Brussels puts ChatGPT under its toughest online rulebook yet

The News

The European Commission has placed OpenAI's ChatGPT inside the strictest tier of the bloc's Digital Services Act, a decision confirmed on 31 August 2026. The chatbot has been designated a Very Large Online Search Engine, the same category that already binds Google Search and Bing, and the label carries a long list of legal duties around risk, safety and transparency.

The trigger is scale. Official figures put ChatGPT at 159.1 million average monthly users across the EU, far above the 45 million threshold that flips a service into the DSA's top bracket. On the same day, the Commission also named Reddit a Very Large Online Platform with 57.2 million users and Roblox a Very Large Online Platform with 46.6 million.

For OpenAI the practical effect is that ChatGPT must now be run as a regulated public utility of sorts. The company will be expected to assess and blunt systemic risks tied to minors, user mental health and the circulation of illegal content, and to open its systems to independent scrutiny rather than self-certify that all is well.

Why It Matters

This is the first time a general-purpose chatbot has been folded into the DSA's heaviest regime, and it settles a question that had lingered since generative tools went mainstream: are they publishers, platforms or something new. Brussels has answered by treating ChatGPT as an information gateway, closer to a search engine than a social feed, which reshapes how its outputs are judged.

The direction of travel echoes the arrival of the GDPR in 2018, when Europe's privacy rulebook quietly became the template that firms exported to every market rather than maintain a patchwork. Compliance built for Brussels tends to leak outward, because running one safety architecture is cheaper than running several. What OpenAI engineers for Europe may well become the global baseline.

There is also a competitive signal. Heavier obligations raise the cost of operating at frontier scale, which favours incumbents with deep legal benches and squeezes smaller challengers. Regulation, in other words, can harden the very concentration it was meant to check.

Indian Angle

For India the timing is pointed. New Delhi is still drafting the Digital India Act to replace the ageing IT Act, and MeitY has spent two years signalling that large AI systems will not sit outside the rulebook. India already uses a user-count trigger of its own, the five million registered-user mark that defines a Significant Social Media Intermediary, and the DSA gives officials a live example of how a scale-based AI tier might be framed.

India is one of ChatGPT's largest markets by users, so any European template that tightens age verification or content controls will reach Indian users through the same product build, well before any domestic law lands. That makes Brussels an unofficial regulator of the Indian experience in the interim.

It also sharpens the case for home-grown models. Sarvam and Ola's Krutrim have pitched themselves as sovereign alternatives, and a world where the dominant foreign chatbot carries EU-shaped compliance baggage strengthens the argument that India needs stacks it can govern under its own DPDP Act and its own thresholds.

FAQ

When do the new obligations begin?

The Commission notified the designations on 31 August 2026. Under the DSA a newly named service has roughly four months to reach full compliance, so OpenAI's first hard deadline falls around the turn of 2027.

How does this compare to how Google is treated?

Google Search was designated a Very Large Online Search Engine in 2023. ChatGPT now joins that same category, meaning the two face broadly similar duties on risk assessment, auditing and transparency despite offering very different products.

What does it mean for Indian developers building on OpenAI?

Little changes at the API level today, but developers should expect stricter safety defaults and more logging over time as OpenAI standardises its European obligations across the whole product.

Where can I read the original announcement?

The Verge first reported the designation, and the European Commission publishes the official user figures and effective dates on its own register of designated services.

This story was reported by The Verge. Read the full original coverage at The Verge.