ChatGPT now falls under the DSA. Your AI Act role stays the same.

This analysis first appeared as the weekly Praxikon newsletter.

<h2>ChatGPT now has a second European rulebook</h2> <p>On 31 August, the European Commission designated ChatGPT as a very large online search engine under the Digital Services Act. The service reported more than 45 million average monthly users in the EU and has four months, until January 2027, to meet the additional DSA obligations. These include assessing and mitigating systemic risks concerning illegal content, minors, fundamental rights, elections and public security.</p> <h2>What does this mean for your organisation?</h2> <p>The new designation is directed at the provider of ChatGPT as an online service. It does not turn your organisation into a very large online search engine and it does not change any AI Act application dates. Where employees use an existing generative AI tool in their work, your organisation will generally be the deployer. The exact role still depends on what you develop, offer under your own name, modify or integrate into your own service.</p> <p>Your own obligations therefore remain separate. The Article 4 duty to take AI literacy measures has applied since 2 February 2025. For your own public chatbot or external AI output, you must also determine which part of Article 50 applies and which party carries the disclosure, marking or labelling obligation.</p> <h2>More nuanced than it looks: supplier evidence is not your own file</h2> <p>A DSA risk assessment by a large platform may produce valuable supplier information, but it does not replace your own AI inventory, privacy assessment, Article 4 measures or Article 50 control. These are two rulebooks with different duty holders. Use the supplier's evidence as input for your file, not as proof that your own use is automatically in order.</p> <h2>Action for this week</h2> <p>Create a one-page role card for one widely used AI tool. Record the service and supplier, the specific use, your likely role, whether customers or employees interact with the system directly, which data goes into it, who owns it internally and which evidence is still missing. Ask legal, IT and the operational owner to review the same card. Differences between their answers are exactly the gaps you want to find now.</p> <p>If you want to make Article 4 demonstrable per role straight away, see the <a href="https://learnwize.ai/article-4-evidence-dossier?utm_source=praxikon&utm_medium=referral&utm_campaign=praxikon_weekly&utm_content=editie-2026-09-08">Article 4 evidence dossier by LearnWize</a>. It records which measures were taken for each role and who can produce the evidence.</p> <p>You receive this weekly AI Act update because you signed up with Praxikon, formerly Praxikon, or used one of our tools or templates. You can unsubscribe with one click at the bottom.</p> <p>Until next Tuesday.<br/>Zahed Ashkara<br/>Praxikon</p>