The EU just called ChatGPT a search engine

Three search engines exist in EU law, and ChatGPT is one of them

The Digital Services Act keeps a public register of the services it considers systemically important. Anything reaching 45 million average monthly users in the EU gets designated, and the register splits them into very large online platforms and very large online search engines. Until 31 August the search-engine column had two rows in it. It now has three, and the middle one is ChatGPT, listed at 159.1 million average monthly users on the Commission's own table, ahead of Microsoft Bing. The provider named against it is OpenAI Ireland Limited.

Source: European Commission, supervision of the designated very large online platforms and search engines under the DSA. Every figure on that table is self-declared by the provider: the Commission footnotes them as reported "without prejudice to the assessment by the Commission of the methodology used to calculate the active recipients of service".

The reasoning is short enough to quote in full. ChatGPT, the Commission wrote, is a system that "can engage with and respond to users' prompts and queries, including by searching the web. Hence, ChatGPT is a hybrid service that qualifies as an online search engine under the DSA." The law was drafted to allow that reading. Article 3(j) defines a search engine as a service that takes a query and "returns results in any format in which information related to the requested content can be found". Ten blue links were never the requirement. A paragraph of prose with four footnotes qualifies just as well.

Two other services were designated the same day, both as platforms rather than search engines: Reddit at 57.2 million and Roblox at 46.6 million EU monthly users. That brings the DSA's top tier to 28 designated services in total. Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, security and democracy, said the three will "be held to a higher standard of scrutiny and accountability in the European Union", and added that the Commission "will not hesitate to designate any platform that meets the threshold for enhanced supervision".

Seventeen months from 11 million to 159 million

The 159.1 million figure is not an estimate by a research firm. OpenAI Ireland Limited publishes it twice a year because Article 24(2) of the DSA obliges it to, and the first of those disclosures covered the six months to October 2024. Read the four disclosures in order and the designation stops being a surprise.

The first disclosure, for the six months to 31 October 2024, put ChatGPT search and Browse at 11.2 million. Six months later it was 41.3 million, then 120.4 million, then 159.1 million for the six months ending 31 March 2026. Roughly fourteen times bigger in seventeen months of reporting, and the last of those periods closed five months ago, so the live number is likely higher than anything published.

Read that number precisely, because it is easy to overstate in both directions. It counts people using ChatGPT search, which OpenAI defines as "our online search features", and not everyone who opens ChatGPT. The chat interface does not always go to the web. On the other hand, the Commission designated ChatGPT, the whole service, and the decision does not carve the product into a regulated half and an unregulated one. Mathias Vermeulen and Laureline Lemoine of the Brussels firm AWO make both points in their reading of the decision: the search users are "only a slice" of the EU base, and the designation "does not appear to separate out ChatGPT's different functionalities".

For a marketer the exact denominator matters less than the shape. A search channel the size of Bing assembled itself in Europe inside two years, and most brands have never once measured what it says about them. We put numbers on that gap in the state of GEO in 2026.

What a very large search engine has to do, and by when

Nothing changes for OpenAI today. Designated services get four months from notification, which the Commission states as "four months, i.e. by January 2027". Some same-day reporting put the deadline at the end of November 2026. The Commission's own text says January, and it said January in the version published on 31 August.

From that date, a VLOSE has to assess and mitigate the systemic risks its service creates, run an internal compliance function, submit to an independent audit at least once a year, share data with the Commission and national regulators, let vetted researchers access platform data, offer a recommender option that is not based on profiling, and keep a public repository of the advertisements it has served. The listed risk categories include illegal content, minors, public security, electoral processes, and media freedom and pluralism.

The advertising clause is the one with a date attached to it already. ChatGPT Ads went live across 31 European markets on 24 August 2026, one week before the designation, on the free and Go tiers only. OpenAI pitched it to advertisers as a way to reach people "while they are actively exploring, comparing, and making decisions". From January 2027, under Article 39, that ad system has to be published in a repository anyone can inspect. Whatever your competitors buy inside the answer box, you will eventually be able to look it up.

Supervision runs through Dublin. OpenAI Ireland Limited is the designated provider, so the Commission works in cooperation with Coimisiún na Meán, Ireland's Digital Services Coordinator. Separately, OpenAI announced on 27 July that its European headquarters will be in Dublin, with 250 new jobs. If you run a brand out of Ireland, both the company and the regulator that supervises it are on your doorstep.

The tier has teeth, incidentally. The Commission fined AliExpress EUR 550 million on 20 July 2026 for failing to assess and mitigate risks around illegal and counterfeit goods.

Citation behaviour is about to become a documented risk

Most of the DSA obligation list reads like someone else's compliance project. Two parts of it will produce evidence a marketer can use.

The first is the risk assessment itself. Media pluralism is named as its own systemic risk category under Article 34(1)(b), which means the assessment should cover, in the AWO analysts' words, "how ChatGPT's citation and sourcing behavior affects publisher visibility". Whose sites get cited, and whose do not, becomes something OpenAI has to look at on the record rather than something the rest of us infer from scans.

The second is Article 40 data access. Vetted researchers can request internal data under Article 40(4), and Article 40(12) gives researchers who are not vetted, including those at non-profits, a right to whatever is publicly visible on the interface. The same access is already being used elsewhere: AlgorithmWatch is investigating whether Google's AI Overviews displace clicks away from news sites. Expect equivalent studies on ChatGPT within a year of the obligations landing, and expect the findings to be about which domains the model reaches for.

There is a longer thread running under all of this. In July the Commission decided that AI chatbots offering search functionalities are eligible to receive shared data from Google Search, under the Digital Markets Act. That is a different instrument with a different test, and nobody has been named a gatekeeper. The AWO analysts note only that after a VLOSE designation, a DMA gatekeeper case against OpenAI "no longer looks far-fetched". Treat that as informed speculation. What is decided, and dated, is the DSA designation.

One thing the designation does not do is settle who gets recommended. Regulators can force disclosure about how citations are produced. They cannot make an engine name your brand instead of the competitor whose comparison page answers the question better, which is a problem with a different fix.

What you actually do

Treat ChatGPT the way you treat a search engine, because a European regulator has just agreed that it is one. Four steps, in this order.

1. Move it out of the AI column of your reporting. If ChatGPT sits in a slide called "AI tools" next to a transcription app, the internal argument about budget is already lost. It belongs in the same row as Google and Bing, with the same questions asked of it: how often do we appear, on which queries, and who appears instead. The Commission's table is the most quotable thing you will get all year for that conversation.

2. Measure what it says about you now. You cannot argue about a channel you have never sampled. Run a mention scan across the questions your customers actually ask, record which brands come back, and keep the result. That is your baseline, and every later claim about improvement is measured against it.

3. Watch the sources, not only the mentions. An answer is assembled from pages. When your brand appears, note which domains supplied the sentence, because those are the pages that need to say the right thing. When a competitor appears instead, the cited source tells you what beat you, usually a comparison page or a forum thread rather than anyone's homepage.

4. Diary January 2027. When the obligations land, the risk assessments, the transparency reporting and eventually the ad repository become public material about how ChatGPT chooses the sources it cites. Very few marketing teams will read any of it. The ones that do will be planning against documented behaviour while everyone else guesses.

The first three take an afternoon between them, and the scan comes first because everything after it is a comparison against that baseline.

See what AI engines say about your brand

Questions people ask about this