Every major online platform is now an AI company. Recommender systems decide what billions of people see, generative tools create content at scale, and AI chatbots answer search queries. In the EU, two laws govern how…
Every major online platform is now an AI company. Recommender systems decide what billions of people see, generative tools create content at scale, and AI chatbots answer search queries. In the EU, two laws govern how that AI is run. The Digital Services Act (DSA) regulates platforms and search engines: their recommender systems, content moderation, advertising, protection of minors and systemic risks. The EU AI Act regulates the AI systems and models themselves: what is prohibited, what must be disclosed, and what general-purpose AI providers must do.
In 2026, the two laws converged. On 31 August 2026, the Commission designated ChatGPT as a very large online search engine under the DSA, the first time an AI chatbot has been placed in the DSA's strictest tier. And the Digital Omnibus on AI gave the Commission's AI Office exclusive supervision of AI systems built into very large platforms and search engines, so both regimes now sit with the Commission.
This guide explains how the two laws divide the work, where they overlap on recommender systems and AI-generated content, and what platforms must do to comply with both.
- Digital Services Act
- Regulation (EU) 2022/2065; applies to very large platforms since August 2023 and to all intermediaries since 17 February 2024
- EU AI Act
- Regulation (EU) 2024/1689, in force since 1 August 2024
- DSA focus
- Intermediary services: illegal content, recommender transparency, advertising, minors, dark patterns and systemic risks
- AI Act focus
- AI systems and models: prohibitions, transparency, high-risk requirements and general-purpose AI duties
- Very large services
- 28 designated platforms and search engines as of October 2026, each with 45 million or more EU users
- Maximum fines
- DSA: 6% of worldwide turnover · AI Act: 7% for prohibited practices
- Supervisor for big players
- The Commission under the DSA; the AI Office for AI integrated into very large platforms and search engines
The short answer
The DSA governs how a platform uses AI to shape what people see and do: recommender transparency, a non-profiling feed option on very large platforms, risk assessments for algorithmic amplification, moderation and advertising. The AI Act governs the AI itself: bans on manipulative AI, labelling of deepfakes and AI-generated content, chatbot disclosure, and duties for general-purpose AI model providers.
For a large platform, the two meet in its systemic-risk framework. Under the Omnibus, the DSA's risk assessments, mitigation measures and audits are the first point of entry for assessing AI built into very large platforms, and the AI Office can still apply AI Act powers on top.
The DSA regulates
Online platforms and search engines: recommender systems, content moderation, notice and action, ads, minors, dark patterns, systemic risks, independent audits and researcher data access.
The AI Act regulates
AI systems and models: prohibited manipulation, chatbot and deepfake transparency, machine-readable marking, high-risk AI, and general-purpose AI model duties, including for models with systemic risk.
What the DSA requires for recommender systems and AI content
The DSA uses layered duties: light ones for all intermediaries, more for online platforms, and the most for very large online platforms (VLOPs) and very large online search engines (VLOSEs).
| DSA provision | Who it applies to | What it requires for AI |
|---|---|---|
| Article 27: recommender transparency | All online platforms | Explain in the terms and conditions the main parameters of recommender systems and any options to change them |
| Article 38: non-profiling option | VLOPs and VLOSEs | Offer at least one recommender option that isn't based on profiling |
| Article 25: dark patterns | Online platforms | No interface design that deceives or manipulates users |
| Article 28: minors | Online platforms accessible to minors | High privacy, safety and security for minors; no profiling-based ads to minors |
| Article 26 and 39: advertising | Online platforms; ad repositories for VLOPs | Disclose why users see ads; public ad repositories |
| Articles 34 and 35: systemic risks | VLOPs and VLOSEs | Assess and mitigate risks from the design and functioning of services, including algorithmic systems and generative AI |
| Article 37: audits | VLOPs and VLOSEs | Annual independent audits of DSA compliance |
| Article 40: data access | VLOPs and VLOSEs | Give vetted researchers data access, including on how algorithms work |
Enforcement has started. In December 2025, the Commission issued its first DSA non-compliance decision, fining X EUR 120 million for three breaches. In 2026 it opened proceedings into X's recommender systems and its deployment of Grok, preliminarily found TikTok in breach over addictive design (February 2026), and found that TikTok's default settings for minors fell short (July 2026), including algorithmic promotion of minors' content.
