Ask ChatGPT which candidates are standing in your local election and, on the Commission's reading, you are querying a search engine that owes the EU transparency and risk-mitigation work [1][3]. Then ask the obvious follow-up about who deserves your vote, and according to Politico's Eliza Gkritsi and Pieter Haeck you have crossed into the part of the product the designation largely does not reach [2][3]. The seam runs through the middle of a single text box, in a place no product team would ever draw a boundary.
The seam is there for a reason, and thenextweb.com sets it out plainly: the other available category, Very Large Online Platform, would have brought content moderation duties and, with them, safe harbour, the rule that a company is not liable for material because someone else uploaded it [4][5]. Apply that frame to a two-way exchange with a machine and you have to decide whether the machine's half counts as user-generated content [5]. Answer yes, and a model's sentences start to look like third-party material its maker merely hosts [5].
The classification took the Commission just under a year [11]. That is roughly what you would expect, given that the DSA was finalised in 2022 and never contemplated this [9]. João Pedro Quintais of the University of Amsterdam describes ChatGPT as a hybrid that behaves like a search engine and a platform, but also publishes its own content, and it is that third function no existing category handles [10]. Experts told Politico that until the full designation text is published, what OpenAI actually has to do is hard to pin down [12].
The gap has a cost, and it falls on users, not on the design choice that created it. AXA's 2026 mind health report puts the share of adults globally using chatbots for therapy at as much as 60% [7], which means the single largest reported use sits in the layer the designation was written not to touch [17]. The companionship case is already in court, including the suit brought by the parents of 16-year-old Adam Raine in California [8]. Christel Schaldemose, the Danish socialist MEP who helped negotiate the DSA, said ChatGPT is "much more than a search engine", named emotional dependency and manipulative or addictive design, and asked the Commission to clarify how existing rules cover them [6]. Those are design questions about the conversational layer.
The AI Act was meant to be the other half of the answer. Builders of general-purpose models have owed systemic-risk assessment and mitigation since last August, with enforcement opening at the end of August as the Commission questioned AI companies about security procedures [13]. The risks the expert group singled out are nuclear and biological weapons, loss of control, models hacking autonomously, and large-scale manipulation [14]. Daniel Leufer of AccessNow told Politico the guidance is "more focused on so-called existential risks than risks to fundamental rights" [15]. A teenager forming a dependency falls into neither category: not the systemic-risk list that drives AI Act enforcement, nor the search-engine duties behind this designation [16].
For anyone shipping an assistant into Europe, the usable sort is by who wrote the words. One column is retrieval: results you fetched, ranked, and cited, which is where the auditable duties now live [1][2]. The other is generation: sentences your model composed, which carry named obligations only if you are the model builder, and then only against the systemic-risk list [13][14]. Whatever harm a support queue is actually logging falls into one of those columns, or into neither. Where the two line up, you have a regulator and therefore a budget line. Where the support queue has entries and the regulatory column is blank, you are funding safety work nobody will ever ask you to evidence, and that is the work that goes in the first flat quarter.
