On 31 August 2026 the European Commission designated ChatGPT, Reddit and Roblox under the EU’s Digital Services Act, moving all three into the toughest tier of European platform regulation. They have four months to comply. The detail every growing platform should notice is that Roblox crossed the line with 46.6 million users, about 1.6 million above the threshold.
Why this designation matters
The Commission designated ChatGPT as a Very Large Online Search Engine (VLOSE), and Reddit and Roblox as Very Large Online Platforms (VLOPs), under the Digital Services Act (DSA), Regulation (EU) 2022/2065. The Commission’s public register dates all three designations to 31 August 2026 and notes that the formal decisions are not yet published.
This is not a new law. The DSA has applied in full since 17 February 2024, and the first wave of designations, covering Facebook, Google Search, Amazon, TikTok, YouTube and others, happened in April 2023. What is new is that the list now includes a generative AI assistant used directly by consumers, and that one of the three services is barely over the line.
What actually triggers designation
Article 33(1) of the DSA sets the test. The heavier obligations apply to online platforms and search engines with an average of 45 million or more monthly active recipients of the service in the EU, once the Commission designates them on that basis. There is no discretion about size and no exemption for being a young company. The threshold is tied to European demographics: Article 33(2) requires the Commission to adjust it by delegated act whenever the EU’s population moves by at least 5 per cent, so that it keeps corresponding to 10 per cent of the Union’s population.
The Commission’s register puts ChatGPT at 159.1 million average monthly active users in the EU, Reddit at 57.2 million and Roblox at 46.6 million. Roblox is the instructive case. It is not a household-name social network and it is nowhere near the scale of the 2023 cohort, but it carries the same obligations, because it reports a number above 45 million.
ChatGPT’s classification is the other surprise. It was designated as a search engine rather than a platform. In the Commission’s own words, ChatGPT “is an Artificial Intelligence (AI) system that can engage with and respond to users’ prompts and queries, including by searching the web. Hence, ChatGPT is a hybrid service that qualifies as an online search engine under the DSA.” Anyone building a consumer-facing AI assistant with a browsing or retrieval function should read that sentence twice. The DSA’s categories are applied by what a product does, not by what its makers call it.
What designation actually requires
Designation moves a company out of the DSA’s baseline duties, which are manageable for most online businesses, and into a regime that only exists above the threshold.
Systemic risk assessment and mitigation
Under Article 34, a designated provider must identify, analyse and assess the systemic risks in the EU arising from the design and functioning of its service, including its algorithmic systems. Four categories are named: dissemination of illegal content; negative effects on fundamental rights; negative effects on civic discourse, electoral processes and public security; and negative effects relating to gender-based violence, public health, minors and serious consequences for users’ physical and mental well-being. The first assessment is due by the date the obligations start to apply, then at least once a year, and again before deploying any functionality likely to have a critical impact on the risks identified. Article 35 then requires reasonable and proportionate mitigation.
Independent audit, at your own cost
Article 37 requires designated providers to submit to independent audits of their DSA compliance, at their own expense, at least once a year. This is not an internal review signed off by the general counsel. It is an external audit, and the auditor has to be found, engaged and briefed before it can happen.
Recommender systems, advertising and data access
Article 38 requires at least one option for each recommender system that is not based on profiling within the meaning of the GDPR. Article 39 requires providers that display advertising to keep a public, searchable repository of the ads shown on the service. Article 40 requires data access for the Digital Services Coordinator and the Commission on reasoned request, and for vetted researchers.
A compliance function with real independence
Article 41 requires a compliance function independent of the operational side of the business, staffed by one or more compliance officers. For a company that has run compliance as a part-time responsibility of the legal or security team, that is an organisational change, not a policy document.
From when, and who enforces it
Article 33(6) is precise about the clock: the obligations apply from four months after the designation is notified to the provider. For these three services the Commission puts that at January 2027. Four months is not long to build a risk assessment methodology, appoint an independent auditor and stand up an advertising repository from nothing.