What the AI Act requires from platforms
Recommender systems and content moderation AI are generally not high-risk under the AI Act. The Act's main hooks for platforms sit elsewhere:
- Prohibited practices (Article 5, since 2 February 2025): no AI using subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm, and no AI exploiting vulnerabilities linked to age, disability or social or economic situation. Since the Omnibus, AI that generates non-consensual intimate imagery or child sexual abuse material is also banned, from 2 December 2026.
- Transparency (Article 50, since 2 August 2026): tell people when they are interacting with a chatbot, mark generative AI outputs in a machine-readable way, and label deepfakes and AI-generated text published on matters of public interest.
- General-purpose AI (since 2 August 2025): model providers must keep technical documentation, publish a training-data summary and have a copyright policy. Providers of models with systemic risk must also evaluate the model, mitigate risks, report serious incidents and ensure cybersecurity.
- High-risk AI: only where a platform uses AI in an Annex III area, such as hiring or credit, from 2 December 2027.
A recommender system designed to exploit compulsive use could breach the DSA's dark-pattern and systemic-risk rules, and in extreme cases the AI Act's ban on manipulative AI. The DSA is the practical enforcement route for platform design, while the AI Act sets an absolute floor.
If you are mapping AI governance for a platform or marketplace, I post practical breakdowns of the AI Act, the DSA and ISO 42001 regularly on LinkedIn. You're welcome to connect with me there and tell me which overlap your trust and safety team is working through.
The 2026 convergence: one Commission, two rulebooks
ChatGPT becomes a DSA search engine
On 31 August 2026, the Commission designated ChatGPT a VLOSE, describing it as a hybrid service that qualifies as an online search engine because it answers prompts, including by searching the web. Reddit and Roblox were designated as VLOPs the same day. The new designees must meet the extra obligations by January 2027, four months after notification, including systemic-risk assessments, independent audits and transparency duties.
That puts one AI product under three regulatory layers: the AI Act's general-purpose AI duties for the underlying models, Article 50 transparency for the chatbot, and DSA very-large-service duties for the search-facing service.
The AI Office takes over AI on the largest platforms
The Digital Omnibus on AI, in force since 27 July 2026, made the AI Office exclusively competent for AI systems that are, or are integrated into, designated VLOPs or VLOSEs, and for AI systems built on a general-purpose model by the same provider. For AI embedded in very large platforms, the DSA's risk-assessment, mitigation and audit duties (Articles 34, 35 and 37) are the first point of entry, without limiting the AI Office's AI Act powers. DSA teams can also ask the AI Office's opinion on AI risk assessments.
Labelling a deepfake under AI Act Article 50 doesn't discharge a platform's DSA duty to assess and mitigate disinformation risks. And a DSA risk assessment doesn't replace AI Act general-purpose AI obligations for the model provider. The regimes coordinate, but each still applies in full.
