warrant enhanced scrutiny to examining whether their safeguards are actually adequate.
That distinction will determine whether this designation becomes largely a compliance exercise or the beginning of significant product changes inside some of the world’s most influential digital services. For ChatGPT in particular, Brussels has now made one thing clear: becoming one of Europe’s dominant gateways to online information also means inheriting the regulatory responsibilities that come with that power.
