The Answer as a Risk – What Brussels’ New AI Oversight Really Regulates

by Michael Hollister
Exclusive published at GlobalBridge on September 29, 2026

5.055 words * 27 minutes readingtime

For years, the dispute over the digital public sphere revolved around two operations: deleting a post and sorting a list of search results. Anyone following the debate over the Digital Services Act saw regulators instructing platforms to remove illegal content and make their recommendation systems auditable. On August 31, 2026, the European Commission applied this logic to a system that performs neither operation – because it does something fundamentally different. It writes the answer itself.

On that day, the Commission designated ChatGPT as a Very Large Online Search Engine, alongside Reddit and Roblox, which were designated Very Large Online Platforms. For the first time, a standalone AI service has entered the strictest tier of European platform oversight. The trigger is simply scale: OpenAI reported 159.1 million average monthly users in the EU – more than three times the statutory threshold of 45 million, roughly 10 percent of the Union’s population. Reddit reported 57.2 million and Roblox 46.6 million. The ChatGPT figure is the real news: A service that effectively did not exist in this form three years ago now reaches more Europeans than most established platforms.

The move appears technical, but it represents a shift in category. Until now, the DSA supervised channels: spaces in which people distribute other people’s content and machines that rank existing pages. A generative system fits neatly into neither category. It does not merely distribute; it creates. And this shift – from supervising distribution to supervising generation – is the real subject of this article.

The Question Beneath the Headline

The headline “EU Regulates ChatGPT” misses the decisive point. The story becomes interesting one level deeper. The DSA was written for services that distribute information. What happens when its instruments encounter a system that first produces information in dialogue with the user – and who then decides which generated answer constitutes a “systemic risk”?

This article strictly separates two things that tend to blur together amid the excitement. One is capability: What levers does the designation create, and where do they apply? The other is intent: what those levers will be used for. Capability can be inferred from the legal texts and enforcement to date – it is a finding. Intent is an open question that no serious observer can resolve for the months ahead. Anyone who conflates the two produces either reassurance or alarm. Neither helps the reader. The analysis that follows maintains this distinction: It describes what the instrument can do, identifies who holds it, and leaves the assessment to the reader. An instrument of this reach deserves a cold description, neither a comforting nor an indignant one.

What Was Decided on August 31 – and What Was Not

First, the mechanics. The Commission did not classify ChatGPT as a search engine because it is a chatbot, but because the service can retrieve information from the open web. This second function – web search – brings it within the DSA definition of an online search engine. The Commission describes it as a hybrid service. Unlike a conventional search engine, however, ChatGPT does not merely retrieve and rank pages; it summarizes information, formulates original answers, and blends retrieved material with model-generated content. OpenAI did not oppose the classification and confirmed that the search function qualifies as a search service under the DSA; the company is preparing for the additional requirements. The designation thus follows the service’s function, not the “chatbot” label, as the Commission’s full press release explains.

ChatGPT thereby joins a group that has existed since 2023. When the Commission named the first very large services, the list contained the familiar names of the platform economy – Facebook, Instagram, TikTok, YouTube, what was then Twitter, as well as the Bing and Google search engines. The threshold has always been the same: 45 million monthly users. The tier is not new; its new occupant is. For the first time, it includes a system whose core function is not relaying content created by others, but formulating its own.

A deadline now begins to run. Under Article 33 of the regulation, the enhanced obligations apply four months after the provider is notified – not automatically four months after the public announcement. The Commission’s English-language pages give January 2027 as the deadline; a representation page refers to the end of December 2026. The Commission has not yet published the decision itself or the exact notification date; its register still lists the ChatGPT decision as unavailable. This is not a minor detail, but the first indication of a pattern running through the entire process: The supervision exists, while the verifiable basis for it does not yet exist everywhere. Specialist reporting has likewise noted the new compliance deadline and the unresolved timing.

Equally important is what the designation is not. It is a legal classification and the trigger for new obligations – not a finding that ChatGPT has broken the law or caused harm. The three services entered the stricter category because of their size, not because of a proven violation. A sanction requires a separate proceeding, including preliminary findings and an opportunity to respond; a fine requires intentional or negligent noncompliance. Only then can the Commission impose a penalty of up to 6 percent of the provider’s worldwide annual turnover in the preceding financial year. Anyone who reads the designation as a judgment skips precisely the stages at which the instrument’s eventual use will be determined.