EU AI Act vs DSA: side by side
| Dimension | Digital Services Act | EU AI Act |
|---|---|---|
| Regulates | Intermediary services: hosting, platforms, marketplaces, search engines | AI systems and general-purpose AI models, across all sectors |
| Approach | Due diligence and systemic risk management for services | Risk-based product rules for AI |
| Recommender systems | Transparency for all platforms; non-profiling option and risk assessment for VLOPs | Not high-risk as such; subject to prohibitions on manipulation |
| AI-generated content | Systemic-risk mitigation, including prominent labelling of deepfakes (Article 35(1)(k)) | Machine-readable marking and deepfake labelling (Article 50) |
| Chatbots | DSA applies if the chatbot is, or is part of, an intermediary service such as search | Disclosure that users are interacting with AI |
| Risk assessment | Annual systemic-risk assessment for VLOPs and VLOSEs | For high-risk AI and general-purpose AI models with systemic risk |
| Minors | Article 28 protections and Commission guidelines | Ban on AI exploiting age-related vulnerabilities |
| Audit | Annual independent audit for very large services | Conformity assessment for high-risk AI; evaluations for systemic-risk models |
| Supervisor | Commission for VLOPs and VLOSEs; Digital Services Coordinators for others | AI Office for general-purpose AI and AI in VLOPs and VLOSEs; national authorities for others |
| Max fine | 6% of worldwide turnover; periodic penalties up to 5% of daily turnover | EUR 35M or 7% (prohibited); EUR 15M or 3% (most other duties) |
The AI Act also sets fixed euro caps (EUR 35M and EUR 15M), with the higher amount applying. Fines on general-purpose AI providers are imposed by the Commission.
How the timelines fit together
- 16 Nov 2022
DSA enters into force.
- 25 Aug 2023
DSA obligations apply to the first designated VLOPs and VLOSEs.
- 17 Feb 2024
DSA applies to all intermediary services.
- 1 Aug 2024
AI Act enters into force.
- 2 Feb 2025
AI Act prohibitions, including on manipulative AI, apply.
- 2 Aug 2025
General-purpose AI model obligations apply.
- Dec 2025
First DSA fine: EUR 120 million against X.
- 27 Jul 2026
Digital Omnibus on AI enters into force; the AI Office gains competence over AI in VLOPs and VLOSEs.
- 2 Aug 2026
AI Act Article 50 transparency duties and penalties apply.
- 31 Aug 2026
ChatGPT designated a VLOSE; Reddit and Roblox designated VLOPs.
- 2 Dec 2026
New AI Act bans on nudifier and CSAM-generating AI apply; marking deadline for generative systems already on the market.
- Jan 2027
ChatGPT, Reddit and Roblox must meet very-large-service DSA obligations.
A 6-step plan for platform AI governance
Map every AI system on the platform
List recommender systems, ranking and search AI, moderation classifiers, ad targeting, generative features and chatbots. Tag each with its DSA role and its AI Act classification (prohibited risk, Article 50, high-risk or general-purpose AI).
Fold AI into the DSA systemic-risk assessment
If you are a VLOP or VLOSE, assess how recommender systems and generative AI contribute to illegal content, disinformation, harm to minors and risks to fundamental rights, and document mitigations your auditors can test.
Fix recommender transparency and choice
Explain main ranking parameters in plain language, give users controls, and offer a non-profiling feed if you are a very large platform. Check feeds for addictive or manipulative design.
Label and mark AI content
Apply machine-readable marking to content your own generative tools produce, label deepfakes and public-interest AI text, disclose chatbots, and build detection and labelling for AI content users upload.
Protect minors across both laws
Apply DSA minor-protection defaults to feeds, and test AI features against the AI Act's bans on exploiting age-related vulnerabilities and generating sexual imagery.
Run one governance and evidence system
Use one AI inventory, one risk register and one evidence library for DSA audits, AI Office requests and general-purpose AI duties. An AI management system under ISO/IEC 42001 can provide the structure.
Common mistakes to avoid
- Assuming recommender systems are outside the AI Act because they aren't high-risk
- Treating AI Act Article 50 labels as full DSA disinformation risk mitigation
- Assuming AI chatbots can't be DSA services; ChatGPT shows they can
- Running DSA trust-and-safety and AI governance teams with separate inventories
- Ignoring the 2 December 2026 bans on AI-generated intimate imagery and CSAM
A prompt to map your platform's AI to the DSA and the AI Act
Paste in your platform details to get a first-draft compliance map. Your trust and safety, legal and AI governance leads should review it.
