--- title: "The EU Classified ChatGPT by Function, Not Name" slug: "eu-dsa-chatgpt-vlose-classified-by-function" author: "Jaione Amigot" date: "2026-09-01 12:00:00" category: "Premium" topics: "EU Digital Services Act, DSA, VLOSE, ChatGPT regulation, AI governance, enterprise AI compliance, audit trail, self-hosted AI" summary: "On 31 August 2026 the European Commission designated ChatGPT a Very Large Online Search Engine under the DSA — classifying an AI assistant by what it does rather than what its vendor calls it. The precedent matters more than the ruling, because most enterprise agents retrieve and synthesise information too." banner: "" thumbnail: "" linkedin: | The European Commission designated ChatGPT a Very Large Online Search Engine on 31 August. Read the reasoning, not the headline. ChatGPT was not classified as an "AI system." It was classified as a search engine, because the Commission looked at what it does: users put in a query, it retrieves and synthesises information, and it does so at scale — the search function averaged about 159 million monthly active users in the EU for the six months ending March 2026, against a 45 million threshold. Reddit and Roblox were designated the same day as Very Large Online Platforms. All three have four months, to January 2027, to comply. DSA penalties run to 6% of global annual turnover. Here is why this should interest anyone running internal agents. The Commission classified by FUNCTION. An internal knowledge agent your staff query to find documents performs the same operation — retrieve, rank, synthesise. Nobody is suggesting your intranet assistant is about to be designated; the thresholds are enormous and aimed at public services. What travels is the reasoning: regulators are reading behaviour, not product categories, and "we call it an assistant" is not a classification. So the practical question is not "are we a VLOSE." It is: if a regulator asked tomorrow which model answered a given query, on what data, for which user, under what access rules — could you answer from records you hold? For most organisations that evidence lives inside a vendor's platform, and you can request it rather than produce it. On ibl.ai you own all the code and the data. The audit log, the access controls and the model routing run inside your own perimeter, model-agnostic across any LLM, with no per-seat pricing — so the evidence a regulator asks for is a query you run, not a support ticket you file. #iblai #AIGovernance #DigitalServicesAct #EnterpriseAI #AIRegulation #Compliance --- ## The Short Answer **On 31 August 2026 the European Commission designated ChatGPT a Very Large Online Search Engine under the Digital Services Act — classifying an AI assistant by what it does, not by what its vendor calls it. Any enterprise agent that retrieves and synthesises information inherits that logic. On ibl.ai you own all the code and the data, so the audit trail, access controls and model routing a regulator would ask about already sit inside your own perimeter.** The designation itself applies to a consumer service at a scale almost no internal tool will reach. The reasoning is what transfers, and it is the part worth reading closely. ## What did the European Commission actually decide on 31 August 2026? The Commission designated **ChatGPT as a Very Large Online Search Engine (VLOSE)**, and **Reddit and Roblox as Very Large Online Platforms (VLOPs)**, under the Digital Services Act. The threshold for designation is reaching at least **45 million average monthly users in the EU**. ChatGPT's search function was reported at roughly **159 million monthly active EU users** for the six months ending March 2026 — more than three times the bar. All three services have **four months to comply**, which puts the deadline in **January 2027**. DSA infringements carry penalties of up to **6% of global annual turnover**. The obligations are not cosmetic. They include annual systemic risk assessments covering illegal content, effects on minors, users' physical and mental wellbeing, fundamental rights, electoral processes and public security — plus independent audits and data access for vetted researchers.
