The Digital Services Act (the “DSA”) is designed to protect and ensure regulation of the rights of users in the EU in the context of online platforms and services, and it imposes obligations on certain platforms to ensure safe use of those platforms by minimising the risk of exposure to illegal and harmful content.

On 31 August 2026, the European Commission made the decision to designate the AI system, ChatGPT, as a very large online search engine (“VLOSE”), making it now one of 28 designated very large online platforms and search engines under the DSA. As ChatGPT has the ability to engage with and reply to prompts raised by users, and can conduct internet searches on the basis of those prompts, it is considered a hybrid service and online search engine pursuant to the DSA.

ChatGPT declared that it exceeded the threshold of 45 million average active monthly users in the EU, which therefore meets the criteria for a VLOSE, and is estimated to have an average 159.1 million users per month.

Reddit and Roblox also join ChatGPT on the list of designated services, as very large online platforms (“VLOPs”). The risk management obligations imposed under the DSA by this decision are in addition to the obligations imposed on the service by the AI Act.

OpenAI Ireland has four months from the notification of the European Commission’s decision to comply with the enhanced obligations and take steps to ensure they mitigate risks and provide transparency around recommender systems and advertising. That is, it must comply with its obligations by January 2027.

In terms of the steps it must carry out, OpenAI Ireland will be required to, for example:

• Establish a point of contact for both users and regulatory authorities
• Report suspected criminal offences in terms of use
• Ensure its terms and conditions are clear, accessible, and user-friendly
• Provide greater transparency around advertising, recommender systems and content moderation
• Mitigate negative effects on minors, as part of its systemic risk obligations.

While the DSA applies to all providers of intermediary services proportionally to their size, it recognises that certain very large online platforms and search engines play a significant role in our societies and democracies and therefore should be subject to specific rules to ensure the minimisation of systemic risks related to, for example, dissemination of illegal content, threats to fundamental rights, electoral processes, public security, freedom of expression and physical and mental wellbeing of users of the service.

Once risks have been identified and reported to the European Commission, the European Commission, in cooperation with Coimisiún na Meán as Ireland’s Digital Services Coordinator, will supervise ChatGPT’s compliance with the DSA, and appropriate measures must be introduced to address those risks. These could include changes to the design or operation of the service, adjustments to recommender systems, or allocating additional resources to risk management. VLOPs and VLOSEs must also:

• Assess and mitigate systemic risk, and establish an internal function to oversee risk management
• Undergo an independent audit at least once a year and act on any recommendation(s) that arise
• Provide relevant data to the EU Commission and national authorities to enable regulatory oversight
• Facilitate independent scrutiny and provide access to certain platform data to assist in identifying and understanding systemic risk
• Provide a recommender-system option that is not based on user profiling
• Maintain a publicly accessible repository of advertisements.

The designation of ChatGPT as a VLOSE is significant as it qualifies the AI system as a search engine and shows the EU Commission’s move away from treating conversational AI as a model or software product. It will set precedent and influence regulatory expectations for all generative AI systems used across the EU and reflects its ever-growing presence across both the private and public sectors. It is also significant for Ireland given that ChatGPT joins the list as another VLOSE to be established or regulated in this jurisdiction.

It should serve as a reminder not to rely on an assumption that AI providers are fully compliant with all obligations under the DSA and AI Act. Care should be taken to ensure internal controls and assessments are put in place when considering risks associated with their use.