EU Examines Regulating OpenAI Under Digital Services Act

The European Commission is formally assessing whether OpenAI's ChatGPT should be designated under the Digital Services Act after OpenAI published user figures above the 45 million DSA threshold. OpenAI disclosed approximately 120.4 million average monthly active recipients in the EU over the six months to end-September 2025. Commission spokesman Thomas Regnier said the Commission services are "currently assessing this information" and that Large Language Models could fall into scope on a case-by-case basis. German outlet Handelsblatt reported the company would be classified as a very large online search service, a designation Reuters later referenced in corrected copy.

Designation under the DSA (for very large online platforms or search services) triggers a set of escalated compliance obligations focused on systemic risk and transparency. Practitioners should expect requirements around:

• •independent risk assessments and mitigation measures for systemic harms
• •increased transparency reporting and algorithmic accountability, including documentation of ranking and recommendation logic
• •external audits and oversight access to platform data for regulators and vetted researchers
• •stronger content-moderation processes and crisis protocols

These obligations target operational governance rather than model architecture, but will have direct operational consequences: more comprehensive logging, stronger provenance controls, documented datasets and fine-tuning pipelines, and formalized red-teaming and incident response workflows.

This review is the most concrete sign yet that Brussels intends to apply existing digital-platform rules to generative AI products. The DSA was built to govern large intermediaries; extending it to ChatGPT signals regulators view high-reach LLM deployments as comparable systemic intermediaries. For platform operators and ML teams, the practical impact will land on deployment, monitoring, and documentation practices more than on model weights. For smaller providers, the precedent matters because it clarifies how user-count disclosures and service definitions map to regulatory obligations.

The Commission's designation decision and its interpretation of "search" versus "interactive generative service" will set a legal and operational template. Expect follow-on scrutiny of other major LLM providers, and rapid adjustments in compliance tooling, data governance, and transparency APIs as companies prepare for DSA-style oversight.