The Commission designated ChatGPT as a very large online search engine (VLOSE), subject to additional transparency, accountability and risk management obligations. Additionally, Reddit and Roblox were designated as large online platforms, also falling under the Digital Services Act (DSA).
All three services now have only four months to comply with the additional DSA obligations.
Those obligations are substantive. They include assessing and mitigating the systemic risks related to the dissemination of illegal content, the negative effects on minors, users’ physical and mental well-being, fundamental rights, electoral processes and public security.
The trigger was not an investigation. These services declared that they reach at least 45 million average monthly users in the EU and thus meet the threshold for designation. There was no complaint or formal enforcement action: the designation was triggered by the information the service providers disclosed.
The Digital Services Act was drafted before large-scale AI services like ChatGPT existed. One genuinely open question was whether a system that synthesizes answers, rather than returning a list of indexed links, fell within the definition of an online search engine.
It was resolved considerably faster than many expected. Organizations waiting for all questions to be settled before mapping their own exposure could find themselves with a clarifying notification and a strict deadline.
It is now obvious that AI tools can be subject to additional regulatory requirements outside the EU AI Act. The same tool could be subject to two or more regulations, depending on how it is built and used.
This is a structure that HealthTech and life sciences organizations already live with: the AI Act, the GDPR and sectoral regulations such as Medical Devices Regulation could apply to same system at once.
This ruling is an important reminder that your EU compliance program should treat applicable regulations as an interconnected, functional framework and not as separate compliance exercises for each law.
A practical step toward building a scalable, effective compliance program is to define each service by what it actually does (not by its marketing materials) and then assess the regulations that apply.
If you are assessing which regulations apply to your AI tools or R&D project, Regulyn can help. We combine deep expertise, sector understanding and strategic insight to help customers enable responsible innovations.