Jurisdiction is also settled, and it is noteworthy. The Commission itself has exclusive supervisory authority over the enhanced obligations of very large services. Coimisiún na Meán, Ireland’s Digital Services Coordinator, remains the national point of contact and performs functions such as reviewing researcher access. The Union’s political executive therefore supervises directly – a point to which this article will return.

Two Regulatory Regimes Governing One Service

ChatGPT has an additional feature that Reddit and Roblox do not share: The service is now subject to two regulatory regimes at once. OpenAI is already covered by the European AI Act, which addresses general-purpose models and AI-generated content – in other words, model development, risk management for general-purpose AI, and transparency obligations for machine-generated output. The DSA applies at a different point. It regulates not how a model is built, but how a service disseminates information at scale and affects users and society. The resulting dual regulatory structure is one of the designation’s central consequences.

The distinction sounds academic, but it has practical consequences. A single ChatGPT answer on a political topic may implicate the AI Act’s transparency rules while simultaneously raising DSA questions about disinformation, electoral processes, or fundamental rights. OpenAI must coordinate model testing, product design, content safeguards, and compliance documentation across both regimes. The Commission is thereby demonstrating something fundamental: It can apply its platform law to new AI services without waiting for a separate statute governing conversational interfaces. Anyone operating a large chatbot does not automatically inherit VLOSE status merely by using ChatGPT or its interface; yet the consequences reach further – through altered contractual terms, additional logging, stricter safeguards, and restrictions on particular use cases. For companies offering their own chatbots, the question therefore shifts: Not only the model, but also the service as a platform becomes an object of oversight.

This overlap is more than an administrative issue. The AI Act and the DSA intervene at different points in the same process, and no clean line separates them. The constraints placed on a model during development help determine which answer ultimately appears; what the service must answer for in that output feeds back into model design. OpenAI thus faces the task of assessing the same output against two regulatory frameworks at once – and the question of which takes precedence in cases of conflict has not yet been spelled out.

What “Risk Mitigation” Means for an Answer System

At the heart of the DSA’s highest tier lies a chain: A service must assess the systemic risks stemming from it, mitigate them, submit to audits, and report on them. Risk assessments are required at least annually and before any change that could materially alter those risks. The categories specified by the law are: dissemination of illegal content; adverse effects on fundamental rights such as privacy and freedom of expression; effects on civic discourse and electoral processes; public security; and harms involving minors, physical and mental well-being, and gender-based violence. These obligations are set out in Articles 34 and 35 of the Digital Services Act.

For a conventional service, these categories have tangible points of application. On a platform, mitigation concerns moderation and recommendation; on a search engine, ranking. With a generative service, the point of intervention shifts. If the generated answer is the product, then the answer is also where mitigation applies. The law does not require the elimination of every conceivable risk, but a proportionate and effective response – and under the regulation, that can extend to changes in service design, internal systems, algorithmic functions, enforcement of terms and conditions, and moderation. The distance between “adjusting a recommender system” and “adjusting answer behavior” is smaller than the technical language suggests.

The risks become concrete when applied to an answer system. Specialist observers and German international reporting identify hallucinations, fabricated citations, election disinformation, harmful advice, interactions involving mental health, and risks to minors as possible subjects of scrutiny. These are not invented horror stories – a system that freely fabricates sources or responds incorrectly to someone in a psychological crisis raises real questions. At the same time, the list reveals the breadth of the discretion involved: The boundary between a “fabricated footnote” and an “undesirable political statement” is not technical, but evaluative. Reporting on the new classification has accordingly emphasized both the safety concerns and the reach of the Commission’s discretion.

Everything hinges on the term “systemic risk” – and it was not designed for generated language. It was developed for networks in which the aggregate of many contributions produces a societal effect that no individual contribution would have created. Applied to an answer system, it requires a translation that no one has yet provided: When does an incorrect answer become a systemic risk, and when does it remain an isolated error? Whoever defines that threshold also defines how deeply oversight reaches into the design of answers. This is not pedantry, but the point at which an abstract category becomes a concrete depth of intervention.

