Brussels didn't regulate ChatGPT as an AI. It regulated it as a search engine, and that word is the whole rule.

The reported version of what happened in Brussels on the last day of August is that the European Union came for ChatGPT. The binding version is narrower, stranger, and far more consequential: the European Commission did not designate an artificial intelligence. It designated a search engine. On 31 August the Commission named OpenAI's ChatGPT a Very Large Online Search Engine — a VLOSE — under the Digital Services Act, the first time a generative chatbot has been placed in that category. The headline everyone repeated was the six-percent fine. The word that actually does the work is 'search'.

That distinction is not pedantry. Under the DSA, the obligations that attach to a service, the moment they attach, and the regulator who enforces them all flow from which box the service is placed in. The Commission had a choice of boxes. It could have waited for the AI Act to mature, or leaned on the chatbot's conversational surface, or called ChatGPT a platform. It chose instead to classify the one feature that has nothing conversational about it — the live web-search function that fetches results from the open internet and answers before you click — and to regulate that. Read the choice closely and it is not a ruling about one product. It is a template.

What the designation actually is

Start with what the DSA is, because the summaries blur it. The Digital Services Act has been in force since 2022 and fully applicable since February 2024. Most of its obligations bind every intermediary that reaches European users: notice-and-action on illegal content, terms written in plain language, a point of contact. Those rules were already live for ChatGPT. Nothing about them changed on 31 August.

What changed is that ChatGPT crossed into the DSA's top tier. The Act reserves a heavier set of duties for the largest services — those with at least 45 million average monthly active users in the EU, roughly a tenth of the bloc's population. Cross that line and the Commission can designate you a Very Large Online Platform or, if your service is a search engine, a Very Large Online Search Engine. Designation is the switch. It does not create a new law; it moves an existing service into a regime that was drafted years ago and has been waiting.

OpenAI reported roughly 159 million average monthly EU users for the six months ending 31 March 2026 — up from about 120 million it had disclosed earlier in the year. Whatever one thinks of self-reported user counts, the company put itself well past the threshold on its own numbers. The same day, the Commission designated Reddit and Roblox as Very Large Online Platforms, with about 57 and 48 million EU users respectively. Three services, one threshold, three designations. Only one of them was called a search engine.

Why 'search engine' and not 'platform'

This is the operative clause, so it is worth slowing down. A Very Large Online Platform and a Very Large Online Search Engine sit under the same enhanced tier of the DSA, but they are not identical categories. The platform box is built for services that host and rank content other people upload — a social feed, a marketplace, a game. The search-engine box is built for services that let you query the whole web and return results. Some of the tier's obligations map cleanly onto both; some — an advertising repository, a recommender-system opt-out — were written with feeds in mind and sit awkwardly on a query box.

The Commission could have argued ChatGPT is a platform. It did not. It reached for the search-engine designation, and the reason is the feature that triggered it: ChatGPT's browsing mode, the one that goes out to the live internet, retrieves pages, and synthesises an answer with citations. That is functionally a search engine with the results page dissolved into a paragraph. By hanging the designation on that capability rather than on the chatbot as a whole, the Commission did something quietly deliberate. It defined the thing it is regulating by what it does, not by what it is called.

A capability-based rule does not care what you market yourself as. It cares what your product does. That is the difference between a ruling about ChatGPT and a rule about every chatbot that reaches for the web.

Marketing categories are a moving target; capabilities are not. 'Is this an AI assistant or a search engine or a browser?' is the kind of question a company can litigate for years. 'Does this service query the live web and return synthesised results to more than 45 million Europeans?' is a question with a yes-or-no answer and a number attached. The Commission picked the version of the question that a court cannot easily be talked out of.

Who it binds, and when it bites

Designation starts a clock. From the moment it takes effect, a VLOSE has four months to comply with the enhanced tier — which puts OpenAI's deadline at the end of December 2026. That date, not the designation itself, is the load-bearing one. Everything reported as a consequence of 31 August is really a consequence of what OpenAI does, or fails to do, by 31 December.

What the enhanced tier requires is not content moderation in the tabloid sense. It is a set of structural obligations that attach to the service as a system. The company must run an annual assessment of the 'systemic risks' its service creates in the EU — categories the Act names explicitly, including illegal content, effects on fundamental rights, on civic discourse and elections, and on the protection of minors — and it must take reasonable measures to mitigate what it finds. It must submit to an independent audit of that work, paid for by the company but conducted at arm's length, every year. It must give vetted academic researchers access to data to study those risks. It must publish transparency reporting on a fixed cadence. And it answers, for these duties, not to a national regulator in one member state but directly to the Commission in Brussels.

