BRUSSELS — The European Union will take at least another year to figure out how to wield its powerful digital law to rein in the risks of ChatGPT.
Use of the artificial intelligence chatbot has taken off in Europe, and OpenAI this month declared it has crossed an important threshold for regulatory scrutiny. The news that more than 120 million people use ChatGPT’s search function each month came as no surprise to the European Commission, two officials told POLITICO.
Yet regulators have not yet figured out how to handle ChatGPT under the EU’s powerful Digital Services Act, in force since early 2024, to make sure platforms minimize their risks. A decision is only expected in mid-2026, according to a senior Commission official.
It’s a test case of the EU’s ability to handle the risks posed by large language models, which are fast becoming as ubiquitous in people’s lives as traditional search engines.
The sluggishness reflects the fact that the flagship digital law was designed before ChatGPT hit the mainstream, and its definitions don’t cleanly cover AI chatbots — leaving Brussels at risk of falling behind the curve in tackling these risks, even as they come into sharper focus.
OpenAI recently acknowledged that 1.2 million people each week have conversations with ChatGPT that suggest they are planning to take their own lives, and that “in some rare cases, the model may not behave as intended in these sensitive situations.”
“For an industry used to voluntary AI-safety frameworks and self-defined benchmarks, the DSA’s legally binding due diligence regime might be a tough reality check,” said Mathias Vermeulen, director at Brussels law firm and consultancy AWO Agency.
“OpenAI will have to step up its game significantly and won’t be able to get away with a simple copy/paste job of what it is currently doing,” he said.
The company didn’t respond to the criticism, instead pointing to its online help pages for information on how the company is complying with the DSA. It also noted the 120 million figure refers to people using ChatGPT’s search capabilities and not to the whole service.
How wide to go
ChatGPT is already regulated under the EU’s AI Act. As of August, it must assess risks and mitigate them, risking fines up to €15 million if it doesn’t comply.
But user figures now put the chatbot into the big league, shooting way above the 45-million-monthly-user threshold for large platforms and search engines under the DSA.
Once it falls under the DSA, it risks fines up to 6 percent of its annual global turnover.
ChatGPT was not “foreseen” by the DSA, but it “fits the language of the statute,” said Martin Husovec, a law professor at the London School of Economics.
Under the law’s structure, the EU designates sites as either very large online platforms and search engines — so-called VLOPs or VLOSEs — that must comply with the most stringent rules.
“A core question” is the scope of the designation for ChatGPT, said Joris Van Hoboken, a law professor focused on AI governance at the Vrije Universiteit Brussels.
The Commission could narrow it to ChatGPT’s search functionalities, to classify it as a search engine, or open the aperture to the entire offering — either as a platform or service.
What requirements are placed on OpenAI and how it can fulfill them largely depend on what the Commission decides.
OpenAI will have to figure out how serious the risks posed by its chatbot — including to elections and public health — are. It will have to mitigate them and inform the Commission in a long compliance report. The wider the designation, the wider that report has to be.
These risk assessments include “the design of their recommender systems and any other relevant algorithmic system,” according to the DSA law. That may prove difficult if the Commission targets the entire large language model underlying ChatGPT and its responses, as opposed to a narrower focus on search content served to users.
A narrow definition could also save OpenAI from one commitment: As a search engine, it wouldn’t have to provide a notice-and-action mechanism that allows users to flag content for takedown.
If a designation is made in mid-2026, that means DSA requirements would hit OpenAI in the final quarter of next year.
OpenAI may also contest the designation, as other platforms have unsuccessfully done in the past, said João Pedro Quintais, associate professor of information law at the University of Amsterdam. Any disagreement would further lengthen the process.
Too many laws?
Key questions remain about how the two major laws tackling AI and platforms overlap.
The AI Act and the DSA were designed to coexist in cases where AI is integrated into digital services, such as Google’s AI Overviews, said Quintais. They weren’t designed with so-called vertically integrated AI providers like OpenAI in mind.
The two laws are based on two different risk frameworks. Platforms have to assess which risk categories they fall under and adjust their services appropriately.
These risk frameworks are not perfectly aligned; the AI Act says models need to be classified as unacceptable, high, limited, or minimal or no risk. Platforms and search engines need to determine and mitigate four types of “systemic risks,” such as civic integrity, elections, public health and fundamental rights.
But under the AI Act, features integrated into VLOPSEs, such as Google’s AI Overviews, are assumed to be compliant with the AI rules if they file DSA assessments.
That means that some aspects of regulation — for example, disinformation and deepfakes — are “taken over by the DSA,” said Quintais, while other risks, for example, the use of ChatGPT in hiring processes, stay within the AI Act.
There could be gaps in how the company assesses the risk of its services because the two frameworks do not perfectly align, said Quintais.
The company may also benefit from what is known as safe harbor laws, under which platforms and search engines are not liable for content posted on them, he added.
The post The EU can’t figure out what to do about ChatGPT appeared first on Politico.