This is precisely where the defending voices begin, and they belong in this article. On the Commission’s reading, and that of observers sympathetic to it, the DSA instructs no one to remove lawful criticism, political disagreement, or controversial views merely because someone considers them harmful. Proportionality is central; oversight asks whether a provider has credible systems to understand large-scale risks, respond appropriately, and explain its decisions. A service could alter recommendation settings, improve reporting channels, redesign interfaces, or strengthen protections for minors – the appropriate response depends on the service and the identified risk. Anyone who reads the DSA simply as a deletion order therefore reduces it – so far, one side’s argument.

The opposing position reduces nothing; it asks the next question. A 2026 academic analysis argues that ChatGPT is a hybrid of a search engine and a platform and displays, across all four central DSA risk areas – illegal content, fundamental rights, democratic integrity, and public health – a risk profile comparable to that of established very large services. That supports the legal case for designation. But it simultaneously sharpens the underlying question: If “threats to democratic processes” or “election disinformation” are the categories to which mitigation applies, then someone must define what counts as disinformation – and some institution must make that decision. There is also a simple fact noted even by sober specialist observers: No sentence of the DSA was written for chatbots. Both sides are only now working out how an answer system can document its risk profile at all. The academic case for treating ChatGPT as a hybrid service is developed in Between Search and Platform: ChatGPT Under the DSA.

Surrounding this chain is the apparatus that makes it auditable: an annual independent audit, paid for by the provider, whose recommendations it must implement or reject with reasons; an independent compliance function with sufficient authority; conditional data access through which the Commission and – after review by the Irish coordinator – approved researchers can request insight into algorithmic design, logic, operation, and testing; and transparency reports, the first within two months after the new obligations take effect and at least every six months thereafter. Internal self-reporting by a company thus becomes documentation available to defined external actors. That is the practical difference between a voluntary safety program and the DSA’s highest tier – and also the reason the access reaches so far. Technical coverage of the designation has highlighted this audit, data-access, and reporting apparatus.

The Precedent: X, Grok, and the First Penalty

How this instrument operates in practice cannot yet be inferred from ChatGPT, whose deadline is still running, but it can be seen in the most recent enforcement action. On December 05, 2025, the Commission issued the first noncompliance decision under the DSA: a €120 million penalty against Elon Musk’s platform X, around $140 million. The decision followed an investigation opened two years earlier. The penalty was based on three violations of transparency obligations – concerning the blue verification checks deemed misleading, the advertising repository, and data access for researchers. X was given 60 and 90 days to remedy the deficiencies; failure to comply could trigger additional periodic penalty payments. This was the first real test of a regulatory framework that had long existed primarily as a threat.

The penalty remained below what the framework would have allowed – up to 6 percent of worldwide turnover – but its symbolic effect was substantial. It demonstrated that the Commission was prepared to use the instrument and provided a template for every subsequent proceeding: transparency obligations first, because they are the easiest to prove, followed by a staged procedure with deadlines before periodic penalties take effect. Contemporary reporting converted the penalty to approximately $140 million. One detail of the decision forms a bridge to the AI question. One of the three allegations concerned researcher access to data. Oversight now gains precisely this lever – the obligation to give vetted researchers insight into internal processes – in relation to ChatGPT as well. What concerns the visibility of advertising and moderation on a platform concerns the logic by which answers are generated in an answer system.

A second proceeding is closer to the AI question. The Commission is investigating the integration of Grok, X’s AI chatbot, after the system generated nonconsensual sexualized images in response to user requests, some of which appear to depict abuse. Musk dismissed the uproar as a pretext for censorship; responsible Commissioner Henna Virkkunen described the purpose of the investigation as determining whether X had fulfilled its DSA obligations. The question of how the DSA can be applied to a generative system is therefore no longer hypothetical – it is already being worked out in a specific case, in parallel with the ChatGPT designation. The broader confrontation between Musk, the Trump administration, and the EU is documented in reporting on the political escalation surrounding the X case.

Enforcement reaches further. TikTok faces proceedings over inadequate advertising transparency; in Italy, an AI chatbot service was fined. The supervisory architecture has been developing for around two years, case by case. The Commission is demonstrating that it can apply its platform law to new AI services without waiting for a separate statute governing conversational interfaces. That is the designation’s real message: not an isolated act against one product, but a template. Specialist services explicitly describe it as a capability-based model that can be extended to the next major systems – Gemini, Claude, and Perplexity – once they cross the threshold. One detail that is easily overlooked is that advertising is also subject to scrutiny. OpenAI has built an advertising business for ChatGPT that, according to the company, has reached an annualized revenue rate of around $1 billion – and this advertising system, too, must now be assessed for systemic risks. Industry reporting has described the designation as a precedent for other large generative systems.

