ChatGPT Moves Into EU’s Strictest Tier

The European Commission’s decision to put ChatGPT, Reddit and Roblox into the toughest tier of the EU’s online-safety regime is easy to misread. It is not a finding that any of the three has broken the law. It is the Commission saying these services are now so large that their internal choices can spill out beyond their own user base and shape public life across the Union.

A useful way to think about it is the difference between a business saying its systems are grand and an inspector being entitled to check. The Digital Services Act, the EU law governing online platforms, has now moved all three into that second category.

The Size Rule

The Digital Services Act sets a clear threshold. Any online service with more than 45 million monthly users in the EU enters the highest oversight tier (European Commission). That is roughly a tenth of the EU’s population, the point at which Brussels treats a platform’s design as capable of producing effects across the bloc, not just inside a particular app or website (Commission DSA overview).

All three passed that line. ChatGPT reported roughly 159 million EU users for its search function, Reddit 57.2 million, and Roblox about 47 million (Euronews, Yahoo News). The total number of designated services now stands at 28 (IEU Monitoring).

Reddit and Roblox are familiar territory for the DSA. Reddit is built around user-generated content. Roblox is built around user-created games. ChatGPT is the more revealing case. The Commission classified it as a search engine because, when asked a question, it can retrieve and rank external information from the web (Straits Times). A search engine influences what people find. A chatbot that searches the web goes a step further by turning several sources into one conversational answer, making it harder for the user to see why that answer appeared rather than another.

This is the first time a mainstream AI chatbot has been brought into this tier. The AI Act, a separate EU law, already places transparency duties on chatbots. The DSA designation works differently. It treats ChatGPT as information infrastructure large enough to cause harm through design choices at scale, rather than through one particular answer or post (Les Echos, ZDNet France).

Annual Health Check, Outside Inspector, Open Books

The three services have four months from notification to comply. In practice, the move changes the burden from "trust us, we moderate" to governance that can be tested and audited (DSA, Regulation 2022/2065). Three obligations matter most.

First, each company must carry out an annual risk assessment, examining how its design, algorithms and user behaviour may contribute to illegal content, harm to children, damage to public debate or security risks (EDAA explainer). Second, independent auditors must assess whether the safeguards actually work, rather than leaving the companies to mark their own homework (Prighter DSA text). Third, the Commission and vetted academics can seek access to information about how algorithms rank and recommend content, under a framework set out in a 2025 delegated regulation.

That does not mean an EU official will sit between a ChatGPT prompt and its answer, or approve individual Reddit posts. The focus is the system: ranking logic, moderation tools, advertising architecture and child-safety design. When the Commission believes the law has been breached, it uses separate enforcement powers, as it has already done with a €120 million fine against X and preliminary findings against Meta over addictive design. Fines can reach 6% of worldwide annual turnover (Brussels Times).

Why Families Should Pay Attention

For parents, Roblox is the easiest case to grasp. Around 70% of its users are under 18 (Biz Chosun). The DSA’s guidelines on minors ban targeted advertising based on user profiles where a service knows the user is a child. The top-tier designation also requires Roblox to assess whether its user-created games, chat systems and recommendation algorithms create risks for children at scale (Commission minors guidelines).

Roblox has already introduced facial-recognition age checks, age-banded chat restrictions and AI moderation. The issue now is whether those measures work together in practice, across a platform used by tens of millions of children. The Commission will now have the legal basis to press that question.

Executive Vice-President Henna Virkkunen described the designations as matching scrutiny to reach (UPI). The powers behind that language are real. By late December, the companies should be able to show completed risk assessments, audit arrangements and processes for researcher access. The test now is whether the Commission’s audit machinery can tell the difference between genuine accountability and well-presented compliance paperwork.