ChatGPT, Reddit, and Roblox Join the DSA Big Leagues: What the Designation Means for Businesses

On 31 August 2026, the European Commission designated OpenAI's ChatGPT as a Very Large Online Search Engine (“VLOSEs”) and Reddit and Roblox as Very Large Online Platforms (“VLOPs”), bringing them within the Digital Services Act’s (“DSA”) most demanding compliance regime. Each service reported at least 45 million average monthly active users in the EU, triggering the threshold for enhanced obligations. These designations bring the total number of VLOSEs and VLOPs to 28, with the latest three needing to comply by January 2027.

This is a significant step for the DSA, extending its reach beyond the services traditionally associated with platform regulation. In particular, the inclusion of ChatGPT and Roblox demonstrates the Commission’s willingness to apply the framework to emerging categories of digital services, including generative AI and immersive user-generated environments. The decision signals that the Commission is taking an increasingly technology-neutral approach, with risk and reach, rather than business model or label, driving regulatory scrutiny. 

ChatGPT (finally) crosses the DSA threshold

ChatGPT’s designation is arguably the most significant aspect of the Commission’s announcement. Although the service has exceeded the DSA’s user threshold for some time, passing 120 million EU users in late 2025, there has been ongoing debate over whether a generative AI assistant could properly be characterised as a search engine, given that the DSA predates mainstream conversational AI. The Commission has now answered that question, describing ChatGPT as a “hybrid service” that engages with user prompts by retrieving, synthesising and presenting information, including information sourced from the web. In doing so, it has brought a generative AI service within the DSA’s most demanding compliance regime for the first time. 

What changes now? 

As outlined in our previous blogs (see here), OpenAI will now be required to conduct systemic risk assessments annually, as well as before deploying functionalities likely to have a critical impact on systemic risks (including the dissemination of illegal content and adverse effects on fundamental rights, civil discourse, public security, the protection of minors, and individuals’ physical and mental well-being). 

This obligation may prove particularly significant for AI providers. Unlike many traditional online services with relatively established technological platforms, generative AI systems evolve rapidly through model updates, feature rollouts and changes in functionality. Performing DSA-mandated risk assessments may be a more dynamic exercise than for more traditional platforms, with little guidance to draw on. OpenAI will also need to facilitate access to platform data for vetted researchers conducting systemic-risk research, subject to safeguards protecting proportionality, confidentiality, and trade secrets.

This designation arrives shortly after OpenAI began displaying advertisements in ChatGPT across 31 European countries. While OpenAI has stated that advertisements are clearly labelled, separated from AI-generated responses and do not influence outputs, questions have been raised with the Commission regarding the transparency and targeting of such advertising. Given the DSA’s enhanced transparency and advertising obligations, the designation is likely to place OpenAI’s evolving advertising model under heightened regulatory scrutiny.

Reddit and Roblox: Different platforms, same DSA obligations

The designation of Reddit and Roblox as VLOPs, with 57.2 million and 46.6 million average monthly users respectively, brings two very different services within the DSA’s enhanced regime. 

Reddit’s designation comes amid broader regulatory scrutiny. Earlier this year, the UK ICO fined Reddit £14.47 million for breaches relating to the processing of children’s personal data, including deficiencies in age assurance measures. Although the decision is under appeal, it illustrates the increasing regulatory focus on online platforms with larger user bases. As a decentralised platform built around user-moderated communities, Reddit will face challenges around content moderation and the spread of misinformation, particularly as it is subjected to more intense scrutiny of how effectively its measures are operating.

Roblox’s designation is equally notable. As the first dedicated gaming and creation platform with a predominantly younger user base, Roblox will need to grapple with child safety obligations and the systemic risks associated with immersive digital environments. Roblox is already subject to regulatory attention in the US where a Senate subcommittee has opened an investigation into child safety on the platform, and the Australian eSafety Commission has issued a transparency notice to Roblox on grooming, sexual predators, cyberbullying and online hate.

Both platforms will now be subject to the full spectrum of VLOP obligations, including those obligations set out above, as well as carrying out external and independent auditing, sharing data with authorities, and establishing an internal compliance function. Taken together, these designations reinforce that where user-generated content, social interaction and large audiences are present, the Commission appears willing to apply the DSA's enhanced framework irrespective of how a service is categorised.

Practical Implications

For businesses operating in the digital services space, the latest designations offer several takeaways:

• The DSA is expanding beyond traditional online services: The designation of ChatGPT and Roblox confirms that the Commission is willing to apply the DSA’s enhanced regime to emerging categories of digital services, firmly bringing AI and immersive gaming platforms in scope. Businesses developing AI-powered tools with large user bases, gaming platforms or other highly interactive services should assess whether their offerings could attract increased scrutiny as the DSA continues to evolve.
• Child safety remains front and centre: The Roblox designation reinforces the growing focus on platforms with younger user bases. These platforms should expect continued scrutiny of age assurance measures, safety-by-design features, and child-specific risk mitigation strategies. 

Looking Ahead

The latest designations confirm that under the DSA, reach and risk matter more than platform type. For fast-growing AI, gaming and user-generated content services, DSA readiness is no longer just a concern for Big Tech.