ChatGPT is a Very Large Online Search Engine under the DSA: the EU regulates the search feature, not the AI

On August 31 the European Commission designated ChatGPT a Very Large Online Search Engine under the Digital Services Act. It is the first standalone AI service to land in the DSA's strictest regime. The detail that matters for anyone building products is what the designation rests on. It is not that ChatGPT is AI. It is that ChatGPT's live web search feature has 159.1 million monthly users in the EU, which clears the VLOSE threshold the same way Google or Bing does. Compliance is due by the end of December 2026. The penalty ceiling is 6% of global turnover.

What was decided, precisely

The DSA has two very-large tiers: VLOP for platforms and VLOSE for search engines. Coverage the previous day had ChatGPT down as a VLOP; the correction is that it is a VLOSE, and the distinction is not cosmetic. The Commission counted users of a capability, live search across the web, and applied the search-engine rulebook. The chat interface, the model, the training data, the agent features: none of those triggered anything. The search box did. Search Engine Journal and Gizmodo both flagged the same point.

Why capability-based designation is the story

This is a template, and the template is reusable. Any service that offers live web search to enough EU users can be designated the same way, regardless of whether it calls itself a search engine. Claude, Gemini, and Perplexity all have web search features. The moment their EU search usage crosses the threshold, the Commission does not need a new law or an AI-specific instrument. It applies the one it just applied.

For product teams, the lesson is to stop reading regulation by product category and start reading it by capability. The question is not whether you are an AI company. It is which regulated things your product does, and for how many people.

The EU did not regulate the AI. It counted the users of the search box and applied the search rules. Every AI product with a search feature should do the same math.

What changes for AI search and RAG products in the EU

Most of us are far below 159 million users, so designation is not the immediate risk. The immediate effect is that VLOSE obligations become the reference point for what a responsible AI search product looks like, and enterprise buyers in the EU will start asking whether yours can meet them.

• Transparency of retrieval and ranking. If your product retrieves and ranks web or document content before generating an answer, be able to explain how. For a RAG pipeline that means documenting the retriever, the reranker, and the filters, not just the model. The design in hybrid-search-local-rag is easier to explain than a black-box embedding search precisely because BM25 is legible.
• Risk assessment for the search feature. A VLOSE has to assess and mitigate risks its search creates. If your product surfaces live web results, think about what a bad result does downstream and what your validation layer catches. That is where guardrails-output-validation stops being a quality tool.
• Isolate search in the architecture. If search is what gets counted and regulated, make it a component you can measure, audit, restrict by region, or turn off, rather than something fused into the generation call.
• Count EU users per capability. Not per product. If you cannot say how many people in the EU used search last month, you cannot know where you stand.

The wider context

The same week, the US was pushing G20 partners toward what it calls light-touch AI regulation, the explicit opposite of the EU's statutory approach. If you ship to both markets, the practical path is to design for the stricter one and relax by region, because the capability-based approach means strict rules attach to features, and features are easier to gate than models.

The honest gap

The designation is a fact; what compliance will require of ChatGPT in practice is not yet public, and the end-of-December deadline is OpenAI's, not anyone else's. Extending the template to Claude, Gemini, or Perplexity is my reading of the mechanism, not an announced plan. Whether the Commission also reaches for the AI Act to cover the model layer separately is a different question this designation does not answer.