The August 31 designations expand the Digital Services Act’s reach into conversational AI and two major user-generated-content ecosystems. ChatGPT joins the existing list of very large online search engines, while Reddit and Roblox join the very large online platforms group. Both categories trigger obligations that apply only to services reaching more than 45 million monthly active users in the EU.
Scope of the new obligations
Under the DSA, very large online search engines and very large online platforms must conduct annual systemic-risk assessments that examine how their core algorithms amplify illegal content, disinformation, or harmful material for minors. They must also submit to independent audits, publish detailed transparency reports every six months, and maintain clear points of contact for regulators. Child-safety rules require default high-privacy settings, age-appropriate interfaces, and documented measures to prevent addictive design patterns.
For ChatGPT the classification as a search engine adds an extra layer: obligations around the accuracy and completeness of information returned to users. OpenAI will need to demonstrate how the model’s training data and reinforcement-learning processes affect the risk of generating misleading or harmful answers at scale. Product teams must now log and surface the sources or confidence signals that accompany generated responses when users are located in the EU.
Technical implications for engineering teams
Recommendation and ranking systems at Reddit and Roblox will require new instrumentation. Engineers must expose internal metrics that measure the distribution of content categories, the velocity of virality, and the prevalence of illegal material. Audit firms will examine model weights, feature stores, and A/B test logs to verify that mitigation steps are effective. Similar logging requirements apply to ChatGPT’s safety classifiers and content-filtering layers.
Data pipelines must now support granular user-level controls. Reddit’s comment-ranking models and Roblox’s experience-recommendation engines will need hooks that allow users to reset personalization, export training data, or opt out of certain algorithmic feeds. ChatGPT’s conversation-history storage will face equivalent demands for export and deletion interfaces that comply with DSA transparency rules.
Background on the Digital Services Act framework
The DSA entered into force in November 2022 and began applying to the largest platforms in 2023. The European Commission maintains a public list of designated services and updates it when usage thresholds are crossed or new services emerge. The August 31 update is the first time a generative-AI chatbot has been explicitly placed in the search-engine category, reflecting regulators’ view that users increasingly treat large language models as primary information gateways.
Threshold calculations rely on self-reported EU user figures verified by external auditors. Reddit and Roblox both reported crossing the 45-million-user mark in recent filings; OpenAI’s EU usage of ChatGPT triggered the search-engine designation. Once listed, companies have four months to submit their first full risk-assessment report and must thereafter publish transparency reports on a fixed schedule.
Reactions from the companies and industry observers
OpenAI has stated it will cooperate fully with the new requirements and is already expanding its safety and compliance teams in Europe. Reddit indicated it will publish additional data on content-removal volumes and is updating its moderator tooling to meet audit standards. Roblox emphasized its existing child-safety investments and said it will extend those programs to satisfy the DSA’s independent-audit clause.
Software engineers at smaller AI startups are watching closely. Many expect the precedent to influence how future foundation-model providers instrument their systems for regulatory scrutiny. Discussions in engineering forums center on reusable libraries for audit logging, standardized schemas for risk-assessment reports, and open-source tools that can generate DSA-compliant transparency exports.
What happens next
The four-month compliance window means the first risk-assessment reports are due by the end of December. Regulators will review the submissions and may request additional data or remediation plans. Non-compliance can result in fines of up to 6 percent of global annual turnover, plus potential restrictions on service features inside the EU.
Engineering roadmaps at the three companies now include dedicated workstreams for DSA tooling. ChatGPT’s safety team is adding provenance metadata to generated answers, Reddit is instrumenting its ranking models for external audit, and Roblox is extending its age-verification and parental-control infrastructure. These changes will become visible to EU users through new settings panels, clearer explanations of algorithmic choices, and periodic public reports on content-moderation performance.
Over the longer term the designations signal that any service crossing the 45-million-user threshold in Europe—whether a chatbot, social network, or gaming platform—will face comparable obligations. Teams building large-scale AI or user-generated-content systems are therefore embedding regulatory logging and risk-assessment practices into their core development processes rather than treating them as after-the-fact compliance exercises.
