The European Commission has formally placed ChatGPT, Reddit and Roblox under the Digital Services Act’s toughest tier of oversight. The 31 August 2026 designations are not voluntary pledges: ChatGPT is now a Very Large Online Search Engine, while Reddit and Roblox are Very Large Online Platforms. All three have four months, until January 2027, to meet the additional duties.
Key takeaways
- ChatGPT, Reddit and Roblox each declared at least 45 million average monthly users in the EU, triggering formal designation.
- The Digital Services Act requires very large services to assess and reduce systemic risks, including illegal content, harm to minors, threats to fundamental rights and election risks.
- The Commission’s official list records 159.1 million EU users for ChatGPT, 57.2 million for Reddit and 46.6 million for Roblox.
- The three services must comply with the extra obligations by January 2027 and will face direct European Commission supervision.
The distinction matters. An earlier version of this draft described the companies as choosing to follow the rules before being ordered to do so. The Commission’s 31 August designation announcement shows that this is now a binding regulatory status, not a voluntary standard. Bloomberg Law, Deutsche Welle and El País independently reported the same formal designations on the day of the decision.
In practical terms, the Digital Services Act now makes OpenAI, Reddit and Roblox responsible not only for responding to individual complaints but also for examining how their services can create harm at scale. That means documented risk assessments, mitigation measures, independent audits, greater transparency and closer access for regulators and eligible researchers.
Why the Digital Services Act designation happened
The Digital Services Act, usually shortened to DSA, applies a graduated set of obligations to online intermediaries in the European Union. The largest tier begins when an online platform or search engine reaches at least 45 million average monthly active recipients in the EU, roughly one-tenth of the bloc’s population.
The threshold is based on service reach, not on a regulator deciding that a company is inherently unsafe. Each provider declared user figures above the statutory line. The Commission then designated the relevant services under Article 33 of the law.
The Commission’s official register of supervised services, updated on 31 August, lists 159.1 million average monthly active users for ChatGPT, 57.2 million for Reddit and 46.6 million for Roblox. ChatGPT sits far above the threshold, while Roblox clears it by 1.6 million users. Those are the Commission’s recorded EU figures, not global user totals.
What changes for ChatGPT under the Digital Services Act
ChatGPT is the unusual case in this group. The Commission designated OpenAI’s chatbot as a Very Large Online Search Engine, or VLOSE, rather than as a social network. Deutsche Welle reported that it is the first standalone AI chatbot brought into this highest DSA tier.
That classification puts a generative AI answer service into a framework originally associated with search engines and large platforms. The core regulatory question is no longer limited to whether one answer is wrong. OpenAI must assess whether its service and algorithmic systems can create systemic risks across millions of interactions.
Those risks can include the spread of illegal material, effects on fundamental rights, election integrity, public security, public health and users’ physical or mental wellbeing. The Commission’s announcement does not say ChatGPT has violated the law. It says the service’s reach is large enough that OpenAI must document the risks and show how it reduces them.
For an AI system, mitigation could involve changes to safety testing, complaint handling, transparency and monitoring. The exact measures remain the provider’s responsibility and will depend on the risk assessment. The DSA does not prescribe one universal content filter, and it does not make the Commission the editor of individual answers.
Commercial features may also receive more scrutiny as ChatGPT evolves. Lapaas Voice has separately examined the growth of ChatGPT’s advertising business. Under the DSA, very large services face detailed transparency expectations around advertising and recommendation systems, making product design and compliance increasingly connected.
What changes for Reddit and Roblox
Reddit and Roblox received the VLOP label because users create, share and interact with content on both services. Yet their risk profiles differ sharply, so their mitigation plans should not look identical.
Reddit organises public discussions into topic-based communities. Its systemic assessment must consider how community moderation, ranking systems and platform-wide policies interact. Illegal content, coordinated manipulation, hate campaigns and threats to public debate can move differently across a network of independently moderated communities than across a conventional social feed.
Roblox combines user-generated games, social interaction and a large youth audience. The Commission specifically names negative effects on minors and users’ wellbeing among the systemic risks covered by the new duties. That makes age-appropriate design, contact controls, reporting systems and the visibility of harmful experiences central questions for Roblox.