Service Designation Basis of classification
ChatGPT Very Large Online Search Engine Responds to user queries by searching and synthesising the web
Reddit Very Large Online Platform Hosts and disseminates user-generated content at scale
Roblox Very Large Online Platform Hosts and disseminates user-generated content at scale
The Commission described ChatGPT as a *hybrid service*: not purely a search engine, but performing the search function well past the threshold at which the DSA applies. ## Why does classifying AI by function rather than by name matter? Because it removes naming as a defence. A vendor cannot avoid an obligation by calling a product an "assistant", a "copilot" or a "knowledge tool" if the thing it does is retrieve information and answer queries. The Commission read the behaviour and applied the category that fits. That is a durable regulatory instinct, and it is not unique to the EU. Function-based classification is how financial regulators have treated instruments for decades: what a product *is* follows from what it *does*, regardless of the label on the marketing page. For enterprise AI, the consequence is narrower than the headlines suggest and more useful. Your internal agent is not about to be designated a VLOSE — the thresholds are enormous and aimed at services with tens of millions of public users. What changes is the burden of description. When a regulator, auditor or customer asks what a system does, the answer has to be based on its actual behaviour, and you need records that show it. ## Which internal systems perform the same function the Commission looked at? More than most organisations have mapped. Consider what "retrieve and synthesise in response to a query" actually covers: - **An internal knowledge agent** staff query to find policies, contracts or documentation. Retrieve, rank, synthesise — functionally the same operation. - **A customer-facing support assistant** that pulls product information and makes recommendations. - **An autonomous agent** that searches enterprise systems, decides, and acts on what it finds. The third is the one that should get attention, because it adds action to retrieval. An agent that reads a record and then does something — files, approves, escalates, emails — is making decisions traceable to a specific model, prompt and data snapshot. This is where the [agent sprawl problem](/blog/agent-sprawl-board-issue-enterprises-cannot-count-agents) becomes a compliance problem rather than an operational one. An organisation that cannot enumerate its agents cannot describe their function, and an organisation that cannot describe function cannot answer a classification question about itself. ## What would you actually need to produce if someone asked? Strip away the regulatory vocabulary and the DSA obligations reduce to a small number of concrete questions. For any given AI-generated answer or action: 1. **Which model produced it?** Including version, and whether it changed since. 2. **What data did it see?** Which sources, which documents, which records. 3. **Who was the user, and what were they entitled to see?** Access control at the moment of retrieval, not in a policy document. 4. **Can an independent party verify this?** Records that survive being handed to someone outside the team. None of these is exotic. All of them are trivial if the system writes its own logs into infrastructure you control, and awkward if it does not. That asymmetry is the practical point. When your AI runs on a vendor's platform, evidence about your own operations is something you **request**. When it runs on infrastructure you own, evidence is something you **query**. ## How do you make compliance a configuration rather than a retrofit? By putting the governance layer under the agents rather than beside them. Broadcom made exactly this argument at VMware Explore the same week, shipping agent governance into the hypervisor and network layer — [governance as infrastructure rather than application code](/blog/broadcom-agentminder-agent-governance-moves-to-infrastructure). The thesis is right: governance implemented per application is governance you re-implement per application. The follow-on question is whose infrastructure it runs on. A control plane you rent is still a dependency priced, versioned and roadmapped by someone else. On ibl.ai the governance primitives — role-based access control, SSO, full audit trails, model-agnostic routing and agent sandboxing — are part of a stack you deploy yourself. Because **you own all the code and the data**, producing an audit trail is a query against your own records, and switching models when a regulator, a price change or a benchmark demands it is a configuration change rather than a migration. That matters more than it sounds. Four months is a short compliance window for an organisation that has to negotiate with a vendor for its own logs. ## What should you do before January 2027? Not panic about designation. Nothing here suggests an internal tool crosses a 45-million-user threshold. Do three things instead, in order: **Inventory what you actually run.** Not the approved list — the agents in production, including the ones a team stood up without telling anyone. **Describe each by function.** What does it retrieve, what does it synthesise, what does it act on? Write it in behavioural terms, because that is how a regulator will read it. **Check where the evidence lives.** For each system, can you produce the model, the data and the access context for a given answer, from records you hold? Where the answer is no, that is your actual exposure — and it exists whether or not any regulator ever asks. The EU classified ChatGPT by what it does. The reasonable assumption is that everyone else will read your AI the same way. **Sources:** [European Commission — Commission designates ChatGPT, Reddit, Roblox under the Digital Services Act](https://digital-strategy.ec.europa.eu/en/news/commission-designates-chatgpt-reddit-roblox-under-digital-services-act) · [Euronews — EU places ChatGPT, Reddit and Roblox under strictest digital safety rules](https://www.euronews.com/next/2026/08/31/eu-places-chatgpt-reddit-and-roblox-under-strictest-digital-safety-rules) ## Why does owning the AI stack matter? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.