A chat window can still be a search engine

Calling ChatGPT a search engine sounds odd because it does not behave like a familiar results page. Traditional search usually presents ranked links and leaves the reader to choose what to open. ChatGPT search can choose the sources, merge their claims, and present one synthesized response. Citations help, but the generated answer still decides which evidence receives attention.

The DSA does not require search to look like ten blue links. Its VLOSE rules concern the service's design and operation, including its algorithmic systems. That makes the framework broad enough to reach retrieval, ranking, and synthesis inside a conversational product.

Reviewers still need to test whether the model produces false or harmful statements. They must also examine how the product reformulates a query, selects sources, resolves conflicting evidence, and handles answers that may affect an election, a child, public health, or a person's rights.

What the designation requires

ChatGPT has four months after notification, until January 2027, to meet the additional VLOSE obligations. Articles 34 and 35 of the DSA require very large services to assess systemic risks created by their design, algorithmic systems, and use, then apply reasonable, proportionate, and effective mitigation measures.

Those risk assessments cover illegal content, fundamental rights, media pluralism, discrimination, consumer and children's rights, public security, electoral processes, gender-based violence, public health, and physical and mental wellbeing. Providers must perform them at least annually and before releasing a feature likely to have a critical impact on identified risks.

A VLOSE must also undergo an independent audit at least once a year, operate an internal compliance function, provide relevant data to regulators, and allow vetted researchers to access data for work on systemic risks. Annual risk assessment and audit materials must be published, with allowances for confidential information and security.

OpenAI already provides DSA contact points, an illegal-content reporting form, information about moderation, and appeal routes. Its trust and transparency page hosts DSA reports and links to an explanation of content presentation in ChatGPT search. The VLOSE designation adds a harder requirement: demonstrate that risk findings lead to proportionate product or operational changes.

Auditing the answer is not enough

Model evaluations commonly test accuracy, bias, toxicity, and policy compliance. A search product needs those checks, but its failure modes begin before generation.

Consider a question about a disputed local election. The final answer could contain only defensible sentences yet still draw from a narrow set of sources, miss an official correction, or consistently prefer one type of publisher. An audit that looks only at the prose will not catch that. The review has to follow the full chain: query reformulation, retrieval, source eligibility, ranking, citation fidelity, synthesis, and correction handling.

Researcher access could be especially valuable here. Independent teams often study answer engines through small collections of prompts and screenshots, while both the model and interface keep changing. The DSA does not promise unrestricted access. Privacy, security, and trade-secret protections still apply. It does, however, create a formal path for vetted research into systemic risks, which can support stronger evidence than interface snapshots alone.

Not every requirement maps neatly onto a chatbot. Parts of the VLOSE framework were written around established search and recommendation interfaces. Concepts such as recommender transparency or an option not based on profiling may need careful interpretation in a conversational system. The designation decides the legal category; supervision and implementation will determine how its edges fit ChatGPT search.

Smaller teams should copy the observability, not the bureaucracy

Few AI products will approach 45 million monthly EU recipients. They can still learn from the problem the DSA is trying to expose.

Once a product retrieves current information and compresses it into an answer, source selection becomes product behavior. A team should be able to reconstruct a failure: the request, whether search ran, any query rewrite, the sources considered, the sources cited, the generated text, and the correction path. Logging needs privacy controls and retention limits, but a product that records none of this cannot investigate a repeated pattern.

Useful controls include:

1. Keep retrieval events separate from generated text so source selection can be tested independently.
2. Measure whether each citation supports the attached claim, not simply whether a link is present.
3. Evaluate by language and region because source coverage and risk vary across EU markets.
4. Give users a visible reporting route and retain the minimum evidence needed for review.

Those controls remain useful when models change. A gateway such as api.ish.chat can help an application compare providers while keeping one application-level record of retrieval and output behavior. A consumer service such as ish.chat faces the same basic rule: switching the model does not transfer responsibility for how the product turns sources into answers.

The Commission's decision is bigger than another EU rule aimed at a large US technology company. Search is moving from a list of links to an answer assembled by a model. That answer still shapes what people find, trust, and act on, which makes its source trail part of the product rather than a decorative row of citations.