ChatGPT designated as ‘very large online search engine’ in the EU

The move, confirmed by the European Commission, means OpenAI, the business behind ChatGPT, has until January 2027 to comply with the rules that apply to VLOSEs under the DSA.

The DSA imposes obligations on online intermediaries, strengthening, among other things, existing laws that govern how those businesses must manage illegal and harmful content published, and goods and services sold, via their services. A tiered system of regulation is provided for under the regulation, with the most stringent duties falling on the largest businesses within scope of the regime – ‘very large online platforms’ (VLOPs) or VLOSEs. Pinsent Masons has published a guide to help online intermediaries understand whether their services will be subject to the DSA and, if so, under which category.

Under the Digital Services Act, an ‘online search engine’ is defined as “an intermediary service that allows users to input queries in order to perform searches of, in principle, all websites, or all websites in a particular language, on the basis of a query on any subject in the form of a keyword, voice request, phrase or other input, and returns results in any format in which information related to the requested content can be found”.

In its statement, the European Commission said it believes the ChatGPT service falls within the scope of that definition.

The Commission said: “ChatGPT is an Artificial Intelligence (AI) system that can engage with and respond to users' prompts and queries, including by searching the web. Hence, ChatGPT is a hybrid service that qualifies as an online search engine under the DSA.”

Under the DSA, providers of online search engines are required to publish information on the average monthly active recipients of each of their services in the EU at least once every six months. That information informs whether the online search engine fits the criteria for being designated as a VLOSE. Online search engines which have a number of average monthly active recipients of the service in the EU equal to or higher than 45 million are eligible to be designated as VLOSEs.

Recital 77 of the DSA provides some guidance on the concept of ‘active recipient’ and, in 2023, the European Commission published further guidance with a view to clarify the concept and related reporting requirements.

ChatGPT’s designation has a range of practical implications for the service and OpenAI, its provider.

As a first step, OpenAI must “diligently identify, analyse and assess any systemic risks” in the EU that stem from “the design or functioning of” ChatGPT and its related systems, including algorithmic systems, or from the use made of the service. It is then obliged to put “reasonable, proportionate and effective mitigation measures” in place that are “tailored to the specific systemic risks identified”.

Among other requirements, providers of VLOSEs face a range of enhanced transparency obligations under the DSA, compared to other online intermediaries, and must also establish an independent compliance function in respect of the in-scope service that is separate from the rest of its operations.

VLOSEs must also subject themselves to annual independent compliance audits and can be forced to disclose data to regulators – in ChatGPT’s case, the European Commission and/or Ireland’s Media Commission – to enable them to scrutinise their compliance with the DSA too.

The European Commission has now designated 28 VLOPs and VLOSEs under the DSA, after confirming Reddit’s and Roblox’s designations as VLOPs alongside ChatGPT’s designation as a VLOSE on Monday. Some businesses, including Amazon and Zalando, have previously challenged their designations before the EU courts.