The EU has classified ChatGPT as a search engine. Referring to it as a platform would have provided OpenAI with protection from liability.

      The European Commission designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act (DSA), which subjects OpenAI to potential fines of up to 6% of its global revenue. However, this designation only pertains to the tool's retrieval functions and not its conversational aspects. The article argues that classifying it as a Very Large Online Platform would have offered safe harbor—the protection typically granted to companies that host user-generated content—implying that the output generated by a chatbot consists of third-party material.

      On Monday, the European Commission classified ChatGPT as a Very Large Online Search Engine under the DSA, imposing transparency and risk-management responsibilities similar to those required of Google and Bing. This decision exposes OpenAI to fines of up to 6% of its global annual revenue, but as reported by Eliza Gkritsi and Pieter Haeck in Politico, the classification is limited enough that the chatbot's actual conversations are largely unregulated.

      This distinction is significant. For instance, asking ChatGPT to name candidates in a local election now falls under the DSA, while discussing whom to vote for—where misinformation could arise—may not be covered.

      Why not label it as a platform?

      The Commission had the alternative option of classifying it as a Very Large Online Platform, which includes social media and marketplaces, thus imposing content moderation responsibilities. This categorization could have been beneficial for OpenAI, as platform laws globally are founded on the safe harbor principle, meaning companies aren't held liable for content uploaded by users. Applying this concept to a chatbot raises the question of whether the interactive dialogue between a user and a machine constitutes user-generated content.

      If the answer is affirmative, a model's output may resemble third-party material merely hosted by its creator. Granting this status to a company that generates every word it provides is a significant advantage.

      The cost of the safer choice

      However, avoiding this characterization comes with its own costs, particularly affecting children. Christel Schaldemose, a Danish socialist MEP and key negotiator for the DSA, stated that ChatGPT is “much more than a search engine” and that risks directly linked to the chatbot lie beyond the regulation's most stringent obligations.

      She pointed out issues such as emotional dependency and manipulative or addictive designs, urging the Commission to clarify how current regulations address these concerns. These design issues pertain to the conversational aspects of the chatbot, which the current designation does not cover.

      The scale of the issue is considerable. According to AXA’s 2026 mind health report, as many as 60% of adults worldwide utilize chatbots for therapeutic purposes. Moreover, the companionship aspect of chatbots has been central to legal disputes, such as the case initiated by the parents of a 16-year-old, Adam Raine, in California.

      A category problem, not a drafting error

      The DSA was completed in 2022 and did not account for this situation. João Pedro Quintais, an associate law professor at the University of Amsterdam, describes ChatGPT as a hybrid entity, combining functions of a search engine, an online platform, and something akin to a content publisher.

      This third function is not addressed by any existing classification. The DSA was created to regulate how companies handle content produced by others, whereas a model generating its own material stands apart from this framework.

      It took the Commission nearly a year to reach this decision, reflecting the complexity of the classification process. Experts informed Politico that without access to the full designation text, it remains unclear what specific actions OpenAI is now required to undertake.

      The parallel track, and its blind spot

      The Commission also has another regulatory mechanism aimed at the same company. Under the AI Act, creators of general-purpose models have been mandated since last August to evaluate and manage systemic risks, with enforcement commencing at the end of that month when the Commission scrutinized AI companies regarding their safety protocols.

      The expert group highlighted significant concerns: nuclear and biological weaponry, loss of control over models, autonomous hacking, and large-scale manipulation scenarios, particularly focusing on rogue-agent situations this year.

      Daniel Leufer from AccessNow accurately identifies the gap, stating that the guidance is “more focused on so-called existential risks than risks to fundamental rights.” A teenager developing reliance on a chatbot does not constitute a systemic risk as understood by the AI Act, nor is it clearly classified as a search risk under the DSA.

      Where the harms actually get regulated

      Brussels has developed a framework for addressing this issue, which has been applied in other contexts. The Commission has taken action against Meta for creating addictive designs aimed at children under the DSA, treating design choices as the regulated subject.

      Leufer argues that the designation presents an opportunity to pursue the same approach here—to delve into the design decisions and recognize ChatGPT as what it truly is: a product. This perspective is gaining traction across various jurisdictions.

      Regulators from Brazil to California have begun focusing on design guidelines rather than access restrictions,