ChatGPT SEO: the EU has designated ChatGPT a very large online search engine

What the Commission decided on 31 August 2026

The announcement is short and it does two things. It names the category each service falls into, and it states the basis: "These services declared that they reach at least 45 million average monthly users in the EU and thus meet the threshold for designation." That number is not an estimate the Commission produced. Article 24(2) of the regulation requires every provider to publish, in a publicly available section of its own interface and at least once every six months, the average monthly active recipients of the service in the Union over the past six months. Designation runs off that published figure.

Where 45 million comes from is worth knowing, because it is the whole test. Recital 76 explains that significant reach "should be considered to exist where such number exceeds an operational threshold set at 45 million, that is, a number equivalent to 10 % of the Union population", and Article 33(1) puts the same number in the operative text. Nothing in either provision asks whether a service is good, popular in the right way, or a search engine in the sense a marketer means. It asks how many people in the Union use it.

The announcement lists the obligations in one sentence, being "assessing and mitigating the systemic risks stemming from their service and algorithmic systems related to the dissemination of illegal content, the negative effects on minors, users' physical and mental well-being, fundamental rights, electoral processes and public security". Article 33(6) then sets the clock: the Commission notifies the provider, publishes the list of designated services in the Official Journal, and the obligations "shall apply, or cease to apply, to the very large online platforms and very large online search engines concerned from four months after the notification to the provider concerned". The Commission's page does not print a per-service user count, and OpenAI's own disclosure page under Article 24(2) refused a request from this sandbox with HTTP 403 on 6 September 2026, so no such figure is printed here.

Does ChatGPT SEO change now that ChatGPT is a search engine in EU law?

Not in any way you can act on this month, and the reason is in the definition. Article 3(j) defines an online search engine as "an intermediary service that allows users to input queries in order to perform searches of, in principle, all websites, or all websites in a particular language, on the basis of a query on any subject in the form of a keyword, voice request, phrase or other input, and returns results in any format in which information related to the requested content can be found".

Read that as an engineer rather than a lawyer. Every clause in it describes an interface: what goes in, how wide the corpus is, what comes back. The phrase "in any format" is doing the work that makes a chat answer qualify. There is no clause about ranking, no clause about indexing, no clause about how a result is chosen, and therefore nothing in the definition that a person practising generative engine optimization or answer engine optimization could use. The classification tells you that the law will now treat a chat product's live retrieval as a search function. It does not tell you one thing about the retrieval.

This matters because the classification argument has been used as a proxy for a different question, which is whether the tactics that earn a blue link also earn a citation. That question has partial published answers already and none of them moved on 31 August. A controlled experiment on document structure raised citation rate across six generative engines by 7.8 points rather than the 17.3 often quoted, and the same divergence between crawling and citation is what separates GEO from SEO in practice. If you came to this looking for a change in what to publish, there is not one here. If you came looking for when somebody will have to explain how ChatGPT picks sources, keep reading, because there is a date.

The one obligation that touches how results get chosen

There is exactly one thread in the regulation that runs anywhere near ranking, and it is worth reading precisely rather than hopefully. Article 27(1) requires providers "that use recommender systems" to set out in their terms and conditions, "in plain and intelligible language, the main parameters used in their recommender systems, as well as any options for the recipients of the service to modify or influence those main parameters". Article 27(2) says those parameters shall explain why certain information is suggested, and must include at least "the criteria which are most significant in determining the information suggested to the recipient of the service" and "the reasons for the relative importance of those parameters".

Article 27 by its own words addresses providers of online platforms, which is a different defined category from an online search engine. What reaches a designated search engine is Article 38, which opens "In addition to the requirements set out in Article 27" and then requires providers of very large online platforms and of very large online search engines that use recommender systems to "provide at least one option for each of their recommender systems which is not based on profiling". So the non-profiling option is unambiguous for a VLOSE, and the main parameters disclosure reaches it by that cross reference rather than by Article 27 standing alone.