That last point is the one companies underrate. For the enhanced tier the DSA centralises supervision: the Commission itself investigates, requests information, and, if it comes to it, fines. The ceiling is up to six percent of global annual turnover — the number in every headline — but the number is a backstop, not the mechanism. The mechanism is that a single regulator with subpoena power now sits across the table from the company on a defined schedule, and the first thing it can ask for is the risk assessment the company was obliged to have already written.

• The threshold that triggers everything: 45 million average monthly active EU users. ChatGPT self-reported roughly 159 million.
• The clock that matters: four months from designation to compliance — around end of December 2026.
• The obligations: annual systemic-risk assessment, independent audit, vetted-researcher data access, transparency reporting, minor-protection measures.
• The supervisor: the European Commission directly, not a national digital-services coordinator.
• The backstop: fines up to 6% of global annual turnover — a ceiling, not the day-to-day instrument.

In force is not enforced

It is worth saying plainly what designation does not do, because the gap between 'in force' and 'enforced' is where most of the misreadings live. Designation does not fine anyone. It does not ban a feature. It does not, on its own, remove a single answer from ChatGPT. It moves a service into a regime and starts a compliance period. Whether that regime bites depends on enforcement the Commission has to actually undertake — the information requests, the assessment of the company's mitigations, the eventual finding that the measures were or were not adequate. The DSA has been fully applicable for more than two years, and the Commission's enforcement against the first wave of large platforms is still, in most cases, unfinished. A designation is the beginning of a process, not a verdict.

For OpenAI the near-term reality is prosaic. The company said it is preparing to meet the requirements, which is the only sensible thing to say. Much of the burden is documentary — commissioning the audit, standing up the researcher-access mechanism, writing the risk assessment in a form that survives Commission scrutiny. None of it is trivial, and some of it, applied to a system whose outputs are generated fresh for each user rather than retrieved from a catalogue, raises genuinely novel questions: what does a 'systemic risk assessment' mean for a model that produces a different answer every time it is asked? The Act was written for services that rank existing content. The Commission has now pointed it at services that manufacture content on demand. That mismatch is not fatal, but it is unresolved, and December is not far away.

The template, and the default it sets

Here is why a designation of one American chatbot matters far beyond OpenAI. The Commission did not write a rule about ChatGPT. It established, in the most load-bearing way an administrative body can — by doing it once — that a conversational AI with a live web-search function is, for the purposes of European law, a search engine. The category is capability-based. It follows the feature, not the brand. And the feature is now standard equipment.

Gemini searches the web. Copilot searches the web. Perplexity is a search product that happens to answer in prose. Claude has added retrieval. Every serious assistant is racing to fetch live results because users want current answers, and every one of them is climbing the same user curve toward 45 million Europeans. The designation ChatGPT received is not a bespoke judgment about OpenAI's size or conduct. It is the first application of a test that each of those products will meet on the same two facts: it queries the live web, and it is large. The Commission has shown its hand once. It does not need to invent anything new to show it again.

Europe rarely builds the technology. It writes the terms on which the technology is allowed to meet Europeans — and because no company builds a separate product for one market, those terms become the default everywhere.

And this is where the second-order effect arrives, the one that always follows a Brussels rule and rarely makes the first headline. No company is going to run a differently-governed ChatGPT for Europe and for everyone else. The risk assessments, the audit trails, the researcher-access pipes, the transparency reports — once a firm has built that machinery to satisfy the Commission, it becomes the way the firm governs the product, full stop, because maintaining two regimes is more expensive than running the stricter one everywhere. The 45-million threshold is European. The compliance architecture it forces will not stay that way. A rule made in a committee room off the Rue de la Loi, about whether a chatbot counts as a search engine, is quietly setting the terms on which the entire category is built.

That is the sentence worth keeping. The fine is a ceiling. The user number is a trigger. The interesting decision was the classification — the choice to regulate the capability rather than the marketing — because a capability-based rule does not expire when the product renames itself. Watch the December deadline for what OpenAI files. But watch the category for what it catches next, because the Commission has already written the answer, and it is written in one word.