EU Moves to Put ChatGPT and Roblox Under Toughest DSA Rules

European regulators are lining up the first generative-AI chatbot and the first gaming platform for the Digital Services Act's toughest tier, and both companies are about to find out what that actually costs. Bloomberg reports that OpenAI's ChatGPT and Roblox are on track for designation as Very Large Online Platforms or Search Engines under the DSA, a tier so far occupied by the likes of Meta, TikTok, and Google.

The user math is what forced Brussels' hand. OpenAI itself disclosed that ChatGPT's search feature averaged 120.4 million monthly users in the EU, and Roblox reported roughly 48 million EU monthly users for the six-month period ending February 13, 2026. The DSA threshold for the strictest obligations is 45 million. Both are over it, and both put the numbers on the record voluntarily, which makes them hard to walk back. As Euronews summarised the ChatGPT figure last autumn, the disclosure effectively started the clock.

What designation actually triggers is more interesting than the label. Within four months, a designated service has to run annual systemic-risk assessments across things like civic discourse, minors, and content integrity, submit to independent external audits, share data with regulators and vetted researchers, and stand up an internal compliance function. The enforcement teeth are fines of up to 6% of global annual turnover, plus a 0.05% supervisory fee to fund the Commission's oversight work. For OpenAI this is the first time an AI chatbot would face that regime; for Roblox, per MLex, it would be the first gaming platform in the club.

The honest caveat is that the reporting still leaves the classification question open. ChatGPT could land as a very large online search engine, a very large online platform, or arguably both, and the obligations differ. The 120.4 million figure covers the search function specifically, not the whole chatbot, which is exactly the ambiguity OpenAI's lawyers will lean on. Roblox is separately being investigated by the Dutch consumer authority over minors' safety, so the DSA designation would layer onto pressure that is already in flight rather than start it.

The forward-looking read is that generative AI's regulatory grace period in Europe is ending in a very concrete way. Independent audits and data-sharing obligations create a real market for trust-and-safety vendors and researcher-access tooling, and smaller AI competitors under the 45 million mark get a temporary moat while the incumbents absorb the overhead. If you build a consumer AI or user-generated-content product with any European traction, the interesting question is no longer whether the DSA applies to you, but how soon.