ChatGPT search engine regulation: the EU designates the service, Ofcom lists the search function
In short: ChatGPT search engine duties differ between the EU and the UK. The European Commission designated ChatGPT, as a hybrid service, a very large online search engine under the Digital Services Act on 31 August 2026, with additional duties applying from four months after notification: January 2027. Ofcom lists ChatGPT Search, the search function within ChatGPT, in Category 2A under the Online Safety Act 2023 and makes no finding on the rest of the chatbot.
A provider of an AI assistant that can search the web must work out which parts of its product count as a search engine, and the European Commission and Ofcom have given different answers. The Commission has designated ChatGPT, which it describes as a hybrid service, as a very large online search engine. Ofcom has listed the search function, ChatGPT Search, in Category 2A, the category for the largest search services, and has said expressly that the entry is not a finding that the extra Category 2A duties apply to chatbot output that is not search content.
The EU designation of ChatGPT under the Digital Services Act
The European Commission designated ChatGPT as a very large online search engine (VLOSE) on 31 August 2026, under Article 33(4) of the Digital Services Act (Regulation (EU) 2022/2065, the DSA), and designated Reddit and Roblox as very large online platforms on the same day. A service qualifies where it has at least 45 million average monthly active recipients in the EU (Article 33(1)). The Commission reports 159.1 million for ChatGPT on its supervision page. On 6 October 2026 the Commission published the updated list of 28 designated services in the Official Journal (OJ C/2026/5181), as Article 33(6) requires. Three of the 28 are search engines: Bing, ChatGPT and Google Search.
In its press release, the Commission described ChatGPT as an AI system that responds to prompts and queries “including by searching the web”, and concluded that it is “a hybrid service that qualifies as an online search engine”. Under Article 3(j) DSA, an online search engine is an intermediary service that allows users to search, in principle, all websites. As at 7 October 2026 the Commission had not published the designation decision, and it names the designated service as ChatGPT, without qualification, in both the press release and the Official Journal list.
The additional obligations for very large services apply to OpenAI Ireland Limited from four months after the Commission notified the decision (Article 33(6)), which the Commission puts at January 2027; the exact date depends on the notification date, which the Commission has not published. OpenAI Ireland Limited must assess the systemic risks arising from the design or functioning of the service and its related systems, including algorithmic systems, by the date on which those obligations apply and at least once a year after that (Article 34(1)), and put mitigation measures in place (Article 35). It must give the regulators access to data, and vetted researchers access to data for research on systemic risks (Article 40). The Commission has exclusive powers to supervise and enforce those obligations (Article 56(2)), although Coimisiún na Meán, the Irish Digital Services Coordinator, issues the requests for researcher access under Article 40(4).
Ofcom’s Category 2A entry for ChatGPT Search
Ofcom has entered “ChatGPT (ChatGPT Search)” in Category 2A, the category for the largest search services, in its register of categorised services, which it keeps under section 95 of the Online Safety Act 2023 (the OSA) and last updated on 28 September 2026. Ofcom names OpenAI OpCo, LLC as provider. A search engine meets the Category 2A conditions if it has more than 7 million average monthly active UK users and is not a single-topic engine supplied through an API-based arrangement with another business (regulation 4 of SI 2025/226).
Ofcom has qualified the entry with a note on its scope. In Ofcom’s words, ChatGPT Search is a search engine included on ChatGPT, which is therefore a regulated search service. OpenAI must meet the additional Category 2A duties for the design, operation and use of ChatGPT Search in the UK and for the search content that ChatGPT Search presents. The entry “does not constitute a finding” that the additional duties apply to the whole chatbot where its output is not search content. Ofcom applied the same treatment to Feed Deep Dive, the AI search tool on Facebook.
The Category 2A duties include publishing a summary of the provider’s most recent illegal content risk assessment (section 27(9)). The provider must also use proportionate systems and processes to prevent users encountering fraudulent paid-for advertisements in or via search results, and to ensure swiftly that users can no longer encounter them once it is aware of them (section 39). It must also produce an annual transparency report when Ofcom serves a notice, which for a search service may ask only for information about the search engine (section 77(7)). The baseline duties on every regulated search service apply whatever its category.