Now the disappointing part. What Article 27 produces is a passage of prose in a terms and conditions document, written at the level of "the criteria which are most significant". It is not a ranking factor list, not a per-query explanation, and not a report about your site. The nearest working comparison is what the search engines already ship voluntarily: Microsoft's Bing Webmaster Tools names the grounding query behind a Copilot citation while Google's equivalent report names no query at all. A terms and conditions paragraph is considerably less than either. Treat it as context for how citation actually gets decided, not as a feed.

Who gets to read what the Digital Services Act produces

The useful way to read Section 5 of the regulation is not obligation by obligation but audience by audience. Each duty produces a document, and each document has a reader, and for most of them that reader is not the public and is definitely not a site owner. Article 34 requires an annual risk assessment covering systemic risks arising from "the design or functioning of their service and its related systems, including algorithmic systems". Article 37 requires independent audits, "at their own expense and at least once a year", assessing compliance with the obligations in Chapter III. Article 40(1) gives the Digital Services Coordinator of establishment and the Commission access, on reasoned request, to data necessary to monitor compliance.

Two of these do surface publicly, and they are the ones to diarise. Article 42(1) requires a designated provider to publish the transparency reports referred to in Article 15 within two months of the date of application and at least every six months thereafter. Article 42(4) goes further and requires the provider to make publicly available, at the latest three months after it receives each audit report, the risk assessment report, the specific mitigation measures, the audit report itself, and the audit implementation report. That is a dated, compulsory, public description of how a service assesses its own algorithmic systems, and it is the single most substantive thing this designation will produce for anyone outside the Commission.

One further artefact is machine readable by requirement rather than by favour, and it is the only one in the list that is. Article 39(1) obliges a designated provider that presents advertisements on its interface to compile a repository and make it publicly available "through a searchable and reliable tool that allows multicriteria queries and through application programming interfaces". Article 42(3) adds a smaller but useful granularity to the reports, requiring the average monthly recipients of the service to be broken out for each Member State rather than given as one Union figure. Neither is about organic citation, and both are more queryable than anything the ranking side of the regulation produces.

Enforcement sits behind all of it. Article 74(1) allows the Commission to impose fines "not exceeding 6 % of its total worldwide annual turnover in the preceding financial year" on the provider of a designated service that infringes the relevant provisions. That is the reason these documents will exist. It is not a reason to expect them to be about you. Our own note on why a scanner withholds a grade makes the same distinction in a much smaller domain: a document that states a method is not a measurement of your page.

What a site owner can still measure this week

The layer a regulator has just taken an interest in is not the layer you control. The one you do control is the request: whether a named crawler is permitted a path, and what the response holds before any script runs. That is governed by RFC 9309, the Robots Exclusion Protocol, published on the Standards Track in September 2022, and by the bots OpenAI documents, which this blog read at source on 5 September 2026 and found naming four tokens, being GPTBot, OAI-SearchBot, ChatGPT-User and OAI-AdsBot.

Those tokens do not behave alike, and the difference is measurable rather than theoretical. Lantad requested robots.txt from 40 well known hostnames on 5 September 2026 and evaluated the site root for three of those tokens: across the 29 hosts that served a parseable file, the root was allowed for GPTBot on 23, for OAI-SearchBot on 27 and for ChatGPT-User on 27, and on 4 of the 29 the three agents got different answers, always with GPTBot refused while the search bot was allowed. On the same day, 21 of those 29 files named none of the three tokens at all, so the verdict came from the wildcard group. A separate reading of six sites found not one AI crawler token named in any of their files.

Two cautions carry over from that work and neither is softened by a designation. A robots.txt verdict is a statement of permission and observes no request, so it establishes nothing about whether a crawler came or obeyed, which is why a user agent is a claim rather than an identity and why only 6 of 15 registry tokens publish a User-Agent string you can match literally. And permission is only the first of two layers that decide whether AI can read your site: an allowed page can still return nothing a crawler reads.

If you want to check yours rather than read about it, the robots.txt tester evaluates a file per crawler token, what GPTBot sees shows the raw response rather than the rendered one, the AI crawler reference lists the tokens each vendor documents, and how ChatGPT citation works in practice covers the surface this designation does not touch. The scoring method states what each of those checks is worth and why.