ChatGPT and Roblox are heading into the DSA's toughest tier. Bloomberg reported on 29 July 2026 that the European Commission is preparing to designate both as Very Large Online Platforms, with the announcement possible as soon as August. If it lands, it will put the first AI chatbot and the first gaming platform into the same regulatory bracket as the largest social networks in Europe.
Why these two, and why now
The DSA's top tier has a single mechanical trigger: an average of 45 million monthly active users in the EU. Platforms have to publish their own numbers, and both cleared the line by a wide margin.
- ChatGPT: around 120 million monthly users in the EU by OpenAI's own reporting, well over twice the threshold.
- Roblox: roughly 48 million monthly EU users for the six months ending 13 February 2026.
Neither company has commented, and neither has the Commission. Nothing is official yet: this is reporting on a decision that is expected, not a decision that has been taken. That distinction matters, because the obligations only start counting from formal designation.
What designation actually requires
Once designated, a platform gets four months to comply, and the duties are structural rather than cosmetic. Annual systemic risk assessments covering things like harm to minors and public security. Mitigation measures for whatever those assessments find. Independent annual audits. Transparency on advertising and content moderation. A named contact point for authorities and users. Data access for the Commission and for vetted researchers. Terms of service written so ordinary users can follow them. The ceiling for non-compliance is 6 percent of global annual turnover.
The part that is genuinely new
Applying the DSA to a chatbot is not a routine extension of an existing framework. The rules were written for feeds and marketplaces, where content exists as discrete items that can be counted, flagged and removed. A model that generates a different answer for every user does not have items in that sense. What does a systemic risk assessment look like when the content is produced on demand and never repeats? What does an independent audit examine?
Roblox raises a different question. It is a game to its users and a social platform to a regulator, with a young user base that puts it directly in the path of Europe's minor-protection agenda. The Commission has already gone after TikTok over how it handles accounts belonging to minors, and that case is the template: designation first, then the specific enforcement action that designation makes possible.
Where this leads for users
The DSA ladder tends to produce the same two outcomes wherever it is climbed. The first is age assurance, because minor protection is the risk category regulators press hardest, and the practical implementation is verification. That pattern is visible across the growing list of countries restricting social media by age. The second is geographic differentiation: rather than rebuild a product globally, companies apply the strictest rules only where they are compelled to.
That second effect is what users notice. Features get disabled in one jurisdiction and not another, moderation thresholds shift by country, and the same account behaves differently depending on where it connects from. It also runs into a hard limit that regulators themselves acknowledge: Ofcom has conceded that its own online safety regime cannot compel a foreign site to do more than geoblock. Rules that end at a border are rules that a connection can cross.
For anyone using these services the sensible response is not dramatic. Assume that identity checks will spread rather than recede, keep the amount you hand to any chatbot to what the task actually needs, which is the whole point of using AI assistants without oversharing, and understand that if your access starts depending on which country your traffic appears to come from, the tools that survive filtering become part of the picture whether you wanted them to or not.
