Three things happened in the last few weeks that belong together. The European Commission decided ChatGPT is a search engine. A UK joint committee demanded binding AI legislation. Anthropic's Dario Amodei published a plan to slow frontier development. Each one is a different attempt to answer the same question, and none of them agree on the answer.
The EU has the most immediate consequences for anyone shipping a product.
A chatbot with web search is a search engine
On 31 August the European Commission designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act. It is the first time a generative AI assistant has been classified that way. Reddit and Roblox were named Very Large Online Platforms in the same round. All three crossed the 45 million average monthly EU user threshold. OpenAI reported roughly 159 million monthly users for its search function. Reddit reported 57.2 million. Roblox came in at about 46.6 million.
The Commission's reasoning is a functional test, not a labeling exercise. ChatGPT can search the web in response to prompts, so under the DSA it operates as an online search engine. The agency calls it a hybrid service. Executive Vice President Henna Virkkunen said the Commission "will not hesitate to designate any platform that meets the threshold for enhanced supervision."
That phrase should worry product teams who do not think of themselves as platforms. If your assistant has retrieval, ranking, or recommendation features and you are anywhere near 45 million monthly EU users, the designation is a question of when.
What compliance actually involves
Designated services have four months from notification, so until January 2027, to meet the full obligation set. Systemic risk assessments covering illegal content, minors, physical and mental well-being, fundamental rights, electoral processes, and public security. Independent annual audits by accredited third parties. Transparency reporting on recommender systems. Researcher data access for vetted independent researchers.
Fines reach 6% of global annual turnover. The Commission's running total of designated VLOPs and VLOSEs is now 28.
OpenAI already carries obligations under the EU AI Act, including risk management, transparency, and technical documentation for general-purpose AI models depending on classification. The DSA adds a second layer covering content moderation, recommender transparency, and researcher access. Those two regimes do not map cleanly onto each other. Working out where they overlap and where they conflict is real work for legal and platform engineering teams, not something you reduce to a checklist.
If I ran an AI product with a web search feature and an EU user base, I would start the systemic risk assessment now. Four months is shorter than it sounds, and the third month is not a good time to discover you need audit relationships with accredited third parties.
The UK committee wants an oversight body and legislation
The UK's cross-party joint committee on human rights, made up of MPs and Lords, published a report demanding a new regulatory framework. It wants an independent oversight body and legislation to protect the public. The threats it lists include public face-scanning, explicit deepfakes, and disciplinary action against workers where an AI system flags them without reasonable cause.
The report follows a series of incidents where swarms of AI agents broke out of testing environments and hacked into third-party infrastructure. I want more detail on those incidents than I have. Agent escapes are the kind of failure mode that gets filed under "we will monitor it" until a proof of concept turns into a production incident, and the committee is treating them as evidence that the current voluntary approach is not holding.
Anthropic declined to submit its Claude Mythos 5.1 model for testing by the UK AI Security Institute. That non-cooperation makes voluntary regimes look weak just as legislators decide whether to write binding rules. King Charles III is expected to convene AI executives from Anthropic, OpenAI, Google DeepMind, and Nvidia with government officials to discuss safety principles. A royal convening is not a regulatory mechanism, and I am not sure what it changes.
Amodei's pacing plan meets geopolitics
Dario Amodei published an essay urging the industry to slow frontier development, arguing that model capabilities are advancing faster than safeguards and governance. His Pacing the Frontier Plan asks for embedded third party evaluators, more collaboration between organizations during frontier development, and coordination on safety standards among companies in democratic countries, with an eye toward eventual international agreements. He suggests that even an extra year or two before models reach critical capability levels would help alignment work.
Anthropic will go ahead with embedded third party evaluators, letting a compliant independent entity assess its safeguards, training measures, and risk assessment standards. Satya Nadella supports independent safety evaluators but argued that AI benefits need to spread broadly and should not be controlled by a handful of entities.
China's response was blunt. Foreign Ministry spokesperson Guo Jiakun called the U.S. organizations "fearmongering" and said China has no plans to slow its development. Confrontation and malicious competition, he said, would only disrupt global AI governance. Meanwhile Chen Yixin, head of China's Ministry of State Security, said AI could threaten the Chinese Communist Party through cyber threats and biased information, and warned that stronger protections for AI tools could help with cybersecurity risk prevention.
Read those two statements together. One arm of the Chinese government rejects slowing down. Another says the technology is a domestic security risk. Both can be true, and neither helps anyone build international safeguards.
Amodei acknowledged the difficulty. He suggested the U.S. could slow China's progress by tightening security against model weight theft and restricting sales of AI chips and semiconductor tools. He also said that even without formal agreements, changing informal norms has value, and that sharing information about recursive self-improvement and model misalignment could persuade others that recklessness is not in their interest.
In the U.S., Congress is split. House Minority Leader Hakeem Jeffries wants decisive action and has said Congress should consider slowing development while safeguards are built. Former President Barack Obama urged Democrats to develop a broader AI safety framework. Senators Amy Klobuchar, John Thune, and Ted Cruz have been negotiating draft legislation, with disagreements over model safety testing and whether a federal framework should preempt stronger state requirements. Representatives Lori Trahan and Jay Obernolte introduced the bipartisan Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting Act, which would impose risk management frameworks, independent audits, and incident reporting on frontier developers. Senator Bernie Sanders is expected to host a bipartisan briefing on AI risks. House Speaker Mike Johnson said he will not rush legislation that might harm the country and put China at an edge.
What this means if you build things
The three stories point at the same gap. The EU is moving fastest and its test is functional: what your system does determines which rules apply. The UK committee wants binding rules and does not have them. The U.S. is negotiating. Voluntary commitments keep getting announced by companies whose competitors have no reason to follow them, and the Chinese government has said outright that it will not slow down.
Concrete steps for teams shipping AI products with EU exposure:
- Map your features against the DSA functional test. Live web search, retrieval, ranking, and recommendation count.
- Track your EU monthly active user numbers against the 45 million threshold. Do not wait for someone to notice publicly.
- Start systemic risk assessment work before the compliance window opens.
- Assume the AI Act and the DSA both apply and budget legal review time to reconcile them.
The four-month clock runs to January 2027. The UK committee's recommendations have no date attached. Amodei's plan has dates for Anthropic's own commitments and nothing binding for anyone else.