ChatGPT designated a VLOSE: the EU will assess systemic risks, not every answer

For users in Romania, ChatGPT’s designation as a VLOSE does not, for now, result in a confirmed visible change to the interface. It does not guarantee correct answers, does not turn every hallucination into a legal breach, and does not open private conversations to general access by authorities.

The change is less spectacular, but more important: OpenAI will have to show how it identifies and reduces risks that do not arise just once in a single chat, but can recur and be amplified across the European Union. Risk assessments, safeguards, independent audits and regulated data access create a pathway through which this accountability can be verified.

The European Commission’s register shows that ChatGPT was designated a very large online search engine (VLOSE) on 31 August 2026, and identifies the provider as OpenAI Ireland Limited. The same register states that the individual designation decision had not yet been published as of the reporting date, 26 September 2026.

For more information about ChatGPT, see GPT-6 Astra: what OpenAI’s new model brings and who can use it for now, which provides additional details on the subject.

The practical conclusion before the process begins

• What has not changed: The DSA does not certify the truthfulness of every ChatGPT answer.
• What changes: OpenAI must assess and mitigate systemic risks associated with the designated service.
• What has not yet been demonstrated: a product change introduced specifically after the designation.
• What will be verifiable: transparency reports, risk assessments, mitigation measures, audits and any action by the Commission.

The timeline in four steps

1. 31 August 2026 — designation. The Commission places ChatGPT in the VLOSE category. The designation is not a fine and does not, in itself, establish a DSA breach.
2. Notification to the provider — the exact date is not public. Under Article 33 of the DSA, the legal deadline starts to run from this notification.
3. Four months after notification — the additional obligations become applicable. The Commission gives January 2027 as a reference point, but without a public notification date, an exact deadline cannot be independently determined.
4. After the framework takes effect — public evidence emerges. The first transparency report associated with VLOSE status is due no later than two months after the obligations apply. Documents on risks and auditing follow the separate timetable set out in the regulation.

The difference between the date of the announcement and the notification date is not a bureaucratic detail. It determines when OpenAI can be assessed against the new obligations.

Why the figure of 159.1 million does not cover all of ChatGPT

The DSA sets a threshold of at least 45 million average monthly active recipients in the European Union for designation as a VLOP or VLOSE. The register records a figure of 159.1 million for ChatGPT.

The important distinction appears in OpenAI’s reporting: the figure refers to ChatGPT Search, meaning its online search functions, for the six-month period ending on 31 March 2026. The company states that the metric was calculated solely for DSA compliance.

Accordingly, 159.1 million should not be presented as the number of subscribers, unique accounts, paying customers or users of all ChatGPT functions. It is a self-reported legal metric for the online search function.

This is also where the legal tension in the designation lies: the register calls the service “ChatGPT”, while the audience figure published by the provider is limited to ChatGPT Search. In the absence of the individual decision, the exact scope and the Commission’s full reasoning cannot be reconstructed from public documents.

An incorrect answer is not the same as a systemic risk

Suppose a user in Romania asks for medical information and ChatGPT gives them incorrect advice. The error may have serious consequences and should be treated with caution, but a single conversation does not automatically demonstrate a DSA breach.

The issue becomes systemically relevant if there are indications that the service repeatedly produces the same type of dangerous recommendations, presents them in a way that increases their credibility, amplifies them through the search function, or fails to assess and reduce a foreseeable risk despite having been informed of it.

The DSA does not require the Commission to decide whether every generated sentence is true. It requires the provider to analyse risks arising from the service’s design, operation, algorithmic systems and use. Areas covered by the regulation include illegal content, fundamental rights, public health, protection of minors, physical and mental well-being, electoral processes and public security.

What OpenAI must be able to demonstrate

The VLOSE framework adds four central oversight tools:

• Risk assessment: the analysis must be conducted by the time the additional obligations take effect, then at least annually and before functionalities that may critically affect identified risks.
• Mitigation: OpenAI must adopt reasonable, proportionate and effective measures. These may concern design, algorithmic systems, internal processes, testing or information provided to users.
• Independent audit: it is paid for by the provider, but the organisation carrying it out must be independent, free of conflicts of interest and not paid fees contingent on the outcome. The audit checks compliance with obligations; it does not certify the truthfulness of every answer.
• Regulated data access: the Commission, the coordinator in the Member State of establishment and vetted researchers may obtain data under the conditions set by the DSA, to monitor compliance or study systemic risks.

