Digital Services Act: EU Commission Tightens Requirements
What do a chatbot, a discussion forum, and a gaming platform have in common? As of now, they are all subject to the same strict legal framework. On August 31, 2026, the European Commission officially classified ChatGPT, Reddit, and Roblox into the highest obligation category under the Digital Services Act, with significant consequences for all three services.
Teilen Sie diesen Beitrag:
Teilen Sie diesen Beitrag:
What is the Digital Services Act?
The Digital Services Act (DSA) is the EU’s key regulation governing digital services. It imposes tiered obligations on online platforms, marketplaces, and search engines—ranging from basic transparency to comprehensive risk management—depending on their size and reach. The strictest rules apply to the VLOP and VLOSE categories—very large online platforms and very large online search engines—and ChatGPT, Reddit, and Roblox now fall into precisely these categories.
The European Commission’s Classification in Detail
In the future, ChatGPT will be classified as a very large online search engine, or VLOSE. Reddit and Roblox will be classified as very large online platforms, or VLOPs. The reason is purely based on numbers: All three services reach an average of at least 45 million active users per month in the EU—the threshold at which the Digital Services Act deploys its most stringent measures. According to current figures, ChatGPT—with approximately 159 million monthly users in the EU—is actually well above this threshold, while Reddit has about 57 million and Roblox has around 47 million.
The fact that, of all things, an AI chatbot will be classified in the same category as Google or Bing in the future shows just how much the European Commission is guided by the actual use of digital services. Generative AI has become part of the daily lives of millions of people within just a few years, and the Digital Services Act responds to this not by creating a special category for AI systems, but simply by applying the existing scope logic.
What’s Changing for Businesses
With this new status, ChatGPT, Reddit, and Roblox fall into the highest liability category under the Digital Services Act. Specifically, they will be required in the future to annually assess and actively mitigate systemic risks posed by their services, take more consistent action against illegal content, significantly expand protections for minors, safeguard users’ fundamental rights, and monitor and document the impact of their platforms on electoral processes and public safety. In addition, they must undergo independent audits and provide greater transparency regarding advertising.
This isn’t just lip service. Anyone who fails to comply with these obligations risks fines of up to six percent of their global annual revenue—a figure that would hurt even tech giants worth billions. The fines imposed so far under the Digital Services Act already show that the European Commission means business: a total of around 870 million euros has already been imposed—550 million against AliExpress, 200 million against Temu, and 120 million against X.
EU Executive Vice President Henna Virkkunen sums it up: These new designations mean that ChatGPT, Reddit, and Roblox are now subject to a higher level of oversight and accountability, in line with their now enormous societal reach. Incidentally, two different authorities are responsible for oversight: Ireland oversees ChatGPT and Reddit, while the Netherlands is responsible for Roblox.
The clock is ticking: Four months to go
Starting from the official notification, the three services have four months to implement the additional requirements. This means that by the end of December 2026, ChatGPT, Reddit, and Roblox must have brought their internal processes, risk assessments, and safeguards up to the new standard.
Why this is also drawing attention outside of Brussels
For us at BAYOOCARE, this announcement is more than just a footnote in tech regulation. It is yet another sign of the direction in which the European regulatory landscape as a whole is heading. Just as with medical device legislation under the MDR, we see the same fundamental principle at play in the Digital Services Act: The greater the reach and potential risk of a product or service, the higher the regulatory requirements for risk management, documentation, and user protection.
The fact that an AI system like ChatGPT is now also subject to such close scrutiny is another piece of a larger trend. Across all industries, software, AI, and digital services are moving closer to a level of compliance that has long been standard practice in medical technology. For anyone who develops or uses regulated software, it’s worth looking beyond their own field, because the principles of risk assessment, user protection, and accountability are similar, whether we’re talking about a medical device or a chatbot with an audience of millions.
What Companies Can Learn from the DSA Classification for Their Own Compliance
Even those who aren’t subject to the Digital Services Act themselves can learn something from this case. Here are a few points that apply across all industries:
- Scope and risk go hand in hand. When scaling up, you should scale up risk assessment and documentation from the very beginning, rather than adding them later.
- Formal certification does not automatically protect against complaints. Regulatory authorities are increasingly focusing on the actual impact of a product or service, not just on the existence of a certificate.
- Transition periods are short. Four months is ambitious for a global tech conglomerate; this is even more true for smaller companies facing comparable deadlines within their own regulatory environments.
- Documented due diligence pays off in the event of a dispute, regardless of whether it concerns consumer protection under the Digital Services Act or risk management under the MDR.
Conclusion
The classification of ChatGPT, Reddit, and Roblox demonstrates how consistently the European Commission is now adhering to its “reach-based” approach, regardless of whether a service was launched as a search engine, social network, or AI chatbot. For companies in regulated industries, this is a mirror to hold up to themselves: The principles of risk management, documentation, and user protection—which have long been standard practice in medical technology—are now gaining traction elsewhere as well.