Supervision sits with the Commission, working with Coimisiún na Meán in Ireland for ChatGPT and the Authority for Consumers and Markets in the Netherlands for Reddit and Roblox, as the Digital Services Coordinators where the providers are established. Where the Commission finds an intentional or negligent infringement, Article 74 allows fines of up to 6 per cent of total worldwide annual turnover.
The tripwire most companies miss
Consider a Nordic company running a consumer app with a social feed, a fintech that has added community features, or a business AI tool that starts being used by consumers across Europe. Nobody inside that company thinks of it as Big Tech. But under Article 24(2) it already has to publish its average monthly active recipients in the EU, in a publicly available part of its interface, at least once every six months, calculated as an average over the previous six months. That duty has applied since 16 November 2022, ahead of most of the DSA.
That published number is the tripwire. It is what the Commission looks at, and under Article 24(3) the provider must also hand over the underlying information to its Digital Services Coordinator and the Commission on request. A company that publishes 43 million one half-year and 47 million the next has, in effect, told the regulator where to look.
Recommended actions
Start with the number. Work out how your company calculates average monthly active recipients in the EU, check that you are publishing it as Article 24(2) requires, and make sure the methodology would survive a regulator asking you to justify it. If you are anywhere within reach of 45 million, or expect to be within two years, sketch a systemic risk assessment now, even informally, so that designation would not find you starting from zero. Note also that four months is when the first risk assessment is due under Article 34, not when the work should begin.
Then look at your product through the regulator’s eyes. Map the features the heavier obligations target, meaning recommender systems, advertising, user-generated content and algorithmic ranking, because that is where audits and enforcement start. Review your dependencies on newly designated services for anything that assumes their pre-designation behaviour, since recommender defaults, advertising practices and data access will all shift over the coming months. And treat the DSA baseline as the floor you should already be meeting. A structured legal growth audit is a practical way to find out where you stand before someone else tells you.
Frequently asked questions
Does the DSA only affect large US technology platforms?
No. Every provider of an intermediary service to users in the EU has baseline obligations covering illegal content, terms of service transparency and points of contact for authorities, and those apply regardless of size. The additional obligations described here apply only above 45 million average monthly users in the EU, but the baseline applies far below that.
How is the 45 million user figure measured?
It is the average number of monthly active recipients of the service in the Union, calculated over the previous six months and published by the provider itself under Article 24(2). The Commission may adopt delegated acts laying down the methodology, and can request the underlying data directly.
What happens if a designated company misses the four-month deadline?
The Commission supervises designated services directly and can open formal proceedings, as it has already done against several platforms designated in earlier rounds. Under Article 74, fines can reach 6 per cent of total worldwide annual turnover for intentional or negligent infringement.
Conclusion
The ChatGPT, Reddit and Roblox designations are a reminder that the DSA’s heaviest obligations are not reserved for household names. They attach once a service crosses a user number the provider itself has to publish, and the gap between comfortably below and formally designated can be a single strong quarter. For any Nordic technology, AI or consumer business with real growth ambitions in Europe, the time to understand this regime is well before the Commission’s notification arrives. Lawgent helps growing technology and AI companies map their exposure under the DSA and the AI Act together and build a compliance programme that scales with the business.
This is general information, not legal advice for your specific situation.
Sources
Regulation (EU) 2022/2065 (Digital Services Act), consolidated text on EUR-Lex, Articles 24, 33, 34, 35, 37, 38, 39, 40, 41, 74 and 93: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065
European Commission, “Commission designates ChatGPT, Reddit, Roblox under Digital Services Act”, press release IP/26/1772: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1772
European Commission, news item on the same designations: https://digital-strategy.ec.europa.eu/en/news/commission-designates-chatgpt-reddit-roblox-under-digital-services-act
European Commission, “Supervision of the designated very large online platforms and search engines under DSA”, the official register of designations and user numbers: https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses
