The European Commission on 31 August 2026 designated ChatGPT under the Digital Services Act. Nearly every write-up called it a platform designation. The Commission's own press release does not: it designated ChatGPT as a Very Large Online Search Engine (VLOSE), and separately designated Reddit and Roblox as Very Large Online Platforms (VLOPs). Those are two different legal categories in one announcement, and the coverage merged them.
What the categories actually do
VLOP and VLOSE obligations overlap heavily — systemic risk assessment, independent audit, a researcher data-access duty, crisis protocols — but they are not identical, and the risk assessment a search engine must run is scoped to search. The distinction also matters for what Brussels thinks ChatGPT is. Designating a chat assistant as a search engine is a statement about function, and it is the first time the category has been applied to a general-purpose AI assistant.
The number nobody measured
Designation turns on a threshold of 45 million average monthly active users in the EU. The Commission's sentence is precise: these services "declared that they reach at least 45 million average monthly users in the EU and thus meet the threshold for designation." The figure is self-reported by the companies under their DSA transparency duty. The Commission accepted the declaration; it did not publish an independent count, and no audited user figure exists for any of the three.
What the common framing gets wrong
Three things. First, ChatGPT is not now "a very large online platform" — it is a very large online search engine, and Reddit and Roblox are the platforms. Second, "the EU says ChatGPT has 45 million users" inverts the source: OpenAI says so, and the Commission designated on that basis. Third, the deadline. Several outlets rendered the four-month clock as ending in late November 2026. The Commission's page states the services "have four months, i.e. by January 2027, to comply" — the clock runs from notification of the designation, not from the press release, and Brussels has written down which month it lands in.
What is not yet decided
Designation is the start of an obligation, not a finding of wrongdoing. No breach has been alleged, no fine is in play, and the first risk assessments are not due until the four months run. The enforcement question — whether a model's outputs are the service's own content or third-party content — is exactly what the DSA has never had to answer before, and this designation is what forces it.