AI Search Is Now Regulated: How Should Your GEO Change?

On August 31, 2026, the European Commission designated ChatGPT a Very Large Online Search Engine (VLOSE) under the Digital Services Act (DSA), and designated Reddit and Roblox as Very Large Online Platforms (VLOPs) the same day [1].

It is the first time a generative AI service has entered the DSA's strictest regulatory tier — previously occupied only by Google Search and Microsoft Bing [2].

For enterprises, the point is not that regulation has arrived. It is a usable dividing line: regulators are targeting the use of undisclosed commercial means to change answers, not the work of making true information easier to find. Those two have often shared one budget. They now need to be separated.

---

Quick Answer

The designation is in force, and the compliance deadline is January 2027. The three newly designated services must meet the enhanced obligations by then, which leaves enterprises a workable planning window.

Three boundaries:

1. The regulated parties are platforms, not brands. DSA obligations fall on OpenAI and Reddit. They impose no direct compliance duty on brands doing GEO, but they change the environment you operate in.
2. Auditability will rise. Independent audits, data access for vetted researchers, and transparency reporting will gradually move AI visibility from "inferred from outside" toward "partly verifiable."
3. Risk rises for specific tactics, not for GEO itself. Technical readability, factual verifiability, and genuine third-party corroboration are unaffected. Bulk content production, fabricated authority, and burying paid influence inside the evidence chain carry clearly higher risk.

---

What the EU Actually Designated

All three designations took effect the same day, triggered by the same threshold: 45 million average monthly active users in the EU [2].

OpenAI's obligations include annual systemic risk assessments, plus additional assessments before deploying functionality likely to affect systemic risks; facilitating platform data access for vetted researchers; submitting to external independent audits; and establishing an internal compliance function [2].

---

Why This Classification Matters to Enterprises

The Commission described ChatGPT as a hybrid service: it responds to user prompts by retrieving, synthesising and presenting information, including information sourced from the web. That web-search functionality is what makes it a search engine in law. Legal analysis summarises the signal as: reach and risk matter more than platform type [2].

Three practical uses for enterprises.

Internal buy-in gets easier. "AI assistants are search entry points" has moved from an industry view to a regulatory classification. That is a citable argument for budget approval.

Platform statements now have a framework for verification. The designation came shortly after OpenAI expanded ads to 31 European countries, and questions about the transparency and targeting of that advertising have already been raised with the Commission [2]. So "ads do not influence answers" should still be recorded as a platform commitment pending verification, not written into reporting as established fact.

Off-site concentration risk needs re-assessment. Reddit, a high-weight source, has entered the enhanced regime and will face closer scrutiny of its content moderation. When a high-weight platform is pushed to tighten governance, its content mix can shift, which changes what AI retrieves from it. The response is to diversify your source structure, not to withdraw.

---

Not Just Europe: The Target Is the Same

Four signals, one direction.

The US bill's definition of "influence" reads almost like a complete description of what GEO sets out to do, and is worth reading word for word. The mechanism the 315 reporting describes is this: large volumes of systematically placed false information can be picked up by AI training and retrieval systems, then surface as high-priority answers [5].

---

What Enterprises Should Do: Four Things

The compliance window runs to January 2027. There is time, but sequence matters.

First, audit what your current GEO vendors actually do. This is the highest priority right now. Ask for three things: a list of the sites where content was published, disclosure of commercial relationships behind any paid third-party content, and confirmation of whether any form of bulk generation was used. After the 315 broadcast, several vendors issued statements distancing themselves from black-market practices [5] — which is itself evidence that such practices exist in the market. This is not a trust question. It is exposure accounting.

Second, separate paid and organic accounting completely. Ad data does not prove GEO results, and GEO data does not prove ad results. While "ads do not influence answers" remains a platform statement, mixing them contaminates both conclusions. Write this rule into your internal attribution document.

Third, build a traceable evidence chain for key claims. For high-risk statements about safety, compliance, pricing, or efficacy, cite the source, the testing body, the sample, and the date. This is both a content-quality requirement and the least costly form of self-protection as disclosure duties tighten.

Fourth, diversify off-site sources and monitor platform by platform. A rule change at one high-weight platform directly reshapes your citation mix. What you need is continuous recording by platform, by language, and over time — not a single screenshot.

---

Which Tactics Now Carry More Risk

The right-hand column is a risk-direction judgment, not legal advice. For specific compliance questions, consult counsel in your market.

