A chatbot answering a question about postal voting returns four paragraphs of prose, with nothing to click and nothing to compare. The Commission has put that product in the same regulatory family as the services that organise and direct users to information on the web [10]. Product teams often treat a chat answer as a first draft the user checks elsewhere. The designation instead treats the answer as the place the user stops.
That distinction is not cosmetic, because the DSA attaches different duties to different service types [9]. Search-shaped obligations assume there is an index and a ranking someone can inspect. Here the thing under audit is the whole production chain behind a sentence. The designation adds no new rules; it moves three companies into a regime that requires an annual systemic risk assessment covering illegal content, protection of minors, physical and mental wellbeing, fundamental rights, electoral processes and public security [11], plus independent audits and data access for regulators and vetted researchers [12]. For OpenAI that means writing up electoral process and public security risk in a form an auditor can actually test [17].
The threshold arithmetic is the part every other assistant team should run. ChatGPT's reported 159 million monthly EU users sit about 3.5 times above the 45 million bar [1] and about 2.8 times Reddit's 57.2 million [3], while Roblox cleared the line by roughly three million [2]. A product distributed as a default surface can pass 45 million users in a single quarter, with no launch moment required.
The clock is four months, ending in November [15], and the assessment repeats every year [11]. The 6 percent of global turnover ceiling for serious violations is the number that gets quoted [16], but the standing cost is the function that produces the file and survives the audit. Note also that the obligation is pinned to OpenAI Ireland Limited, with Irish regulators sharing enforcement with the Commission [20], so the work lands on an EU subsidiary's headcount rather than on a US org chart.
A simple grid decides how much of this applies to you tomorrow. One axis: does your product hand back an answer or a route to sources. The other: are you within one year's growth of 45 million EU monthly users. If your product routes users to sources and you are far from that threshold, this is reading material. If it answers directly and you are close to that threshold, you are already writing the same document OpenAI is writing, only later. The teams that get through a first audit will be the ones that can name, for each of the six risk headings, the person who owns it and the evidence they would hand a regulator without renegotiating what counts as commercially sensitive [13].
