Brussels moves ChatGPT into the supervision tier it built for search engines

The reasoning that pulled ChatGPT into the top tier attaches to a capability rather than to a corporate identity. It sits in the search-engine category because it can answer prompts using information retrieved from the web, which the Commission treats as part of a hybrid service subject to direct oversight ^[7]. Most consumer assistants now ship exactly that capability, and a team that adds retrieval so answers stay current is, on this reading, building the thing the Commission has decided to supervise directly.

Scale is the second gate, and it sits closer than it looks. ChatGPT search reported 159.1 million average monthly recipients in the EU, against 364 million for Google Search and 119 million for Bing ^[6]. That is about 44 percent of Google's reported figure and roughly 1.3 times Bing's ^[17][18]. All three numbers are reported by the companies themselves for DSA purposes ^[6], so the trigger for designation runs through a disclosure the provider controls.

The margins on either side of the threshold are thin. Roblox reported 46.6 million, 1.6 million above the 45 million line ^[8][3], which is 3.6 percent of headroom ^[19], while Reddit's 57.2 million sits 27 percent above it ^[20]. Designation also moves in the other direction (the Commission withdrew Stripchat's very large platform designation in May 2025) ^[12], and Henna Virkkunen said the Commission "will not hesitate to designate any platform that meets the threshold for enhanced supervision" ^[13].

Only three companies carry European user counts anywhere near that threshold today, but the clock is what makes this operationally real. Providers get four months from notification to assess risks tied to their service and algorithmic systems and to introduce measures reducing them, covering illegal content, harm to minors, electoral processes, public security, mental and physical health, and fundamental rights ^[4][5]. Evidence of that kind is assembled over product cycles, so four months buys process rather than findings.

The dates in the record deserve to be held loosely. The Commission puts the deadline in January 2027 ^[4], which working back from a four-month clock implies notification around September 2026 ^[16], while the designation itself is dated Aug. 31 with no year stated in the account we have ^[1]. What matters operationally is that notification, not designation day, starts the count ^[4].

It remains unclear from the enforcement record what adequate mitigation looks like for a generative interface. The largest penalty so far, 120 million euros against X in December 2025, concerned transparency violations involving the paid blue checkmark and the advertising repository ^[10], which are disclosure obligations with fairly legible tests. Whether a model's answers satisfy the risk duties is a judgment the Commission has not published against, and the exposure runs to 6 percent of global annual turnover ^[9]. Oversight is shared, with Ireland's Coimisiún na Meán paired to ChatGPT and Reddit and the Dutch Authority for Consumers and Markets to Roblox, while direct responsibility for the additional obligations stays with the Commission ^[11].

That unsettled standard lands on a provider listed as OpenAI Ireland Ltd ^[14]. According to the source account, OpenAI confirmed a confidential draft S-1 filed with US regulators on June 8 and its March funding round valued the company at $852 billion, with no listing date confirmed ^[15]. The first systemic-risk assessment filed for a generative interface becomes the reference other teams will work from, and the January deadline now sits on a company that just confirmed that S-1 and that valuation, with no listing date on the calendar yet.