News analysis · Published
ChatGPT's EU Search Designation: What Businesses Should Prepare For
By the ELYMENT AI editorial team · Free to read
The European Commission designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act on 31 August 2026. OpenAI now has four months, until January 2027, to meet additional obligations covering systemic-risk assessment, mitigation, transparency and independent audit. Businesses using ChatGPT do not automatically inherit that designation, but they should expect the service, evidence available from the vendor and contractual risk questions around AI search to become more formal. That makes governance readiness a procurement issue now.
What changed on 31 August 2026
The European Commission formally classified ChatGPT as a Very Large Online Search Engine, or VLOSE, under the Digital Services Act. The Commission said ChatGPT declared at least 45 million average monthly users in the European Union, which meets the statutory scale threshold. Reddit and Roblox were designated separately as Very Large Online Platforms.
The designation gives OpenAI four months, until January 2027, to comply with the additional rules for the largest services. Reuters confirmed that the Commission will supervise compliance and can investigate service functionality. This is a confirmed regulatory decision, not a proposal, although the practical implementation will develop through OpenAI's compliance work and regulatory oversight.
The search classification is the strategic signal
The Commission classified ChatGPT as a search engine because it can retrieve information from publicly accessible websites. That matters beyond one product. AI assistants are increasingly used to discover, summarise and prioritise information, so regulators are beginning to treat their retrieval and ranking functions as infrastructure that can shape decisions at scale.
A company that merely uses ChatGPT is not thereby designated as a VLOSE. However, organisations embedding AI search into customer journeys, professional advice or internal decision support should separate three roles: the regulated upstream service, the business deploying it and the person accountable for the final decision. Contracts and controls should make those responsibilities explicit.
The obligations are built around evidence
The Commission says VLOSEs must assess systemic risks connected with illegal content, fundamental rights, protection of minors, wellbeing, elections and public security, then implement measures to mitigate them. The regime also requires an internal compliance function, independent audits at least annually, data access for authorities and vetted researchers, and greater transparency around recommender systems and moderation.
For enterprise buyers, this does not guarantee that every model output becomes accurate, safe or suitable for a specific workflow. It should create a stronger evidence environment. Procurement teams should ask which risk reports, audit findings, service changes and control documentation apply to the exact ChatGPT product, geography and contract they use rather than relying on broad corporate statements.
Use a five-question AI search review
Leaders can translate the designation into five practical questions:
- Scope: Which workflows use ChatGPT search, and which decisions or audiences can they affect?
- Evidence: What vendor risk assessments, audit material, incident notices and model or service documentation can the business obtain?
- Responsibility: Who validates sources, handles complaints, corrects harmful outputs and approves consequential use?
- Contracts: Do terms cover service changes, data use, retention, audit cooperation, incident notification and exit assistance?
- Continuity: Can critical search workflows fall back to another source, model or human process if access or behaviour changes?
What business leaders should do next
Map every material workflow that treats ChatGPT as a source of current information, then rank it by consequence and audience. For the highest-risk use case, retain the retrieved sources, record the model and service context, require a named reviewer, and test what happens when the service is unavailable or produces an unsupported answer. Ask the vendor or reseller how DSA compliance evidence will reach enterprise customers.
ELYMENT AI's South Australia AI Royal Commission analysis explains why owned evidence matters under public scrutiny. Our enterprise data-retention guide covers the contract detail behind model use, while the OpenAI Cursor cutoff Insight shows why portability must be tested. ELYMENT AI can help operators turn these obligations into a practical AI search control set without treating regulatory status as a substitute for workflow assurance.
Sources
- European Commission: ChatGPT designated under the Digital Services Act (2026-08-31) - Primary announcement confirming ChatGPT's VLOSE designation, the 45 million-user threshold and the January 2027 compliance deadline.
- European Commission: VLOP and VLOSE obligations (2026-05-19) - Official explanation of systemic-risk assessment, mitigation, annual audit, data-access and transparency obligations for very large services.
- Reuters: ChatGPT to follow the EU's very large service rules (2026-08-31) - Independent reporting on the designation, compliance period, Commission supervision and the risks covered by the DSA.
Continue learning
Related analysis
- ChatGPT for Financial Services: Build an Evidence Chain
OpenAI has launched ChatGPT for Financial Services. Learn how firms can preserve data entitlement, source evidence, review and accountability.
Frequently asked questions
What does the EU's ChatGPT designation mean?
It means ChatGPT is regulated as a Very Large Online Search Engine under the Digital Services Act and must meet additional systemic-risk, transparency and audit obligations by January 2027.
Does a business using ChatGPT become a VLOSE?
No. Using ChatGPT does not automatically give the customer OpenAI's designation, but the customer's own legal, contractual and operational responsibilities still depend on how it deploys AI search.
What should AI procurement teams request?
They should request product-specific risk and audit evidence, incident and service-change terms, clear data controls, accountable review processes and a tested continuity path.