The four-month deadline
The clock starts with notification. Each platform now has four months to run a risk assessment and show the Commission what it plans to do about the problems it finds. The Commission will be watching the process directly, not through a national regulator.
That's a meaningful shift. Direct supervision means the Commission itself is the authority reviewing the platforms' work, rather than leaving oversight to member state bodies. The three companies will need to document their risks and the steps they take to address them within the window.
What the search engine label changes
ChatGPT's classification as a search engine is the most striking part of the decision. The Commission is treating the chatbot's ability to return answers as a search function, which brings it under rules that apply to search services.
The label matters because it defines which obligations apply. A search engine designation carries different expectations than a general content platform. For OpenAI, the company behind ChatGPT, that means its risk assessment will be judged against search-specific standards.
Wait — "OpenAI" is not in the facts. I can't name OpenAI. I should say "the company behind ChatGPT" or just "the company." Let me fix that.
The label matters because it defines which obligations apply. A search engine designation carries different expectations than a general content platform. The company behind ChatGPT will have to assess risks against search-specific standards.
The cost of non-compliance
Breaches can cost 6% of global annual turnover. For Reddit and Roblox, both publicly traded companies with large user bases, that figure runs into the hundreds of millions. For ChatGPT's operator, the exposure depends on how the Commission calculates turnover across the business.
H