You are a platform regulation specialist with deep knowledge of the Digital Services Act (Regulation (EU) 2022/2065) and the EU AI Act (Regulation (EU) 2024/1689) as amended by the Digital Omnibus on AI. Our platform: [service type (social network, marketplace, search, video, app store, AI assistant); EU monthly active recipients; DSA status (intermediary, online platform, VLOP, VLOSE); AI systems used: recommenders, ranking, moderation, ad targeting, generative features, chatbots; whether we build or license the models; user groups, including minors] Produce: 1. For each AI system: applicable DSA articles and its AI Act classification (prohibited risk, Article 50, high-risk, general-purpose AI). 2. How to integrate AI risks into a DSA Article 34/35 systemic risk assessment, with example mitigations. 3. A recommender transparency and user-choice checklist (Articles 25, 27, 28, 38). 4. An AI content labelling plan covering Article 50 marking, deepfake labels, chatbot disclosure and user uploads. 5. Who supervises us under each law, including AI Office competence after the Digital Omnibus. 6. A 6-month action plan with owners. Use only what I provide and mark uncertain points UNKNOWN.
The DSA asks what your algorithms do to society. The AI Act asks what your AI is allowed to be. Platforms that answer both questions with one governance system will move fastest. — Kumail Mehdi
Frequently asked questions
Are recommender systems regulated by the AI Act?
They aren't classed as high-risk as such, but they are AI systems, so the AI Act's prohibitions on manipulative and exploitative AI apply. The detailed rules on recommender transparency, user choice and systemic risk come from the DSA.
Is ChatGPT regulated under the DSA?
Yes. On 31 August 2026, the Commission designated ChatGPT a very large online search engine, describing it as a hybrid service that can search the web. It must meet the additional very-large-service obligations by January 2027, alongside its AI Act duties.
Who supervises AI on very large platforms?
The Commission supervises VLOPs and VLOSEs under the DSA. Since the Digital Omnibus on AI, its AI Office is also exclusively competent under the AI Act for AI systems that are, or are integrated into, those services.
Do platforms have to label AI-generated content?
Under the AI Act, providers of generative AI must mark outputs in a machine-readable way, and deployers must label deepfakes and certain AI text from 2 August 2026. Under the DSA, very large platforms must also mitigate systemic risks, which can include prominently labelling deepfakes.
Does a DSA risk assessment cover AI Act obligations?
Not fully. For AI embedded in very large platforms, DSA risk assessments are the first point of entry for supervision, but AI Act duties, such as Article 50 transparency and general-purpose AI obligations, still apply in their own right.
What are the maximum fines?
Up to 6% of worldwide annual turnover under the DSA, with periodic penalties of up to 5% of average daily turnover. Under the AI Act, up to EUR 35 million or 7% for prohibited practices, and EUR 15 million or 3% for most other breaches.
Master AI governance in 6 months, 15 minutes a week
AI Governance – Decoded is my weekly newsletter that explains the EU AI Act, the Digital Services Act, ISO 42001 and the frameworks around them in plain language. One short, practical read every week.
Join the newsletterGoverning AI on a platform or marketplace? Let's connect on LinkedIn. I'm always glad to compare notes on platform AI regulation.
Sources
- EUR-Lex — Regulation (EU) 2022/2065 (Digital Services Act)
- EUR-Lex — Regulation (EU) 2024/1689 (AI Act)
- Search Engine Journal — ChatGPT is now a very large online search engine in the EU
- Bratby Law — ChatGPT's DSA designation and compliance date
- Continental Brief — DSA list of 28 very large platforms and search engines
- EU Law Analysis — Digital Services Act summary and enforcement (October 2026)
- MediaLaws — EUR 120 million later: the DSA enters the enforcement phase
- ASIL — Commission finds TikTok failed to protect minors under the DSA
- European Commission — Two years of the Digital Services Act
- Stephenson Harwood — The Digital Omnibus on AI: ten key takeaways
- Model Diplomat — Digital Omnibus centralises AI enforcement
Kumail Mehdi
ISO 42001 Lead Auditor and AI strategist. 11 years in corporate leadership, 14 years running a digital agency. I help professionals, consultants and AI startups turn expertise into governed, AI-powered systems.
