Regulation often works by thresholds: reach a certain size and additional obligations apply. On 31 August, the European Commission announced that it had designated ChatGPT, Reddit and Roblox under the Digital Services Act’s regime for very large online platforms and search engines, on the basis that each reported at least 45 million average monthly users in the EU. The designation triggers extra duties after a four-month compliance period.
What the Digital Services Act does
The DSA sets rules for online intermediaries, with obligations that scale with size. Smaller services face basic requirements such as transparency and notice-and-action procedures. Very large platforms face additional duties, including systemic risk assessments, independent audits and enhanced transparency. The logic is that the largest services have the greatest potential to cause harm and the capacity to address it.
Why 45 million is the threshold
The figure represents roughly ten per cent of the EU population, a level at which a service is considered systemically important. Once designated, a platform must assess risks related to its design and use, including risks to minors, fundamental rights and public security, and take measures to mitigate them. It must also submit to independent auditing.
A designation stops short of a finding
Being designated does not mean a platform has broken the rules. It means the obligations apply. A regulatory step of this kind is often reported as if it were an accusation, and the distinction matters for how the process is understood. Enforcement comes later, if at all, after assessments and supervisory work.
What compliance involves
Compliance takes several actions at once. It involves producing risk assessments, adjusting product design where risks are identified, providing researchers with access to data, and publishing transparency reports. Each of these is a substantial undertaking, and the adequacy of the measures will be judged by the Commission and, potentially, by courts.
The AI dimension
Designating ChatGPT is notable because it applies platform regulation to an AI service, raising questions about how systemic risk assessment applies to a system whose outputs are generated rather than curated. Risk assessment frameworks developed for social media may not map neatly onto generative AI, which is one reason the designation is being watched closely.
Why Roblox and Reddit
Roblox is a gaming and social platform with a large young user base, and Reddit is a forum platform with substantial public discourse. Both raise familiar concerns about content moderation and minors, which are central to the DSA’s systemic risk framework. Their designation expands the set of services subject to the regime beyond the largest social networks.
What to follow closely
Risk assessments, transparency reports and Commission decisions will show what changes in practice. The useful questions are whether the assessments identify real risks, whether the measures address them, and whether independent audits have access to the information they need. Those are the points at which regulation becomes effect rather than form.
How platforms respond
Platforms subject to the DSA typically establish compliance teams, conduct risk assessments and publish reports. The quality and candour of these exercises vary, and researchers have criticised some for being superficial. The regulation creates a process, and the substance depends on how seriously it is carried out and how rigorously it is supervised. Independent audits are meant to provide a check, and their effectiveness depends on access and expertise.
The international dimension
The DSA applies to services operating in the EU regardless of where the company is based, which extends European rules globally in practice. Other jurisdictions are developing their own frameworks, raising the prospect of overlapping and sometimes conflicting requirements. For large platforms, compliance becomes a matter of managing several regimes at once, which favours companies with legal resources and disadvantages smaller competitors.
What researchers get
The DSA includes provisions for researcher access to platform data, addressing a longstanding complaint that independent scrutiny was impossible. In practice, access is negotiated and often contested, and the terms shape what can be studied. Whether these provisions produce meaningful research will depend on how the arrangements work over the next few years.
The definition of a platform
The DSA’s obligations attach to categories such as online platforms and search engines, and applying those categories to new kinds of service is not always straightforward. An AI assistant is neither a forum nor a search engine in the traditional sense, and deciding how it fits is a regulatory judgement. That process will shape how future services are treated, and it is one reason this designation is being watched.
The designation expands the DSA’s reach into services that were not anticipated when the rules were drafted. That is a sign of a framework designed to adapt, and it also places weight on regulators’ judgement about which services qualify. How that judgement is exercised in future cases will shape the regime’s scope.
Sources
- European Commission. Commission designates ChatGPT, Reddit and Roblox under the Digital Services Act. ec.europa.eu
Image: EmDee · CC BY-SA 4.0 · via Wikimedia Commons.