ChatGPT just got hit with the EU’s toughest platform rules

What happened

A few days ago, on Monday, August 31st, the European Commission officially designated ChatGPT as a Very Large Online Platform (VLOP) under its Digital Services Act (DSA). This places ChatGPT on the same list as major social platforms, marking it as the first AI chatbot to receive this designation. Reddit and Roblox were also added to the list concurrently. The trigger for this classification is exceeding 45 million monthly users within the European Union.

This VLOP status initiates a four-month compliance period for OpenAI. During this time, ChatGPT must implement stronger processes and increased transparency, including conducting deeper risk reviews and demonstrating efforts to reduce systemic harm. This encompasses issues like illegal content, scams, harassment, exploitation, and risks to minors, mental well-being, and public safety. For a chatbot, these obligations apply to what the model says, what it refuses to say, and how it might be misused. The DSA focuses on large services distributing content at scale, distinct from the AI Act, which governs AI systems and models.

Why it matters

The designation of ChatGPT as a Very Large Online Platform under the Digital Services Act signals a significant shift in how AI services are perceived and regulated. This move treats AI chatbots not merely as tools, but as media channels with widespread influence, requiring a higher degree of accountability. This precedent suggests that as AI becomes more ubiquitous, it will increasingly be subject to the same regulatory scrutiny as other large-scale content platforms.

For users, this designation could lead to more friction in Europe, potentially through increased notices, explanations for blocked outputs, and enhanced reporting mechanisms for harmful content. Product development for the EU market might also slow, with features arriving later or with additional guardrails by default, as companies seek to avoid significant fines. This often results in EU regulations shaping global product decisions, as platforms find it expensive and complex to maintain entirely separate user experiences across regions.

Strategically, this move exposes platforms like OpenAI to greater responsibility for the outputs of their models, placing the onus on them to actively mitigate potential harms. For business leaders and operators, this could mean more transparency and consistency from AI systems, which can build trust for professional use cases like drafting emails or proposals. However, it also implies potential trade-offs, such as more refusals from the AI on sensitive topics or increased identity verification, as compliance becomes a more integrated part of the AI's operation.

What to watch next

• How rapidly OpenAI implements the required changes within the four-month compliance window.
• The specifics of OpenAI's new risk review processes and transparency reports for ChatGPT outputs.
• Whether other large AI models or chatbots in the EU cross the 45 million monthly user threshold and face similar DSA designations.
• If the EU's stricter rules for ChatGPT lead to a noticeable divergence in features or behavior between the EU and other global versions of the platform.
• How businesses that rely on AI tools adapt their workflows and internal policies in response to increased compliance and potential AI output limitations.

What this means for you

Business leaders and operators should recognize that AI is increasingly moving from an optional tool to critical infrastructure, attracting regulation. This shift mandates a proactive approach to understanding how AI outputs are generated and verified. When incorporating AI into core business processes, anticipate increased scrutiny on accuracy, potential biases, and safety. This might require updating internal guidelines for AI use, particularly for customer-facing applications or decision-making support.

To navigate this evolving landscape, implement practices that encourage transparency and accountability from AI systems. Adopt a "receipt mode" approach: when using AI for important deliverables or advice, prompt the AI to articulate its assumptions, uncertainties, potential risks, and what information needs human verification. This practice turns AI into a more careful assistant, fostering judgment in your team and mitigating the risks of "hallucinations" or unreliable outputs.

Key takeaways

• ChatGPT was designated a Very Large Online Platform by the EU, requiring stricter compliance.
• This designation was triggered by ChatGPT exceeding 45 million monthly users in the EU.
• OpenAI has four months to implement deeper risk reviews and enhance transparency.
• EU rules often shape global product decisions due to the complexity of running separate systems.
• Businesses should expect more transparency but also potential "no" answers from compliant AI systems.

What is the Digital Services Act?

The Digital Services Act (DSA) is an EU regulation that focuses on large online services distributing content at scale. It imposes obligations on these platforms, especially those designated as Very Large Online Platforms, to address systemic risks like illegal content, scams, harassment, exploitation, and threats to minors, mental well-being, and public safety. Its aim is to create a safer digital space by holding large platforms accountable for the content they host and propagate.

Why is ChatGPT now regulated like a social network?

ChatGPT is now regulated like a social network because the European Commission designated it as a Very Large Online Platform (VLOP) under the Digital Services Act. This designation applies to services with over 45 million monthly users in the EU, a threshold ChatGPT crossed. This means it's no longer seen merely as a quirky app or tool, but as a major platform that distributes content at scale, similar to social media platforms, and therefore carries similar obligations for systemic risk reduction and transparency.

What changes for ChatGPT users in Europe?

Users in Europe might experience more friction, such as increased notices or explanations if certain outputs are blocked. They will also likely have more ways to report harmful content. Features might arrive slower in the EU or with additional guardrails enabled by default as OpenAI works to comply with the stricter regulations. While this could mean more "no" responses around sensitive topics, it also implies greater transparency and potentially more trustworthy, consistent AI outputs for professional use.

How does the DSA differ from the AI Act?

The Digital Services Act (DSA) and the AI Act are distinct EU regulations. The DSA specifically focuses on large online services that distribute content at scale, like social media platforms and now large AI chatbots such as ChatGPT, imposing rules related to systemic harm reduction and content moderation. In contrast, the AI Act is centered on regulating AI systems and models themselves, focusing on the development and deployment of AI technologies across various risk levels. ChatGPT is now subject to both sets of regulations.

What are the main obligations for ChatGPT as a Very Large Online Platform?

As a Very Large Online Platform, ChatGPT must conduct deeper risk reviews to identify and mitigate systemic harms. These harms include illegal content, scams, harassment, exploitation, risks to minors, and threats to mental well-being and public safety. OpenAI is also required to implement stronger processes and increase transparency around its operations and content moderation, with a four-month deadline to comply with these enhanced obligations under the Digital Services Act.