ChatGPT Is Now an EU-Regulated Search Engine. What Does That Mean for AI Compliance?

One service can fall under several EU regulations

The European Commission has formally designated ChatGPT as a Very Large Online Search Engine, or VLOSE, under the EU Digital Services Act. That puts ChatGPT in the same DSA service category as Google Search and Bing.

The designation followed ChatGPT's declaration that it reaches at least 45 million average monthly users in the EU. The Commission's public list records 159.1 million for ChatGPT. The additional VLOSE obligations are due to apply four months after designation, by January 2027.

The important compliance point is that being classified as a search engine under the DSA does not mean ChatGPT stops being an AI system, and it does not exclude the service or its provider from other EU laws.

European regulation does not normally work on a one service, one law basis. Different rules can apply depending on what a service does, how it is provided and how people use it.

• Digital Services Act: additional obligations concerning systemic risk assessment and mitigation, transparency, fundamental rights, illegal content, minors, elections and regulatory oversight.
• EU AI Act: AI-specific rules that can concern providers, general-purpose AI models, transparency and other regulated AI activities.
• GDPR: independent data-protection requirements where personal data is processed.
• Other rules: consumer protection, copyright, competition and sector-specific law may also apply in the relevant circumstances.

Classification does not mean exemption

A classification under one EU regulation generally does not provide an exemption from another. The DSA designation concerns ChatGPT's legal classification under the Digital Services Act. It does not automatically determine how ChatGPT, its underlying models or a particular business use are classified under every other EU law.

A business may therefore need to ask several questions about the same system. Does the AI Act apply to the way we use it? Are personal data being processed under GDPR? Are there transparency duties? Does the system affect employees, candidates or customers? Which responsibilities sit with the provider, and which remain with us as the organisation deploying it?

Treating AI compliance as a check against one regulation can leave important gaps.

What the ChatGPT decision tells businesses

The decision shows how the EU can regulate a service according to the functions it now performs, not only the label originally attached to the technology.

ChatGPT began primarily as a conversational AI assistant. It now also performs web search and information-discovery functions used by millions of people. The Commission has applied a framework designed for very large search and intermediary services alongside legislation specifically governing AI.

The same principle matters at company level. An AI recruitment system, customer-service chatbot, employee productivity tool or automated decision system may interact with several areas of law at once. A new function can introduce an additional regulatory question without removing the existing ones.

AI compliance is broader than the AI Act

The EU AI Act remains the central European law focused specifically on AI. Organisations should still approach AI compliance as a wider governance exercise.

That means understanding which AI systems are used, what they do, what data they process, who may be affected, which legal frameworks are relevant and how responsibility is divided between the provider and the deploying organisation.

The practical lesson from the ChatGPT designation is simple: a new regulatory classification can add obligations. It does not necessarily remove the ones already there.