EU Moves to Classify ChatGPT Under Strictest DSA Rules — What 120M EU Users and Enterprise Buyers Need to Know

The European Commission is in the final stages of designating OpenAI's ChatGPT as a Very Large Online Platform (VLOP) — or potentially a hybrid VLOP / Very Large Online Search Engine (VLOSE) — under the Digital Services Act. The move follows OpenAI's October 2025 self-report of 120.4 million average monthly active recipients in the EU, well above the 45-million threshold that triggers DSA's most stringent obligations. The Commission has signaled it intends to conclude the designation procedure in the first half of 2026, with computing-industry reporting suggesting an announcement could come within days.

What VLOP/VLOSE Designation Actually Triggers

If ChatGPT is designated, OpenAI must comply with the DSA's tier-one rules within roughly four months — significantly faster than the multi-year ramp the EU AI Act allows. The obligations include: published, accessible terms of service; a designated regulator and user contact channel; mandatory transparency reports on content moderation and algorithmic recommendations; researcher access to platform data; suspected criminal-activity reporting; advertising transparency including who paid for sponsored content; and annual independent risk assessments covering fundamental-rights impacts. Hybrid VLOP/VLOSE designation would layer search-engine-specific obligations on top, particularly around ranking transparency and indexing decisions.

Why the EU Is Pushing Now

The legal question that has slowed designation through 2025 is whether ChatGPT is more analogous to an online platform (user-generated content surfaces) or a search engine (information retrieval). Regulators reportedly favor a hybrid classification because chatbot answers blend the two: users generate prompts, the model retrieves and synthesizes, and outputs sit in the gray zone between recommendation and search. Commissioner Virkkunen's office has telegraphed that resolving this in 2026 is a priority, partly to avoid the precedent of letting a 120M-user platform sit outside the DSA framework while smaller services comply.

How This Layers on the EU AI Act

The DSA designation is additive to — not a replacement for — the EU AI Act obligations that hit on August 2, 2026 for general-purpose AI models. AI Act rules govern model-level transparency, training-data documentation, and systemic-risk evaluations. DSA rules govern user-facing service obligations: moderation, advertising, data access. Enterprises deploying ChatGPT in EU operations will need to track both compliance lanes, and OpenAI's response document burden roughly doubles from this designation alone. Expect downstream impact on enterprise contract terms, particularly around data export and content-moderation auditability.

What This Means for Professionals and Buyers

Three concrete implications for the next 90 days: (1) Procurement teams negotiating ChatGPT Enterprise or API contracts with EU exposure should request DSA-compliance addenda now — vendor language will tighten quickly post-designation. (2) AI governance and compliance professionals should treat DSA + AI Act as a combined compliance program, not two separate workstreams; the audit evidence overlaps significantly and the cost of running them separately is rising fast. (3) Career-wise, EU-jurisdiction AI compliance roles — already paying $130K-$220K in major EU hubs — are about to see a step-up in demand as the DSA designation triggers risk-assessment hiring across every enterprise using ChatGPT at scale. The career window for building DSA+AI-Act dual fluency is narrowing as the designation date approaches.

Frequently Asked Questions

When will the EU formally classify ChatGPT under the DSA?

The European Commission has signaled an intent to conclude the designation procedure in the first half of 2026, with industry reporting in early May 2026 suggesting an announcement could come within days. Once designated, OpenAI has roughly four months to come into full DSA compliance for ChatGPT.

What is the difference between VLOP and VLOSE under the DSA?

VLOP (Very Large Online Platform) is the designation for user-content services like social networks and marketplaces over 45 million monthly active EU users. VLOSE (Very Large Online Search Engine) is the equivalent designation for search services. ChatGPT is a candidate for hybrid VLOP/VLOSE classification because it blends user-prompted generation with information retrieval — the Commission has signaled both designations could apply simultaneously.

Does the DSA designation affect ChatGPT users outside the EU?

Directly, no — DSA obligations are scoped to EU users and EU-facing service operations. Indirectly, yes: OpenAI's compliance infrastructure (transparency reporting, advertising disclosures, terms-of-service changes) will likely be applied globally to avoid running parallel product configurations, which historically is how GDPR-style EU rules end up shaping non-EU user experiences.

How does the DSA designation interact with the EU AI Act?

The two regimes are additive, not overlapping. The EU AI Act governs the model layer — training data, systemic risk, transparency about model capabilities — with August 2, 2026 as the next major deadline for general-purpose AI obligations. The DSA governs the service layer — content moderation, advertising, user terms, researcher data access. Enterprises using ChatGPT in EU operations need a combined compliance program that tracks both lanes.