Loading story…
The European Commission designated OpenAI's ChatGPT a Very Large Online Search Engine (VLOSE) under the Digital Services Act after the service exceeded the 45 million average monthly EU-user threshold; ChatGPT reported 159.1 million monthly active EU users. The Commission classified it as a hybrid conversational AI and web-search service, making it the first conversational AI service subject to the DSA's VLOSE regime. Reddit and Roblox were designated Very Large Online Platforms (VLOPs) in the same action.
OpenAI, Reddit, and Roblox must meet the enhanced DSA requirements by the end of January 2027, including assessing and mitigating systemic risks involving illegal content, minors, wellbeing, fundamental rights, elections, and public security; undergoing annual independent audits; providing ranking-system transparency; and granting data access to regulators and vetted researchers. The Commission will supervise ChatGPT and Reddit with Ireland's Coimisiún na Meán, and Roblox with the Netherlands' Authority for Consumers and Markets; violations can draw fines of up to 6% of worldwide annual turnover.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The European Commission designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms after each reported at least 45 million average monthly EU users. The designations subject the services to enhanced systemic-risk, audit, transparency, and regulatory data-access obligations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
cyberinsider.com
Open sourcethecybersecguru.com
Open sourcezdnet.fr
Open sourcearstechnica.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceec.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **European Commission** opened formal proceedings against **X** under the **Digital Services Act (DSA)** to examine risks linked to the rollout of its AI tool **Grok** in the EU, focusing on whether the platform adequately assessed and mitigated systemic risks tied to the spread of **illegal content**. Regulators cited the apparent materialization of harms including **manipulated sexually explicit images** and content that may amount to **child sexual abuse material (CSAM)**, and will assess whether X met DSA obligations around risk identification, mitigation measures, and reporting—potentially including whether an **ad hoc risk assessment** was completed and submitted before Grok-related features were deployed. The Commission is also expanding its earlier DSA investigation into X’s **recommender systems**, including risks associated with a shift toward a **Grok-based recommender model**, and is coordinating with Ireland’s media regulator **Coimisiún na Meán** (as Ireland is X’s EU establishment). Reporting also notes parallel international scrutiny and responses: the UK regulator **Ofcom** has opened a probe into Grok, **Malaysia and Indonesia** have banned the chatbot, and xAI/X have claimed to implement technical measures and restrict some Grok functionality (including limiting certain image generation and restricting access to paying subscribers) amid concerns that mitigations have been insufficient to prevent sexualized deepfakes and related harms.
Jun 29, 2026
A U.S. court overseeing *The New York Times* copyright litigation ordered OpenAI to preserve ChatGPT output logs, including conversations users delete, as potential evidence. The preservation requirement creates a significant retention obligation for AI-service data that would ordinarily be subject to user deletion and minimization practices. The order raises compliance concerns under the EU General Data Protection Regulation (**GDPR**) and the California Consumer Privacy Act (**CCPA**), which establish rights to deletion and impose limits on retaining personal data. Organizations using or building generative-AI services should review litigation-hold processes, data-retention disclosures, cross-border data handling, and procedures for responding to privacy-rights requests when records must be retained for legal claims.
Sep 2, 2026
The **European Commission** opened a formal investigation into **X** under the **Digital Services Act (DSA)** over concerns that its GenAI chatbot **Grok** enabled the creation and dissemination of *manipulated sexually explicit images*, including content that may amount to **child sexual abuse material (CSAM)**. EU officials said the probe will assess whether X properly identified and mitigated systemic risks tied to Grok’s deployment in the EU and whether safeguards were adequate to prevent illegal sexual content and related harms; Commission executive vice-president **Henna Virkkunen** described sexual deepfakes of women and children as a violent form of degradation and said the investigation will determine whether X met its legal obligations. Reporting also noted parallel scrutiny outside the EU, including investigations in the **UK** and **France**, and action by **California Attorney General Rob Bonta**, who cited an “avalanche of reports” about non-consensual sexually explicit material. X publicly reiterated “zero tolerance” for child sexual exploitation and non-consensual nudity and said it removes high-priority violative content and reports relevant accounts to law enforcement; it also announced changes to Grok intended to curb generation of these images. Under the DSA, the EU has enforcement options that can include significant financial penalties if non-compliance is found.
Jun 29, 2026