The DSA already bans targeted advertising to children and requires platforms to take steps to protect minors from inappropriate content. Very-large-service status adds a broader layer: Roblox must examine how the design of the whole service may amplify risk, then report and audit its response.
| Service | DSA category | EU monthly users | Distinct compliance focus |
|---|---|---|---|
| ChatGPT | VLOSE | 159.1m | Systemic risks from AI-generated answers and algorithmic systems |
| VLOP | 57.2m | Community moderation, ranking and coordinated harm | |
| Roblox | VLOP | 46.6m | Protection of minors in games and social interaction |
Digital Services Act duties the three services now face
The additional obligations begin with a recurring cycle: identify systemic risks, adopt proportionate measures, test the response and publish evidence. The law also requires independent annual audits for VLOPs and VLOSEs. EU audit rules say the first audit obligation starts four months after designation and the audit must be completed within a year from that point.
Risk assessment is broader than counting removed posts. It examines how design choices, algorithms and business systems may affect illegal content, fundamental rights, media pluralism, elections, public security, gender-based violence, minors, health and wellbeing. A service must then explain what it did to reduce the identified risks.
Transparency duties include reports about content moderation and the operation of recommendation systems. Eligible vetted researchers can receive access to certain platform data so that outside experts can study systemic risks. Very large platforms also maintain public advertising repositories, while users of large platforms can choose a feed that is not based on profiling.
What users may notice—and what they may not
Some DSA protections already apply across online platforms, including explanations for content removals, appeal routes and mechanisms for reporting illegal material. Designation adds stronger systemic obligations, so the first visible changes may be in policies, transparency reports and product controls rather than a dramatic redesign on day one.
ChatGPT users could eventually see clearer explanations of safety limits and improved routes for challenging or reporting problematic outputs. Reddit users may receive more transparency about recommendation choices and moderation. Roblox users and parents may see stronger default protections, age-sensitive settings or more evidence about how child-safety risks are measured.
Those examples are possible implementation choices, not measures already announced by the three companies. The final form will depend on their risk assessments and discussions with regulators. The designation itself does not prove a violation and does not guarantee that every harmful item will be detected.
The decision also does not replace the EU AI Act, data protection law or consumer law. ChatGPT may face obligations under several rulebooks because those laws regulate different questions. Similar overlaps will grow as AI reaches more consumer products, including devices such as voice-guided smart glasses.
Who will enforce the new duties
The European Commission is primarily responsible for supervising the extra VLOP and VLOSE requirements. It will work with Ireland’s Digital Services Coordinator for ChatGPT and with the Netherlands’ coordinator for Reddit and Roblox, reflecting where the providers are established or represented in the EU.
The Commission can request information, inspect systems, open formal proceedings and impose remedies. Under Article 74 of the DSA, a serious intentional or negligent infringement can lead to a fine of up to 6% of the provider’s total worldwide annual turnover in the preceding financial year. That is a maximum, not an automatic penalty attached to designation.
Enforcement history shows that designation creates an ongoing relationship rather than a one-time certification. The Commission’s register records requests for information, proceedings, preliminary findings, commitments and fines involving previously designated services. ChatGPT, Reddit and Roblox now enter that same supervisory system.
What happens by January 2027
The immediate clock is four months from notification. The Commission states that the three services must meet the additional obligations by January 2027. During that period, each provider needs to map relevant systemic risks, establish mitigation measures and prepare its governance and reporting processes.
January is a compliance starting line, not the end of scrutiny. The annual risk-assessment and audit cycle continues, while regulators can ask for information or investigate specific concerns. New product features can also create new risks that require updated analysis.
Everyone else is reporting that three popular US services crossed an EU user threshold; the more important mechanism is that each must now prove how it identifies and reduces harm produced at scale. For businesses building AI, community or gaming products, that mechanism is the signal to watch. Once a service becomes systemically large in Europe, compliance becomes a product, data and governance function—not merely a legal notice.
FAQs
Did the EU ban ChatGPT, Reddit or Roblox?
No. The European Commission designated the services for stricter oversight under the Digital Services Act. They can continue operating, but they must meet extra risk, transparency and audit obligations.
Why is 45 million users important under the Digital Services Act?
It is the statutory threshold for designation as a Very Large Online Platform or Very Large Online Search Engine in the EU. The threshold represents about 10% of the EU population.
When do the new rules apply to the three services?
The Commission says ChatGPT, Reddit and Roblox have four months after notification, until January 2027, to comply with the additional obligations for very large services.
Is ChatGPT a platform or a search engine under the DSA?
The Commission designated ChatGPT as a Very Large Online Search Engine. Reddit and Roblox were designated as Very Large Online Platforms.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
