EU subjects ChatGPT, Reddit and Roblox to tougher online-safety rules

The European Commission has placed OpenAI’s ChatGPT, Reddit, and Roblox under its strictest digital safety regime, classifying ChatGPT as a major search engine and the other two as very large social and gaming platforms.

The decision, announced on 31 August 2026, subjects all three services to the highest supervisory tier of the European Union’s Digital Services Act (DSA). Under the law, online services reaching more than 45 million average monthly users in the EU—roughly 10 percent of the bloc’s population—are placed into two distinct high-oversight categories:

• Very Large Online Platforms (VLOPs): Consumer-facing platforms where users host, share, and interact with content, such as Reddit’s discussion boards and Roblox’s user-created virtual worlds.
• Very Large Online Search Engines (VLOSEs): Intermediary services that crawl, index, and retrieve information across the broader web, a category that now includes ChatGPT alongside traditional search engines like Google and Bing.

According to the Commission’s official register, all three easily cleared the legal threshold. OpenAI reported 159.1 million average monthly active users in the EU for ChatGPT, while Reddit declared 57.2 million and Roblox declared 46.6 million.

The companies have four months following formal notification—giving them until January 2027—to overhaul their safety systems, adjust their algorithms, and comply with the rules.

European officials emphasized that the designation does not stem from an enforcement investigation or signal any legal wrongdoing. Rather, it represents an automatic shift into the EU’s highest supervisory tier triggered solely by audience scale.

Stricter audits and risk controls

As VLOPs and VLOSEs, the three companies must now actively identify, analyze, and mitigate large-scale societal risks created by their software and recommendation algorithms. By law, they must assess potential harms across several key areas:

• Stemming the viral spread of illegal content;
• Shielding children and minors from online harm;
• Protecting users’ physical and mental wellbeing;
• Preventing their tools from undermining fundamental rights, public security, and democratic elections.

To guarantee accountability, each service must appoint dedicated internal compliance officers who report directly to company leadership and EU watchdogs. They must also pay for independent annual audits to verify their safeguards and publish detailed transparency reports at least every six months.

The framework also opens a path for academic and non-profit researchers to independently study platform risks. For confidential internal records—such as proprietary algorithms, moderation logs, and internal metrics—researchers must complete a formal vetting process to guarantee data security and user privacy. For data that is already publicly visible on the services, the companies must provide direct, automated access through tools like APIs without requiring vetting, provided the research is academic and non-commercial.

Additionally, services that deploy algorithmic recommendation feeds must provide users with at least one option that turns off behavioral profiling—allowing people to view content organized chronologically or by general popularity rather than through tracking their personal habits.

The European Commission in Brussels holds exclusive authority to enforce these systemic-risk rules, backed by the power to issue fines of up to 6 percent of a company’s global annual turnover. National telecommunications and media regulators across EU member states continue to oversee everyday consumer complaints and routine illegal-content notices.

Why ChatGPT is classified as a search engine

The most unexpected element of Brussels’ decision is the classification of ChatGPT as a VLOSE, placing a conversational generative AI chatbot into the same regulatory basket as traditional web search engines.

According to reports on the decision, European regulators consider ChatGPT a hybrid tool. Unlike early chatbots that generated responses purely from static historical training data, ChatGPT actively queries, crawls, and synthesizes live information from websites across the open internet. Under the DSA, any service that enables users to query virtually all websites meets the legal definition of a search engine. Regulators concluded that as more than 150 million Europeans turn to conversational AI for answers, the tool increasingly functions as an information gateway rather than a simple chatbot.

The Commission has not yet published the formal designation decision, meaning its detailed legal arguments remain under wraps for now.

The VLOSE designation also places OpenAI under two distinct, parallel European legal regimes. While the newly enacted EU AI Act regulates the underlying artificial intelligence models upstream—imposing technical benchmarks, copyright disclosure, and model-training standards—the DSA governs how the consumer-facing ChatGPT application retrieves, displays, and spreads information downstream.

Distinct hurdles for Reddit and Roblox

Both Reddit and Roblox face compliance challenges rooted in their product architectures:

• Reddit: The company must reconcile its decentralized, volunteer-led community moderation with the EU’s strict demand for centralized corporate liability. While unpaid moderators set independent rules for individual subreddits, the DSA holds Reddit corporate legally responsible for stopping hate speech and illegal content across the platform.
• Roblox: With tens of millions of young players, regulatory attention will focus heavily on child safety. Regulators will scrutinize Roblox’s safeguards against predatory adult behavior, grooming, deceptive design patterns, and aggressive in-game monetization inside its user-built multiplayer experiences.

The real test of the designations will begin in early 2027, when the companies must submit their initial risk assessments and undergo their first mandatory third-party audits. The move also signals a warning to competing AI developers: conversational assistants will be pulled into the EU’s toughest regulatory net as soon as their European user base crosses the 45-million threshold.