Three services that most Europeans use without thinking about regulation crossed a legal line this summer, and the European Commission moved on 31 August to make that crossing official. The DSA designation now covers ChatGPT, which the Commission treats as a Very Large Online Search Engine, alongside Reddit and Roblox, which it classes as Very Large Online Platforms. All three passed the threshold that the Digital Services Act sets at 45 million average monthly users in the Union.
The numbers explain the timing. OpenAI reported that the search function inside ChatGPT averaged roughly 159 million monthly active users across the EU in the six months to March 2026. Reddit reported 57.2 million. Roblox reported about 48 million. None of those figures sits close enough to the threshold to invite an argument, and the Commission did not have to build a contested case.
What follows matters more than the label. The three services have four months, running to January 2027, to meet obligations that apply only to the largest players. They must run annual systemic risk assessments covering illegal content, harm to minors, effects on users’ physical and mental wellbeing, fundamental rights, electoral integrity and public security. They must then show what they changed in response. Regulators can read those assessments, question the methodology, and demand the underlying data.
The ChatGPT classification carries the most legal weight. The Commission argues that a chatbot which retrieves and summarises web results behaves as a hybrid service and therefore falls inside the search engine category the DSA already defines. That reasoning drags a generative AI product into a rulebook drafted before such products reached mass adoption, and it does so without new legislation. Lawyers advising other AI developers will read the Commission decision closely, because the same logic reaches any assistant that searches the open web at scale.
Roblox raises a different question. The platform hosts games built by its own users, and a large share of those users are children. Systemic risk assessment on a service like that means examining recommendation systems, chat functions, in-game purchases and moderation capacity all at once. Reddit sits somewhere between the two, a discussion network where moderation runs largely through volunteers and where the Commission will want to know how that model copes with coordinated manipulation.
Supervision splits across three authorities. The Commission leads, working with Coimisiún na Meán in Ireland for ChatGPT and Reddit, and with the Authority for Consumers and Markets in the Netherlands for Roblox. That arrangement follows the country of establishment, and it hands two national regulators a workload they will need to staff quickly.
Executive Vice-President Henna Virkkunen framed the designations as a matter of scrutiny matching scale. The Commission has now designated 28 platforms and search engines in total, and the published list keeps growing as services report user numbers.
Enforcement remains the open question. Designation grants investigative powers, including the right to examine the functionality behind a service, but the Commission still has to use them. Existing proceedings against larger platforms have run for months without conclusion. January will show whether the three newcomers treat compliance as a genuine redesign or as a documentation exercise.
