A regulator changed ChatGPT’s status under the Digital Services Act without touching a single customer contract, and the service changes land within four months.
What changed
On 31 August 2026 the European Commission designated ChatGPT, operated by OpenAI Ireland Limited, as a Very Large Online Search Engine under the EU Digital Services Act. On the same date it designated Reddit and Roblox as Very Large Online Platforms.
The threshold was reach. Each service declared at least 45 million average monthly users in the European Union. The Commission treated ChatGPT as a hybrid service inside the search engine category because it can search the web in response to user prompts. Reddit and Roblox were designated as platforms because users can disseminate third-party content to the public.
The consequence is a compliance clock. Designated services have four months from notification, so until January 2027, to meet the additional obligations that apply to very large platforms and search engines: systemic risk assessment and mitigation covering illegal content, negative effects on minors, users’ physical and mental well-being, fundamental rights, electoral processes and public security, plus independent auditing, transparency reporting on content moderation and data access for researchers. Designation also places the service under direct Commission supervision.
Why it matters
The governance point sits underneath the designation itself. A supplier’s regulatory status can change after onboarding, because of a factor outside the customer’s control.
Many companies onboarded ChatGPT as an AI assistant, a productivity tool, a developer aid or an embedded capability. On 31 August 2026 the same service acquired a new status under the DSA because of its EU user reach. Nothing changed in any customer’s contract. Nothing changed in any customer’s own sector classification. Nothing changed in any customer’s third-party register.
Most third-party processes ask what a supplier does for the company, what data it receives, what controls apply and what contractual protections exist. Fewer ask whether the supplier’s own regulatory perimeter has moved since onboarding. Fewer still name an owner for that question.
The trigger matters as much as the outcome. Designation did not follow from a customer’s decision, a new internal use case or a change in the customer’s risk appetite. It followed from the supplier’s scale. Boards usually map regulation through the company’s own sector, products, geography and customers. Here an obligation attached because a dependency became large enough.
The impact is also likely to arrive as product change rather than as legal duty. A supplier working through systemic risk assessment, mitigation measures, transparency reporting, independent audit and researcher data access inside a four-month window will probably change how the service behaves. It may answer differently. Some functionality may become unavailable, or available on different terms, or restricted for particular groups of users. Anything built on top of that service inherits those changes on the regulator’s timetable.
What changes for management
Management should treat regulatory status as a live supplier attribute rather than a note taken at onboarding. Recording that a tool is an AI assistant, a search-enabled service or a content platform is not the same as recording which regime now governs it, and which parts of the service that regime can move.
That does not call for a legal review of every supplier every month. It calls for a monitoring model over material dependencies, and a plain answer to one question: if a supplier’s regulatory status changed tomorrow, who would know, which register would be updated, and which business processes would be reviewed?
The answer is often unclear, because ownership is split. Procurement holds the contract, legal holds the data protection terms, security holds technical assurance, compliance holds regulatory mapping, and engineering or operations holds the integration. The supplier’s own standing under an external regime can fall between all of them.
The AI Act adds a second layer. It places obligations on deployers of AI systems, not only on the providers that build them, and its transparency obligations began to be enforced from 2 August 2026. A company using an AI system can therefore carry deployer duties while the supplier carries DSA duties as a designated search engine. One tool, two regimes, two clocks, two sets of control evidence, and usually two different owners inside the company.
That gap is where oversight goes missing. Joining the views takes judgement about which dependencies genuinely matter to the business, and the map tends to get sharper when someone from outside works through it with the people who own each piece. It also affects evidence. Boards increasingly need to know what a company can prove under regulatory pressure, not only what policy says should happen. If a supervised supplier changes outputs, access rules or moderation behaviour, management should be able to show when the change was identified, which dependent processes were assessed and what was decided.
What changes for the board
The board does not need to supervise a supplier’s compliance programme. It does need assurance that management can see when a material dependency changes in a way that touches operational resilience, customer impact, legal obligations or control evidence.
That is a different question from traditional vendor risk. It is not whether the supplier passed onboarding. It is whether the supplier is still the same risk proposition, and how the company would find out if it were not.
Financial services boards already face a version of this. The Digital Operational Resilience Act has applied to EU financial entities since 17 January 2025, and its Chapter V requires a register of information on all contractual arrangements with ICT third-party service providers, an assessment of concentration risk and exit strategies, while bringing providers designated critical into an EU oversight framework of their own. The NIS2 Directive points the same way by requiring supply chain security to form part of cybersecurity risk management measures. Dependency governance is becoming continuous rather than a step at contract signature.
There is also a shadow-use angle worth naming. A consumer-scale service used inside a workforce can be unregistered internally at the very moment its provider enters a public supervisory perimeter. Directors should expect management to separate approved integration, tolerated business use and unmanaged use, and to explain how each is detected rather than how each is prohibited.
Questions boards should now ask
- Which tools, AI assistants and embedded services the company relies on have been designated as very large online platforms or very large online search engines?
- Which register records a supplier’s current regulatory status, and who is accountable for updating it after onboarding?
- Where is the designated service used across the company, including enterprise use, embedded product or workflow use, and known unmanaged use?
- Which business processes depend on the answers, search results, content handling or availability of a designated service?
- What would be affected if that supplier changed response behaviour, access rules, content controls or functionality before January 2027?
- Who owns the join between the company’s AI Act deployer obligations and the DSA obligations attaching to the supplier?
- What evidence would show that management spotted the designation, assessed the operational impact and decided what to change?
- Which fallbacks or exit routes exist where the service supports a material process, a customer-facing workflow or a regulated activity?
- How will management monitor future status changes whose trigger is a supplier’s scale rather than the company’s own activity?
Practical implications
The first step is to make regulatory status a monitored field in third-party governance rather than a static note. For material technology suppliers that means recording the applicable public status, the source of it, the internal owner, the date last checked and the dependent business processes.
The second is to connect that field to change management. When a supplier enters a stricter regime, the response belongs wider than legal analysis: product dependency, data flows, user access, control evidence, resilience and customer communications all deserve a look.
On unmanaged use, management should resist the assumption that unregistered means immaterial. A service can sit outside the approved inventory and still shape work, decisions and drafts across the organisation. Consumer-scale adoption raises the chance that a change at the supplier level lands inside the company even where procurement has no contract to point at.
The designation is a useful test of governance maturity. A company that can say where the service is used, what depends on it, who watches its regulatory status and how a change would be handled has turned a regulatory event into operational oversight. A company that cannot has a dependency moving faster than the model built to govern it.