Data access does not mean unrestricted access to user conversations. Authorities’ requests must be justified and limited to the data needed, while researchers must meet requirements on independence, research purpose, security and data protection. The regulation also requires the protection of confidential information and the security of the service.

What a user in Romania can do in practice

The appropriate route depends on the nature of the problem:

1. Factually incorrect answer: use the feedback function in the product and do not treat the output as the sole source for medical, legal, financial or safety decisions.
2. Allegedly illegal content: OpenAI publishes a notification form under Article 16 of the DSA. The notice must identify the content and the reasons it is considered illegal.
3. Possible DSA breach: a user who is in or established in Romania can submit a complaint through ANCOM’s digital services form.

A DSA complaint should not be framed simply as “ChatGPT got it wrong”. It becomes clearer if it identifies the obligation the user believes was not met, the function used, the date, steps to reproduce the issue, relevant screenshots, notices sent to the provider and responses received.

A hypothetical example closer to the DSA’s logic would be documentation of the same type of dangerous recommendation across several ChatGPT Search sessions, followed by repeated notices and indications that the reporting mechanism is not working or that the risk is not being addressed. Even this record would not, on its own, prove a breach, but it gives authorities more than an isolated error.

ANCOM explains that it receives and analyses complaints based on Article 53. If the provider is established in another EU Member State, the complaint may be forwarded to the coordinator in that state, with communication facilitated by ANCOM.

Which institutions are responsible

For Romanian users, ANCOM is the national entry point. For OpenAI Ireland Limited, the coordinator in the Member State of establishment is Coimisiún na Meán. The European Commission has direct powers over the additional obligations applicable to VLOSE services.

ANCOM is not a general fact-checker of ChatGPT answers and does not normally decide whether online information is illegal. Its role is to handle complaints about potential DSA breaches and direct them to the competent authority where necessary.

Three documents will show whether the designation has an effect

1. The individual designation decision. It may clarify the service covered, the legal reasoning and, potentially, the notification timetable. On 26 September 2026, the register marked it as unavailable.
2. The risk assessment and mitigation measures. These will show which problems OpenAI considers serious enough and what changes it claims to have made. Public versions may exclude confidential information or elements that could create security vulnerabilities.
3. The independent audit report and OpenAI’s response. The public will be able to see the scope of the audit, methodology, main findings, the auditor’s opinion and how the provider addresses recommendations. The audit may assess compliance, rather than exhaustively assess every output generated by the system.

This is the real test of VLOSE status: not whether ChatGPT stops making mistakes, but whether its recurring and foreseeable risks can be identified, documented, researched and challenged before authorities with clear powers.

Frequently asked questions

Does the DSA require ChatGPT to provide only correct answers?

No. The DSA requires the assessment and reduction of systemic risks, auditing, transparency and oversight. It does not guarantee the accuracy of every answer.

Is ChatGPT’s VLOSE designation a penalty?

No. The designation is a legal classification linked to the type of service and exceeding the audience threshold. A penalty would require a separate finding of an infringement.

When do the additional obligations become applicable?

Four months after the decision is notified to the provider. The Commission gives January 2027 as a reference point, but the exact notification date was not public as of 26 September 2026.

Does the figure of 159.1 million represent all ChatGPT users in the EU?

No. OpenAI says the figure refers to ChatGPT Search’s average monthly active recipients, calculated for DSA compliance purposes for the six-month period ending on 31 March 2026.

Can I complain to ANCOM about an incorrect ChatGPT answer?

A simple factual error is not automatically a DSA breach. A complaint to ANCOM must identify a possible failure to comply with the regulation and is more useful when it includes context, evidence, notices sent to the provider and responses received.

Will authorities get access to all ChatGPT conversations?

That does not follow from the designation. Data access must be justified, necessary for a purpose provided for in the DSA, and subject to safeguards for personal data, confidentiality and service security.

Sources consulted

• Supervision of the designated very large online platforms and search engines under DSA
• Commission designates ChatGPT, Reddit, Roblox under Digital Services Act
• Regulation (EU) 2022/2065 on digital services
• EU Digital Services Act (DSA) — OpenAI Help Center
• DSA: How complaints concerning digital services will be handled — ANCOM