Why the EU and UK scopes differ
A search engine under section 229(1) of the OSA includes “a service or functionality” that enables a person to search websites or databases. A UK search engine can therefore be one feature inside a larger product, and the Category 2A conditions apply to the search engine itself rather than to the service that contains it. Under Article 3(j) DSA an online search engine is an intermediary service, and the Commission designates services under Article 33. The Commission designated ChatGPT as a hybrid service that qualifies as a search engine, so on its stated reasoning the obligations for very large services, including the Article 34 risk assessment, apply to the service as a whole, subject to what the published decision says.
The Commission may confine the designation more narrowly in the decision itself. Under Article 3(g) DSA an intermediary service means a mere conduit, caching or hosting service, and we are not aware of any judgment of the EU courts deciding whether a generative AI system is one.
| Service | EU tier under the DSA (designation date) | UK category under the OSA (register at 28 September 2026) |
|---|---|---|
| ChatGPT | Very large online search engine (31 August 2026) | Category 2A, listed as ChatGPT Search |
| Very large online platform (31 August 2026) | Category 1 | |
| Roblox | Very large online platform (31 August 2026) | Category 1 |
| Very large online platform (25 April 2023) | Category 1; Feed Deep Dive in Category 2A | |
| Google Search | Very large online search engine (25 April 2023) | Category 2A |
| Bing | Very large online search engine (25 April 2023) | Category 2A |
Implications for providers of AI assistants
The two regimes apply different tests to a provider whose assistant searches the web. In the UK, the Category 2A duties apply to the functionality that is a search engine within section 229, counted by its own UK users, and to the search content it presents. In the EU, the test is whether the service as a whole is an online search engine, and the 45 million threshold counts recipients of the service. The OSA applies to a provider established outside the UK if the service has links with the UK, such as a significant number of UK users (section 4(5)), and is not exempt. The OSA scope tests are set out in Does the Online Safety Act apply to my service?
In the UK, a provider that can show which outputs are search content and which are generated holds the evidence needed to apply Ofcom’s approach. Under the DSA, on the Commission’s stated reasoning, the same separation would not narrow the designated service, because the Commission designated ChatGPT as a hybrid service. Enforcement of Articles 34 and 35 is discussed in the AliExpress DSA fine and the UK marketplace gap, the AI Act’s enforcement position for AI in designated platforms in AI Office enforcement, and the CMA’s separate test for AI assistants on Google’s search choice screen in Search choice screen. Bratby Law advises where a new AI feature raises a scope question under either regime (see regulatory perimeter and market entry).
Viewpoint
I regard Ofcom’s position as the more workable one for anyone building an assistant. Ofcom has tied the extra duties to search content, which a provider can identify and report on, and has left the question of the wider chatbot open.
On the Commission’s stated reasoning, and subject to the published decision, the systemic risk assessment that OpenAI Ireland Limited must carry out by the date the obligations apply covers ChatGPT’s generated answers as well as its web results, because the Commission designated the hybrid service (Article 34(1)).
Frequently asked questions
Is ChatGPT a search engine under the Digital Services Act?
Yes. The European Commission designated ChatGPT as a very large online search engine on 31 August 2026, describing it as a hybrid AI service that qualifies as an online search engine because it can search the web. The additional obligations for very large services apply from four months after notification, which the Commission puts at January 2027. The designation appears in the list the Commission published in the Official Journal on 6 October 2026.
Is ChatGPT a categorised service under the Online Safety Act?
Ofcom lists ChatGPT Search in Category 2A, the category for the largest search services, in its register of categorised services. The Category 2A duties apply to the design, operation and use of ChatGPT Search in the UK and to the search content it presents; Ofcom’s entry is not a finding that the additional duties apply to chatbot output that is not search content.
What duties does Category 2A add under the Online Safety Act?
The Category 2A duties include publishing a summary of the most recent illegal content risk assessment (section 27(9)), using proportionate systems to prevent fraudulent paid-for advertisements appearing in or via search results (section 39), and producing an annual transparency report about the search engine when Ofcom serves a notice (section 77). These apply in addition to the duties on every regulated search service.
Does the Online Safety Act apply to an AI provider established outside the UK?
Yes, wherever the provider is established, if the service has links with the UK and is not exempt. A service has links with the UK if it has a significant number of UK users or UK users are a target market (section 4(5)), or if it can be used in the UK and there are reasonable grounds to believe it presents a material risk of significant harm to people in the UK (section 4(6)).
For advice on whether an AI assistant or search feature falls within the Digital Services Act or the Online Safety Act, contact Rob Bratby at Bratby Law.