For OpenAI, almost all of this is new. Reddit understands the mechanics of moderating content at scale, and Roblox understands child protection; an answer system, by contrast, must first invent a way to describe its risk profile at all. It is precisely this novelty that makes the case a test – not only for one company, but for the question of whether law designed for platforms can be applied seamlessly to generated language.

The Transatlantic Fault Line

At this point, the issue leaves the field of regulatory technique and enters geopolitics. What Brussels understands as oversight of globally used information systems, Washington reads as an encroachment on American companies and American speech. The reaction to the X penalty exposed the fault line. U.S. Secretary of State Marco Rubio called the decision an attack on American technology platforms and on the American people. Musk himself called for the EU to be abolished, a demand widely reported after the fine, including by CNBC. The U.S. House Judiciary Committee went further: Under Chairman Jim Jordan, it obtained the 183-page decision by subpoena and published it before the EU did, under the banner of defending American innovation and American speech against “foreign censors.” The same lawmakers subsequently targeted the Grok investigation and portrayed it as further evidence of a transatlantic threat to American innovation. The circumstances surrounding the congressional release are detailed by Tech Policy Press.

This framing is part of the finding, not its resolution. Anyone who adopts it makes one side’s interests their own. The counterframing is equally shaped by interests and can equally be identified. For the Commission, the DSA is not an instrument of censorship but a means of protecting fundamental rights and enforcing European rules on European soil. The title of the responsible commissioner – Executive Vice-President for Tech Sovereignty, Security and Democracy – carries the program in its name. From this perspective, the issue is not opinion but accountability: Anyone reaching 159 million people in Europe should be subject to European standards of scrutiny. In precisely this sense, Virkkunen said of the designation that the three services would now face stronger scrutiny and accountability, reflecting their impact on citizens and society.

Neither framing can be refuted by repeating the other more loudly. They mark a conflict of jurisdiction older than ChatGPT. For years, the EU relied on the sheer size of its single market to shape global standards – companies build compliance for the European market and subsequently roll it out worldwide. This “Brussels effect” worked as long as regulation was treated as a technical market question. It reaches its limits once the other side treats it as a question of power. The Trump administration has repeatedly announced action against European digital rules, complained of targeted discrimination against American corporations, and treated proceedings against U.S. companies as attacks that might provoke retaliation. A quiet mechanism for setting standards has become an open geopolitical dispute. Analyses of the X penalty have likewise emphasized the politics surrounding European DSA enforcement.

Brussels is well aware of this shift. Where it once trusted the market to export European rules by itself, there is a growing recognition that standard-setting can no longer be enforced solely through the attraction of the single market. On the American side, the conflict is embedded in a larger strategy: The administration has identified European digital oversight as a strategic problem and treats it not as consumer protection but as a question of power over key industries. Two enforcement logics confront each other. Europe’s operates through market access: Anyone wishing to reach the Union’s 450 million consumers submits to its rules. America’s operates through threat and retaliation: trade instruments, diplomatic pressure, and the prospect of countermeasures. The ChatGPT designation therefore lands on ground that was already heavily mined.

For a generative service, this conflict intensifies because the dispute no longer concerns only which posts are permissible, but which answers a system may provide. A European user could ultimately receive different results on politically sensitive questions than a user outside the Union – not through an explicit order, but as a side effect of compliance. This is the geopolitical core of the issue: The conflict over jurisdiction reaches the level at which information is created – and neither side can decide it alone without the other asserting its own control over the same systems.

The New Control Surface

Once both outrage and reassurance are removed, what remains is a sober structural finding. The designation creates an instrument capable of requiring a provider to change something about a generatively produced answer – through the chain of risk assessment, proportionate mitigation, and audit. This instrument is not mechanical, but discretionary: The law requires a reasoned connection between the identified risk and the chosen response, not every possible measure in every case. But discretion requires someone to exercise it.

