# The EU has officially decided ChatGPT is a search engine

> The ChatGPT EU search engine designation puts OpenAI under the DSA rules for very large search engines, with ranking disclosures due by January 2027.

- Published: 2026-09-02
- Topic: [AI](https://futuretechnologyhq.com/topic/ai/)
- URL: https://futuretechnologyhq.com/article/chatgpt-eu-search-engine-designation/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- OpenAI reported roughly 159.1 million average monthly EU users against a DSA threshold of 45 million
- ChatGPT now counts as a Very Large Online Search Engine because it answers prompts by searching the web
- OpenAI has four months, until January 2027, to publish how its ranking works and offer a non-personalised option
- Annual independent audits of systemic risk come with the designation

## Article

159.1 million average monthly users in the EU, against a legal threshold of 45 million. That is the number behind the ChatGPT EU search engine designation, announced by the European Commission on 31 August. OpenAI did not squeak past the line, it cleared it by more than three times.

The designation makes ChatGPT a Very Large Online Search Engine under the Digital Services Act. The Commission's reasoning is that a service which takes a prompt, searches the web, and returns an answer is doing the job of a search engine regardless of what its interface looks like. Reddit and Roblox were designated Very Large Online Platforms in the same round, which is a related but separate category with slightly different duties.

## What OpenAI now has to do

Four months, so until January 2027, to meet three obligations.

The first is publishing how its recommendation and ranking systems work. Anyone who has watched a chatbot cite one source and ignore an obviously better one is about to get a partial written answer on why.

The second is offering a version that is not personalised. Users have to be able to get results that are not shaped by whatever the system has inferred about them.

The third is annual independent audits of systemic risk, covering things like illegal content, effects on fundamental rights, and manipulation of the service. These are conducted by external auditors, not by OpenAI.

## Why this one is different

Regulators have circled AI for years, mostly by treating it as software that needs safety rules. This treats it as information infrastructure. The distinction matters because infrastructure rules come with disclosure duties rather than just conduct standards.

Whatever OpenAI publishes in January becomes the reference point for every competitor that crosses the same user threshold. Google, Anthropic and anyone else operating an assistant at EU scale will be measured against it, and the first document out of the gate tends to set the shape of the ones that follow.

There is a practical angle too. If ranking logic has to be documented, the mechanics of how an assistant chooses and weights sources stop being a black box, which changes what security researchers can reason about. That is directly relevant to the [prompt injection problems in AI browsers](/article/ai-browser-prompt-injection-2026/) we covered last month, where the core issue is that nobody outside the vendor knows how the model decides what to trust.

## What to watch

The interesting question is scope. OpenAI ships more than a chat box now, including [live voice models](/article/openai-gpt-live-voice-model/) and agent tooling that touches other services through protocols like [MCP and A2A](/article/a2a-protocol-vs-mcp/). The DSA designation names ChatGPT. Where the Commission draws the boundary around everything attached to it is the part that has not been settled.

January is the date to put in the calendar. Until then this is a label, not a change.

## Key takeaways

- The European Commission has designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act.
- OpenAI has four months to meet three obligations, including publishing how its recommendation and ranking systems work.
- The company must also offer a version of ChatGPT that is not personalised and provide annual independent audits of systemic risk.
- Regulators are treating AI as information infrastructure, which comes with disclosure duties rather than just conduct standards.
- The documentation of ranking logic will change what security researchers can reason about and is relevant to prompt injection problems in AI browsers.
- The scope of the DSA designation and its boundary around attached services has not been settled.

## Sources

- [Business Standard](https://www.business-standard.com/world-news/what-does-the-eu-very-large-search-engine-tag-mean-for-chatgpt-126090100678_1.html)
- [Gizmodo](https://gizmodo.com/the-eu-has-officially-decided-chatgpt-is-a-search-engine-2000805030)
- [WinBuzzer](https://winbuzzer.com/2026/09/01/eu-designates-chatgpt-tougher-dsa-search-engine-scrutiny-xcxwbn/)