ChatGPT Enters DSA Top Tier

Headlines about Brussels placing ChatGPT, Reddit and Roblox under the EU’s strictest online-safety regime can sound like a penalty. It is not. The European Commission has put all three in the category reserved for services so large that their design choices can affect public life across the Union, including Malta, where a change in an algorithm can quickly shape what people see, share and believe.

The better comparison is not a police charge. It is a building moving from self-certified maintenance to compulsory inspection.

The Size Rule

The Digital Services Act sets a clear threshold: any online service used by more than 45 million people per month in the EU enters the highest oversight tier (European Commission). That figure is roughly a tenth of the EU’s population, the point at which Brussels treats a platform’s architecture as capable of producing Union-wide effects (Commission DSA overview).

All three passed that line. ChatGPT reported around 159 million EU users for its search function, Reddit 57.2 million, and Roblox about 47 million (Euronews, Yahoo News). The number of designated services now stands at 28 (IEU Monitoring).

Reddit and Roblox are straightforward cases. Reddit is built on user-generated content. Roblox is built on user-created games. Both sit squarely within the type of platform the DSA was designed to supervise.

ChatGPT is the more consequential designation. The Commission classified it as a search engine because, when asked a question, it can retrieve and rank external information before producing an answer (Straits Times). A search engine influences what people find. A chatbot that searches the web goes a step further: it compresses several sources into one conversational reply, making it harder for the user to see why one answer appeared instead of another.

This is the first time a mainstream AI chatbot has entered this tier. The AI Act, which is a separate law, imposes transparency duties on chatbots. The DSA designation does something else. It treats the service as information infrastructure large enough to create risk through its design and scale, rather than through one particular post, game or answer (Les Echos, ZDNet France).

Annual Health Check, Outside Inspector, Open Books

The three services have four months from notification to comply. In practice, the obligation moves them from "trust us, we moderate" to governance that can be tested and audited (DSA, Regulation 2022/2065).

Three things change. First, they must carry out an annual risk assessment, looking at how their design, algorithms and use patterns may contribute to illegal content, harm to children, effects on public debate and security risks (EDAA explainer). Second, independent auditors, rather than the companies themselves, must assess whether the safeguards work (Prighter DSA text). Third, the Commission and vetted academics can request access to information on how ranking and recommendation systems operate, under rules set by a 2025 delegated regulation.

This does not mean an EU official will sit between a ChatGPT prompt and its answer, or approve individual Reddit posts. The target is the system: ranking logic, moderation tools, advertising design and child-safety architecture.

When the Commission finds breaches, it uses separate enforcement powers. It has already issued a €120 million fine against X and made preliminary findings against Meta over addictive design. Fines can reach 6% of worldwide annual turnover (Brussels Times).

For Malta, this is EU regulation acting as domestic policy. These platforms are not outside the country’s public sphere. They sit inside the daily information diet of students, parents, journalists, gamers, campaigners and anyone with a phone in a pjazza, classroom or office.

Why Families Should Pay Attention

For parents, Roblox is the clearest case. Around 70% of its users are under 18 (Biz Chosun). The DSA’s guidelines on minors prohibit targeted advertising based on user profiles when a service knows the user is a child. The top-tier designation also requires Roblox to assess whether its user-created games, chat systems and recommendation algorithms create risks for children at scale (Commission minors guidelines).

Roblox has already introduced facial-recognition age checks, age-banded chat restrictions and AI moderation. The issue now is whether those systems work together when millions of children use the platform every day. The Commission will be able to ask for evidence, not just assurances.

Executive Vice-President Henna Virkkunen described the designations as a way of matching scrutiny to reach (UPI). The legal powers behind that statement are real.

By late December, the companies should be able to show completed risk assessments, audit arrangements and processes for researcher access. The designation itself is only the start. The test is whether Brussels can separate genuine accountability from well-presented compliance paperwork.