The European Commission is expected to add ChatGPT and Roblox to its "very large online platform" (VLOP) list under the Digital Services Act, with the designation anticipated in August. Bloomberg, reported via Engadget, broke the news on July 29, 2026.

Under the DSA, a VLOP designation applies to platforms and search engines that exceed 45 million monthly active users in the EU. The threshold is the gate to the regulation's strictest tier of obligations. Existing VLOPs include Google Maps, Google Play, Facebook, Instagram, Snapchat, TikTok, WhatsApp, X, and YouTube.

Within four months of designation, platforms must establish a point of contact for both authorities and users, publish user-friendly terms and conditions, and be transparent about advertising, recommendation systems, and content moderation decisions. VLOPs are also required to report criminal offenses, assess systemic risks related to illegal content, electoral processes, gender-based violence, freedom of expression, media freedom, and discrimination, and implement mitigation measures against those risks.

The designation of ChatGPT would bring an AI-powered conversational service under the DSA's VLOP framework for the first time. The DSA's transparency requirements around recommendation systems and content moderation were written primarily with social media and marketplace platforms in mind. A generative AI chatbot does not operate a content feed in the conventional sense, but it does mediate user access to information through model outputs shaped by training data, fine-tuning, and guardrail mechanisms that functionally resemble content moderation. How the Commission maps those mechanisms onto DSA reporting categories will be a signal for how other foundation-model services are treated downstream.

Roblox presents a different set of questions. The platform combines user-generated content, a virtual economy, and a predominantly young user base. The DSA's risk assessment obligations cover gender-based violence, discrimination, and effects on minors, categories that align directly with longstanding scrutiny of gaming and social platforms frequented by children. Roblox already operates trust and safety systems, but VLOP designation would require formalized, auditable risk assessments and mitigation reporting on an EU regulatory schedule.

The broader context is that the EU has been steadily expanding the perimeter of its digital regulation. The DSA, the AI Act, and the Digital Markets Act now form a three-pillar framework that collectively subjects large technology operators to layered obligations across content governance, AI system risk management, and market competition. ChatGPT's expected VLOP designation sits at the intersection of the DSA and the AI Act, and the compliance architecture a provider builds for one regime will almost certainly inform the other.

For technology teams at affected companies, the practical implications are concrete. Four months is a narrow window to stand up or adapt regulatory contact points, rewrite terms and conditions for EU users in plain language, and produce transparency reports covering recommendation logic and moderation decisions. For an LLM-based service, "recommendation systems" may need to be interpreted to cover retrieval-augmented generation pipelines, ranked output selection, and safety filters. The Commission has not yet published guidance on how DSA obligations apply specifically to generative AI interfaces, and the designation itself, while expected in August, has not been formally announced.

The EU's approach has consistently been to regulate at scale: the 45-million-user threshold is deliberately set high enough to capture only the largest operators while leaving smaller services under lighter-touch obligations. That ChatGPT has crossed that threshold in roughly three and a half years of public availability tracks the adoption curve of consumer internet services that took far longer to reach comparable reach. Whether that pace of adoption should change the regulatory calculus is a policy question, not a factual one.

What this does clarify is that the EU intends to apply its existing platform regulatory toolkit to AI services, rather than waiting for the AI Act alone to define obligations. Companies operating large-scale generative AI products in Europe will need to treat DSA compliance as a near-term operational requirement, not a distant possibility. The compliance investments made here, transparent content-moderation reporting, formalized risk assessments, and user-facing accountability mechanisms, are also the kinds of artifacts that build user trust in systems whose outputs are notoriously difficult to audit. That alignment between regulatory mandate and product maturity is, on balance, a useful convergence.