On August 31, 2026, the European Commission designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the Digital Services Act (Regulation (EU) 2022/2065). All three services had self-declared reaching at least 45 million average monthly users in the EU, the threshold that pulls an online service into the DSA's strictest compliance tier. They now have four months, meaning until the end of December 2026, to meet the VLOP and VLOSE obligations in full.
The designation is the Commission's first VLOP and VLOSE round of 2026, and the first to pull an AI answer engine into the regime: ChatGPT is a VLOSE because the Commission treats its web retrieval and answer synthesis as a search function routing users to information. The Commission's release confirms the three names and the four-month window.
Which services were designated, and under what tier?
Three services enter the DSA's very large tier, each under the category that matches what it does. ChatGPT is a VLOSE, the search-engine tier, because its web retrieval and answer synthesis point users to sources. Reddit and Roblox are VLOPs, the platform tier, because they host user-generated content at very large scale. Each service crossed the 45 million average monthly EU users benchmark through its own declaration to the Commission, the mechanism the DSA requires of any service that believes it has reached the threshold.
| Service | Designation | Function the DSA tier captures | Lead Digital Services Coordinator |
|---|---|---|---|
| ChatGPT (OpenAI) | VLOSE | Hybrid answer retrieval and web search | Ireland, Coimisiun na Mean |
| VLOP | User-generated content aggregation | Ireland, Coimisiun na Mean | |
| Roblox | VLOP | Immersive user-generated platform | Netherlands, ACM |
What new obligations apply, and by when?
The designation unlocks the DSA's most demanding duties, set out in Articles 33 to 43. All three services must comply by the end of December 2026. The core obligations are: assessing and mitigating systemic risks stemming from their service and algorithmic systems, covering the dissemination of illegal content, negative effects on minors, users' physical and mental well-being, fundamental rights, electoral processes and public security; submitting to independent annual audits; providing at least one recommender system not based on profiling; and giving vetted researchers access to data needed to study systemic risks. The full press release (IP/26/1772) frames the package as risk assessment, systemic mitigation and transparency.
For Roblox, the child-safety dimension is acute: the DSA's minor-protection duties, including age-appropriate design and limits on harmful contact, bear on a service whose user base skews young. For ChatGPT, the VLOSE classification extends search-engine transparency to an AI answer engine, including the duty to explain ranking and to prevent illegal content amplification through retrieval.
Who supervises the designated services?
The European Commission is the sole enforcer for VLOPs and VLOSEs, but each designated service is paired with a national Digital Services Coordinator for the day-to-day supervisory interface. Ireland's Coimisiun na Mean acts as the lead coordinator for ChatGPT and Reddit, consistent with their establishment in Ireland, while the Netherlands' Authority for Consumers and Markets (ACM) leads for Roblox. The enforcement toolkit includes fines of up to 6 percent of global annual turnover for infringements, periodic penalty payments, and, for the most serious systemic-risk failures, a binding compliance order.
Designated services can also be ordered to act on specific risks, including crisis-response measures during elections or public-health emergencies. The DSA's first designation round, in April 2023, brought 19 VLOPs and VLOSEs into the regime, including X, TikTok and YouTube; the full list of designated services now includes the three added today. This round adds the first AI answer engine and the first immersion-focused platform to that supervised set.
What should compliance teams do now?
For OpenAI, Reddit and Roblox, the four-month clock started on August 31, 2026. Trust-and-safety, legal and AI governance teams should treat the end of December 2026 as a hard internal deadline to deliver a first systemic-risk assessment, stand up the independent audit interface, and review recommender and researcher data-access plumbing. Teams operating services near the 45 million EU user mark should audit their counts now: self-declaration is mandatory once the threshold is crossed, and the Commission can designate on its own initiative if a service under-reports.
Continuous, per-jurisdiction monitoring surfaces a DSA designation the moment the Commission publishes it, which is how this development was caught here rather than weeks later in a quarterly review.
Subscribe to the free newsletter
What to do next
- Confirm whether your service is within scope of the VLOP or VLOSE tier, or approaching the 45 million EU user threshold.
- Map the obligations triggered by your specific designation, platform versus search engine, against your existing DSA compliance baseline.
- Brief trust-and-safety, AI governance, legal and public-policy teams on the end of December 2026 deadline and on the lead coordinator for your establishment.
Obsidian tracks DSA designations and the wider EU platform-governance stack as they publish, so teams can act the day a designation drops, not in the next reporting cycle.