The regulation identifies that actor clearly: For the highest tier, the Commission supervises directly. It is therefore not only the rule-maker, but also the supervisor of an instrument whose categories – “election disinformation,” “threats to civic discourse” – it interprets itself. In many of the conflicts whose “risks” are being managed here, the Union is also a party. This is not an allegation of intent, but a description of the constellation: Whoever defines a category and simultaneously oversees compliance sits at a control surface whose reach depends on interpretation. And unlike the removal of an individual post, which remains visible, an answer formulated differently as a precaution disappears without a trace – it looks like any other answer.

This invisibility cuts both ways. It makes it difficult for critics to prove that anything was changed at all – and it makes it difficult for regulators to prove that nothing impermissible occurred. The DSA attempts to close this gap through audits and data access. Whether audits and researcher access will be sufficient to make shifts in answer behavior visible will become clear only when the first reports are available. Until then, the control surface remains a capability whose use no outsider can reliably measure.

The open question is therefore not whether Brussels is “programming the truth” – that would be an allegation of intent unsupported by evidence. The question is this: When a generated answer becomes the object of a risk category, who draws the line between undesirable information and legitimate dissent, and according to what standard? The same template that now applies to ChatGPT is ready for every major generative system. The answer will not emerge in press releases, but in enforcement – one audit report at a time.

It also fits into a larger picture. Anyone tracing the architecture of European oversight in recent years – from platform regulation and debates over the scanning of private communications to the promotion of the “right” information ecosystem – can see a movement in which ever more interfaces between citizens and information are placed under institutional observation. AI oversight is the latest component, but not the last. Whether the whole should be understood as protection or restriction is determined not by the intentions of its architects, but by the sum of what ultimately becomes possible.

Three Scenarios

Three developments can be imagined from the present situation, without any of them being predetermined.

In the first scenario, the process remains procedural. The designation amounts to documentation, audits, and semiannual reports; system behavior changes little because mitigation obligations focus on procedures and evidence rather than content. This is the defenders’ reading: greater accountability, no interference with legitimate speech. It is supported by the DSA’s proportionality requirement and by the fact that lawful opinion is expressly not an object of removal. In this world, the designation is primarily an additional bureaucratic burden that a corporation of OpenAI’s size absorbs just as other major services did before it. Precedent would also support this interpretation: Established platforms have complied with their DSA obligations without their core businesses disappearing.

In the second scenario, the rule matters less than the shadow it casts. Under pressure from mitigation obligations, annual audits, and the prospect of fines of up to 6 percent of worldwide turnover, providers formulate politically sensitive answers more cautiously in advance – not because an authority orders them to, but because avoiding risk is cheaper than litigating over it. In the end, a user in the EU would systematically receive different answers on sensitive questions than a user elsewhere. This is the critics’ concern, and it rests on an observable pattern: Companies build compliance for Europe and then distribute it – or its narrower version – more broadly. The boundary between the first and second scenarios is fluid, and no one will ever be able to date the transition because it takes place in the texture of the answers themselves. There would be no order to challenge in court and no document proving the change – only the gradual standardization of what a system still says about sensitive issues.

In the third scenario, the jurisdictional conflict produces fragmentation. If Washington escalates its resistance and Brussels stays the course, providers could separate their behavior by legal jurisdiction or withdraw from individual markets. The fracture that has already divided the platform world into national zones would then reach the generative layer – with the result that the answer to the same question would depend on the jurisdiction in which it was asked. For European users, this would be the most paradoxical outcome: Oversight created in the name of their rights would end by restricting their access to systems that remain openly available elsewhere. It is also the scenario in which the economic leverage would become clearest – a market of 450 million people is not incidental to any provider, and no government willingly loses the tools used on its territory. Which scenario prevails will depend less on the text of the law than on the decisions taken between notification and the deadline at the beginning of 2027.

Findings

August 31, 2026, did not condemn a service or prohibit an answer. It did something more fundamental: An oversight instrument designed for the distribution of content now extends to its generation. The capability to require a provider to alter a generatively produced answer exists – discretionary, supervised by a political executive that is itself a party to many of the conflicts concerned. Whether and how this capability will be used is therefore not answered, but posed.

