EU designates ChatGPT, Reddit and Roblox under DSA

The European Commission has placed OpenAI’s ChatGPT under the Digital Services Act’s very large category for search services and branded Reddit and Roblox as very large online platforms, bringing the three services under direct EU supervision.

On 31 August 2026 the Commission said it would designate ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the DSA, triggering a four‑month timeline for the providers to come into line with obligations that include systemic risk management, independent audits and greater transparency about algorithmic recommender systems.

The designations elevate the services into the DSA’s strictest regulatory tier, meaning the Commission — not just national regulators — will have the power to supervise and, where necessary, require corrective measures. The DSA framework requires very large services to assess and mitigate systemic risks, submit to external audits and provide access to researchers; the Commission highlighted those obligations when announcing the moves.

For HR teams and enterprise buyers, the regulatory shift could materially affect how generative chatbots and platform‑based collaboration or recruitment tools are deployed. Vendor obligations on risk management and transparency may force changes to data‑handling terms, auditability of model outputs, and the way content moderation and recommender systems operate inside workplace deployments. Employers that have integrated ChatGPT‑style assistants into knowledge workflows or used Reddit‑ or Roblox‑based tools for recruiting and employee engagement should expect fresh vendor conversations about compliance and enterprise guarantees.

The decision is the latest step in a broader regulatory push in Europe to tighten oversight of large online services and generative AI. The DSA was conceived to tackle systemic harms that flow from scale — disinformation, illegal content and opaque algorithmic amplification — and regulators have repeatedly signalled they will treat AI‑driven services as sui generis when assessing risks. Industry observers say the move is consistent with prior DSA actions and with parallel efforts by EU institutions to police foundation models and platform algorithms more closely.

OpenAI, Reddit and Roblox will now have specific reporting and mitigation duties under the DSA’s very large category, but the Commission did not publish immediate details about how compliance will intersect with enterprise contracts, data‑processing agreements or workplace‑specific controls. The notice also did not say whether services’ paid or enterprise tiers will be treated differently, nor did it set out timelines for independent audits beyond the four‑month compliance window or explain how the Commission will prioritise workplace‑related risks such as biased hiring outcomes or employee surveillance features.

That lack of detail leaves HR professionals and in‑house counsel with concrete compliance questions: will platform risk assessments be granular enough to cover recruitment modules and internal assistants; will providers be obliged to certify enterprise‑grade safeguards; and how quickly will any required feature changes be rolled out to business customers?

For employers, the Commission’s move signals a moment to reassess vendor risk frameworks and procurement checklists. Expect contract negotiations to increasingly demand audit rights, transparency reports and clearer commitments on moderation and data use. Over time, DSA supervision may push vendors to bake workplace‑safe defaults into their products or to offer documented, auditable enterprise options — a shift that could change how organisations buy and govern AI assistants and platform‑based collaboration tools.