One line to guide budget: money spent making true information easier to find carries falling regulatory risk; money spent making AI believe something untrue carries rising risk.

---

How Innflows Can Help

Tighter regulation creates a very practical requirement: you need to be able to explain where your AI visibility came from.

Innflows sits on exactly that problem. It does traceable measurement rather than content volume. Mapped to the four actions above:

Concretely: around a stable set of business questions, Innflows continuously records brand mentions, recommendation roles, and citation sources, then delivers the raw data — which outlets mentioned you, and which competitors they mentioned — at fine granularity. When you need to explain the composition of your AI visibility to an internal team, a client, or an outside party, that logging carries more weight than a screenshot.

The boundaries should be stated as well: external monitoring does not replace legal advice, and it cannot read a platform's internal retrieval and ranking logic. It describes distributions under selected test conditions and cannot establish causation. The DSA's researcher data access channel is for vetted researchers, not a data source for commercial monitoring tools [2].

---

Where These Conclusions Do Not Apply

• In force does not mean clarified. Legal analysis notes there is almost no precedent for generative AI conducting DSA risk assessments [2]. Do not assume citation rules will be published after January 2027.
• Obligations apply to platforms. Everything here addressed to enterprises is risk management, not a compliance duty imposed by the DSA.
• The US bill is not law. It is cited to show where legislative attention sits [3]; the flight-search study referenced in its press release was not independently verified here.
• The 315 material includes reporting and expert opinion. Vendor statements are self-declarations; the view that conduct "may constitute false advertising or unfair competition" comes from an interviewed economist, not a regulatory finding or court ruling [5].
• This article is timestamped. It relies on public information available as of mid-September 2026, and later developments may change.

---

FAQ

Will this designation affect how my brand does GEO?

Not directly. DSA obligations fall on service providers, not brands. But the environment changes: transparency and audit duties make platform behaviour more verifiable, and scrutiny of undisclosed commercial influence raises the risk attached to some grey tactics.

Why was ChatGPT classified as a search engine?

Because the Commission looked at function rather than product label. It described ChatGPT as a hybrid service that retrieves, synthesises and presents information, including from the web, and that functionality is what makes it a search engine in law [2].

Will AI citation rules be published after January 2027?

Current information does not support that expectation. The DSA requires risk assessments, independent audits, and researcher data access — not publication of retrieval and ranking algorithms. Expect higher verifiability, not transparent rules.

Does buying GEO services create compliance risk?

It depends on vendor practice. Risk concentrates in three areas: fabricating expert identities or test reports, paying for ostensibly objective third-party content without disclosure, and promising that payment secures "standard answer" status. Ask vendors directly for a publication list and commercial relationship disclosures.

Which single action should an enterprise take first?

Audit vendors. The other three can proceed quarterly, but what your vendor has been doing determines your current exposure, and it can only be established through direct questions and documented verification.

If regulation tightens, does that mean GEO is a bad idea?

The opposite. Regulators target the use of undisclosed commercial means to change answers. As auditability rises, visibility built on content quality, first-hand data, and genuine third-party corroboration gains relative advantage, because fabrication and bulk production become easier to detect.

---

Bottom Line

August 31, 2026 belongs on the GEO timeline. From that date, AI search is regulated by the EU as search infrastructure.

What enterprises need to reassess is not whether to do GEO, but which kind of GEO they are currently doing.

Four things, in priority order: audit vendors, separate paid and organic accounting, build evidence chains for key claims, and monitor continuously by platform and language. The compliance window runs to January 2027.

Making true information easier for AI to find carries falling regulatory risk, because the environment is starting to reward what can be verified. Making AI believe something untrue carries rising risk, because the environment is learning how to check.

---

References

[1] - Commission designates ChatGPT, Reddit, Roblox under DSA — European Commission press release ip_26_1772, primary source for the designation

[2] - ChatGPT, Reddit, and Roblox Join the DSA Big Leagues — Slaughter and May; user threshold, hybrid-service classification, VLOSE obligations, the January 2027 deadline, and the advertising-scrutiny overlap

[3] - Magaziner Introduces Bill to Require AI Chatbots and Search Results to Disclose Paid Content — US House official press release; the bill is at introduction stage

[4] - Position: Generative Engine Optimization Creates Underexamined Risks — arXiv:2606.12439, accepted to the ICML 2026 Position Track

[5] - AI industry players vow compliance after China's annual 315 Gala uncovers AI "data poisoning" through GEO technology — Global Times