A PYMNTS Company

EU Wrestles With How To Apply the Digital Services Act to ChatGPT

By  |  November 4, 2025
EU Wrestles With How To Apply the Digital Services Act to ChatGPT

The European Commission is struggling to decide whether to classify ChatGPT as a very large online platform (VLOP) now that the large language model (LLM) has crossed the threshold of average monthly uses established for platforms and search engines in the EU’s landmark Digital Services Act (DSA). Designation as a VLOP or VLOSE would subject the AI model to the most stringent regulations under the law.

    Get the Full Story

    Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

    yesSubscribe to our daily newsletter, PYMNTS Today.

    By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions.

    OpenAI reported last month that its chatbot now has 120.4 million average monthly users in the EU, well above the 45 million users mark set by the law for VLOP designation. Should the Commission decide that LLMs fall within the scope of the DSA, OpenAI could be at risk for substantial fines of up to 6 percent of its global turnover for violations of the law.

    The DSA came into force in 2024 to regulate systemic risks to privacy posed by social media platforms, search engines and other online services. But it was conceived and drafted largely before ChatGPT and other Gen-AI chatbots were in wide use, and the language and definitions in the law do not clearly cover LLMs. A decision by the Commission is not expected at least until mid-2026.

    The question highlights the challenges jurisdictions face when bright-line rules and regulations run up against rapidly evolving technologies such as artificial technology. In this case, the Commission faces the additional challenge of strong opposition to the DSA from the U.S., particularly when applied to U.S. tech companies. The law, along with the Digital Markets Act (DMA) and the AI Act, has been a flashpoint in trade talks between the U.S. and EU and extending it to cover a flagship U.S. AI company risks re-igniting that controversy.

    Related: PayPal Partners With OpenAI to Bring Payments Directly Into ChatGPT

    But the question also highlights the compliance challenges AI companies will face as the protean nature of the technology steers them into new regulated industry sectors. An OpenAI spokesperson confirmed to Euractiv that the EU user figures it publishes include only ChatGPT’s use in search, not any other use case.

    “For an industry used to voluntary AI-safety frameworks and self-defined benchmarks, the DSA’s legally binding due diligence regime might be a tough reality check,” Mathias Vermeulen of the Brussels law firm and consultancy AWO Agency told Politico Europe. “OpenAI will have to step up its game significantly and won’t be able to get away with a simple copy/paste job of what it is currently doing.”

    A critical question concerns the scope of any designation of ChatGPT, Joris Van Hoboken, a law professor focused on AI governance at the Vrije Universiteit Brussels told Politico. The Commission could limit it to just the chatbot’s search functionality and classify it as a search engine, he said, or it could apply the designation to the full breadth of LLM’s capabilities and classify it as a platform or service. If the Commission chooses the latter designation, OpenAI would face much more extensive compliance challenges.

    ChatGPT also is already regulated by the AI Act, and the risk frameworks of the two laws are not perfectly aligned. If the full scope of ChatGPT is brought under the DSA, OpenAI would face the additional challenge of serving two different compliance masters.