The EU’s move

The Digital Services Act faces a (crucial) test from ChatGPT

The inclusion of ChatGPT in the DSA imposes obligations regarding risk management and transparency, but highlights legal uncertainties linked to the innovative and generative nature of the service

FILE PHOTO: OpenAI logo is seen in this illustration created on June 11, 2026. REUTERS/Dado Ruvic/Illustration/File Photo/File Photo REUTERS

4' min read

Translated by AI
Versione italiana

4' min read

Translated by AI
Versione italiana

The Commission’s decision to designate ChatGPT as a ‘very large online search engine’ within the meaning of the EU Digital Services Regulation (Digital Services Act – DSA) marks an important milestone in the European strategy for the governance of artificial intelligence. It means that a new hybrid service – which differs significantly from other online platforms and designated search engines – will be subject to the enhanced regime set out in the DSA. This raises a number of questions regarding how the DSA’s rules will apply to this service, as well as how the European Commission will develop new expertise and methodologies for this purpose.

Whilst, on the one hand, this move imposes on OpenAI obligations to assess and mitigate any systemic risks associated with both the dissemination of unlawful content and that of harmful content (such as disinformation), on the other hand, the decision does not appear to be without its legal complications.

Loading...

The Digital Services Act limits its scope to intermediary services. This is a diverse category, encompassing entities and business models with characteristics that can vary considerably. Search engines are classified as intermediary services that enable users to formulate queries in order to search, in principle, across all websites – including queries based on keywords – and which return results in any format in which information relating to the requested content can be found.

This definition highlights the distinction between online search engines and traditional storage services, which host information uploaded by service users at their request, as is the case with social media platforms. Furthermore, the concept is agnostic with regard to the output produced in response to the user’s request: whilst search engines normally return hyperlinks to third-party content found on the web, there is nothing to prevent the result from taking another form, such as a summary of that content.

Norme più severe nell'Unione europea per ChatGpt, Roblox e Reddit

At this juncture, however, a potential inconsistency can be discerned with regard to the way chatbots such as ChatGPT operate. The intermediary services paradigm posits that the service provider remains essentially neutral with respect to the content in question, which also implies the absence of editorial responsibility. Search engines, including those already designated under the DSA, operate in the same way. The content is generally produced by third parties, rather than created by the service providers themselves, as would appear to be the case with most of the output from generative artificial intelligence systems. The crux of the problem thus shifts to a delicate fine line, marking the boundary between the simple compilation of third-party content and a more purely editorial activity.

The question to be asked, therefore, is whether the generation of content in response to users’ prompts can be equated, in the same way as an intermediary service, with the typical activity of a search engine: this classification appears to pave the way for an affirmative answer, drawing on the fact that the definition is agnostic as to the format in which the information relating to the content requested by the user may be found. Whilst this argument may hold some weight, it is undeniable that in 2022, when the European legislator defined these categories, generative artificial intelligence systems had not yet assumed such a significant role in the information ecosystem.

Questions and other obligations

This designation also raises important questions regarding the application of other obligations under the DSA to ChatGPT: these could potentially include the establishment of a register of online advertising and the obligation to provide users with at least one recommendation system option that is not based on profiling. In this regard, it will be necessary to clarify in which situations recommendation systems can be said to exist within a chatbot such as ChatGPT: depending on the answer to this question, the obligation in question could have significant implications for the business model of an AI-based application that adapts and personalises its responses based on conversations with users.

There is, however, one important aspect that sets a limit to these considerations: the Commission took action after the ChatGPT Search service exceeded the threshold of 45 million active users within the EU, which classifies the online search engines in question as ‘very large’. This classification within the latter category, however, refers ‘simply’ to ChatGPT. Since only some of its features are comparable to the functioning of search engines, the question remains as to whether the Commission will apply the DSA only to these features or to the service as a whole.

In any case, this designation appears to be Europe’s initial response to the risks that the use of chatbots may pose to collective and individual interests, addressing the lack of a regulation that would require systemic risks to be assessed and mitigated directly at the application level. Under the DSA, this will now be possible: the Commission will thus be able to require OpenAI to integrate measures directly into the application aimed at mitigating risks to users’ physical and mental wellbeing, which could also include emergency mechanisms in cases of immediate risk.

Marco Bassini, Tilburg University, Tilburg Institute for Law, Technology, and Society

Brand connect

Loading...

Newsletter

Notizie e approfondimenti sugli avvenimenti politici, economici e finanziari.

Iscriviti