The European Union Enforces Stricter Rules on ChatGPT

The European Union subjects ChatGPT to the regime of the most powerful services under the DSA. OpenAI's chatbot joins Reddit and Roblox under enhanced obligations, including extensive audits, transparency requirements, and increased data access for research, while the exact scope of this access remains under discussion.

Extended Obligations Until December 2026 and More Audits

ChatGPT, Reddit, and Roblox must meet additional obligations by the end of December 2026. The European Commission plans to exercise increased audit powers in coordination with the authorities in Ireland and the Netherlands. In total, 28 platforms and search engines are now subject to this enhanced DSA regime. The current classification does not explicitly allow the Commission to directly test the models. The scope of data access is debated among legal experts, who discuss potential access to training data and model weights to analyze systemic risks. Natali Helberger, a law professor at the University of Amsterdam, refers to Article 40 and believes that this access could extend to these elements if deemed necessary to identify risks or evaluate mitigation measures.

What Services Must Implement and By When

Operational requirements include a searchable advertising archive, semi-annual transparency reports, and a crisis response mechanism. Platforms must also provide tools for reporting illegal content, accompanied by a complaint process. Data access for research is planned, with a provision for approved researchers. An initial compliance deadline is set for four months, with risk assessments focusing on illegal content, dangers to minors, and electoral interference.

Why ChatGPT, Reddit, and Roblox Fall Within the Scope

Reddit and Roblox are considered platforms because their users share content from other users, placing them in the category of very large online platforms. ChatGPT, which can query the web and respond to requests, is treated as a search engine under the DSA. It reaches at least 45 million monthly users in the EU, the threshold required for this status. The Commission officially confirmed this classification in Brussels on Monday. Henna Virkkunen indicated that the affected services should accept stricter oversight.