EU Eyes ChatGPT for Major Digital Services Act Regulation

The European Commission is currently evaluating whether OpenAI’s ChatGPT should fall under the classification of a “Very Large Online Search Engine” (VLOSE) as defined by Europe’s Digital Services Act (DSA). This decision could establish a significant precedent for how all generative AI chatbots are regulated within the European Union.

The debate was sparked after OpenAI disclosed in a recent report that ChatGPT’s search function attracted an average of 120.4 million monthly users in the EU over the last six months. This number is well above the 45 million-user threshold that mandates stricter obligations for “Very Large Online Platforms” (VLOPs) and VLOSEs under the DSA. A Commission spokesperson has confirmed that regulators are assessing this information to determine if ChatGPT qualifies for designation.

The Core Regulatory Question

The central challenge for the Commission is deciding whether to treat ChatGPT's search feature as a standalone service or as an integral part of the entire chatbot. The DSA is designed for intermediary services like search engines and social networks, and generative AI systems like ChatGPT do not fit neatly into these existing categories. The Commission noted that a large language model could fall under the DSA if it is integrated into a service that is already designated. The entire assessment, therefore, depends on this distinction.

Joan Barata, a Visiting Professor at the School of Law at Católica University in Porto, expressed surprise at the potential designation. “A service such as ChatGPT does not seem to fit in either of the three main categories established under the DSA—mere conduit, caching, or hosting—but much depends on this first classification,” he stated. He pointed out that classifying it as a hosting service would create complex challenges, as content policies for an AI chat are implemented differently than for traditional platforms.

Barata also highlighted the difficulty in labeling it a VLOSE, as only specific features of ChatGPT perform search functions. “We would need to differentiate between AI tools that purely assist in search activities from the delivery of elaborated answers, even if originally based on search,” he explained, warning that such a move could complicate the interpretation of both the DSA and Europe's AI Act.

New Obligations for OpenAI

If ChatGPT is designated as a VLOSE, it would be the first AI chatbot required to comply with systemic risk assessments, audit reporting, and extensive transparency obligations under the DSA. Laureline Lemoine, a senior associate at the law firm AWO, explained that this would force OpenAI to conduct annual risk assessments on ChatGPT's design, algorithms, and data practices. These assessments would evaluate the AI's impact on fundamental rights, electoral processes, and public health.

“OpenAI would have to assess whether ChatGPT risks having a negative impact on civic discourse and electoral processes, as well as on minors’ protection and mental health,” Lemoine said. The company would also need to conduct new assessments every time it deploys a major new feature. This could lead to a slower rollout of new functionalities in Europe.

Furthermore, the designation would trigger new data access obligations. Natali Helberger, a professor of information law at the University of Amsterdam, noted that Article 40 of the DSA would allow vetted researchers to access data to identify systemic risks. “It will raise interesting questions regarding the extent of data access rights, and whether the access obligation under Article 40 could potentially also include access to training data or model weights,” she explained. This right of access for researchers is a key provision in the DSA that is not present in the AI Act.

A Precedent for Generative AI Oversight

The way Brussels decides to classify ChatGPT will likely set the regulatory standard for all large-scale generative AI systems across Europe. This designation would mark a new era by bringing a chatbot under the umbrella of intermediary regulation for the first time.

Mathias Vermeulen, public policy director at AWO, emphasized that this would be a significant shift for an industry accustomed to voluntary safety frameworks. “The DSA’s legally binding due diligence regime might be a tough reality check,” he said. He argued that the current industry benchmarks are too narrow, and under the DSA, simple bias tests will not be sufficient for compliance.

“OpenAI will have to step up its game significantly and won’t be able to get away with a simple copy/paste job of what it is currently doing," Vermeulen concluded.