This is not a minor shift. Anyone who determines which posts circulate in a network intervenes in a marketplace. Anyone who influences how a system answers the questions of 159 million people intervenes closer to the formation of judgment – at the point where information becomes opinion. This remains true regardless of whether that power is ever exercised; its existence alone changes the structural balance. Naming that structure without declaring it an intention is the purpose of this analysis.

For the reader, the result is neither reassurance nor alarm, but a direction in which to look. Headlines about protecting fundamental rights or about censorship will not show what becomes of this control surface. Enforcement will: the first risk assessments, the first audit reports, the first dispute over a specific answer. Don’t listen to what they say – watch what they do. The coming months will provide the evidence.

Exclusive published at GlobalBridge on September 29, 2026

This publication answers to its readers – and no one else. Become a member for $5 or a patron for $15 per month, support genuinely independent journalism, and receive full access to all published analyses.

You are also welcome to support my work with a one-time donation.

About the Author

Michael Hollister
is a geopolitical analyst and investigative journalist. He served six years in the German military, including peacekeeping deployments in the Balkans (SFOR, KFOR), followed by 14 years in IT security management. His analysis draws on primary sources to examine European militarization, Western intervention policy, and shifting power dynamics across Asia. A particular focus of his work lies in Southeast Asia, where he investigates strategic dependencies, spheres of influence, and security architectures. Hollister combines operational insider perspective with uncompromising systemic critique – beyond opinion journalism. His work appears on his bilingual website (German/English) www.michael-hollister.com and in investigative outlets across the German-speaking world and the Anglosphere.

Stay informed without having to work through the daily flood of news – the most important developments and connections summarized for you.

Sources

Primary Sources and Legal Basis

1. European Commission, “Commission Designates ChatGPT, Reddit, Roblox Under Digital Services Act” (press release, August 31, 2026): Commission Announcement.
2. European Commission, Press Corner, full release IP/26/1772: Full Press Release.
3. EUR-Lex, Regulation (EU) 2022/2065 (Digital Services Act), full text including Article 33 (designation and deadline), Articles 34–35 (risk assessment and mitigation), Article 37 (audit), Article 40 (data access), Article 42 (transparency reports), and Article 74 (fines): Full Text.

Academic Analysis

4. Toni Lorente and Kathrin Gardhouse, “Between Search and Platform: ChatGPT Under the DSA” (arXiv, 2026): Paper.

Context and Specialist Reporting

5. PYMNTS, “ChatGPT Facing Dual Regulatory Regimes Under New EU Designation” (September 01, 2026): Article.
6. WinBuzzer, “EU Now Regulates ChatGPT as a Very Large Online Search Engine” (September 01, 2026): Article.
7. The European Times, “EU Puts ChatGPT, Reddit and Roblox Under Stricter Rules” (September 2026): Article.
8. Technology.org, “EU Puts ChatGPT, Reddit, Roblox Under DSA” (September 01, 2026): Article.
9. Business Standard, “EU Classifies ChatGPT as ‘Very Large Online Search Engine’ Under DSA” (September 01, 2026): Article.
10. Windows Report, “ChatGPT, Reddit, and Roblox Now Face a Major New EU Compliance Deadline”: Article.
11. AI Weekly, “EU Designates ChatGPT a Very Large Search Engine Under DSA”: Article.

Transatlantic Dimension and Precedent – X and Grok

12. PBS NewsHour / AP, “EU Fines Elon Musk’s X 120 Million Euros for Breaching Bloc’s Social Media Law” (December 05, 2025): Article.
13. Fortune / AP, “Elon Musk’s X Fined 140 Million Dollars by EU for Breaching Digital Regulations” (December 06, 2025): Article.
14. CNBC, “Elon Musk: EU Should Be Abolished After X Fined 140 Million Dollars” (December 08, 2025): Article.
15. Time, “Elon Musk and Trump Officials Go to War With the E.U. Over Fine” (April 2026): Article.
16. Tech Policy Press, “Unpacking the Politics of the EU’s €120 Million Fine of Musk’s X” (December 2025): Article.
17. Tech Policy Press, “EU Decision Behind €120 Million Fine on Musk’s X Released by US Lawmakers” (January 2026): Article.

© Michael Hollister – All rights reserved. Redistribution, publication or reuse of this text requires express written permission from the author. For licensing inquiries, please contact the author via www.michael-hollister.com.