Twenty-one names on the register, and neither of them is there
Open the European Commission register of designated services on 30 July and you count twenty-one names. Amazon Store, the Apple App Store, Booking.com, LinkedIn, Facebook, Instagram, WhatsApp, Pinterest, Snapchat, TikTok, Temu, Shein, Wikipedia, X, YouTube, Zalando. Two search engines only: Google Search and Bing. Neither ChatGPT nor Roblox is on the list.
Bloomberg reported on 29 July that this is about to change, and that the Commission will designate both as very large online platforms as soon as August. Nothing has been signed. The register is still the register.
Why it matters: designation is not a mood or a warning. It is a dated administrative act that starts a clock, and the register is where you can see it happen without waiting for a press release.
The trigger is a headcount, not a capability
The Digital Services Act sets one number and builds everything on it. A service with 45 million average monthly active recipients in the European Union is very large, and the law itself describes that figure as 10 percent of the population of the Union. Providers count their own users and publish the total.
OpenAI publishes 120.4 million average monthly recipients in the EU for ChatGPT search. Roblox publishes about 48 million for the six months ending 13 February 2026. Both numbers were put out by the companies themselves, because the Act requires it.
The consequence: no capability test was applied to either product, and no model was evaluated. ChatGPT is entering Europe's platform regime by arithmetic, under a content law drafted before chatbots mattered to anyone.
Three million users is the entire margin
Roblox sits about three million above the line. That is a margin of roughly six percent on a threshold it will not be crossing back over, and it would make Roblox the first gaming platform pulled into the category.
The threshold is easier to feel at national scale. The Union has around 450 million people, so 45 million is one European in ten. The United Kingdom, with about 69 million people, sits outside the Digital Services Act entirely and runs its own Online Safety Act instead, which is a separate filing and a separate regulator.
Yes, but: the count runs service by service, not company by company. A vendor can operate one designated product and three undesignated ones, and the obligations follow the product you actually bought.
What arrives four months after the letter
Designation is a notification, and the heavy obligations apply four months after it lands. The first systemic risk assessment falls due inside that same four-month window, which is why the letter matters more than the announcement.
After that the service carries an annual cycle: risk mitigation measures, an independent audit every year, data access for vetted researchers, transparency on recommender systems with an option that is not based on profiling, a crisis response mechanism, and an annual supervisory fee. For designated services the Commission supervises directly rather than leaving it to a national coordinator.
On 2 August 2026, three days from now, the AI Act adds its own layer: the Article 50 transparency duties become enforceable and the Commission gains its general-purpose AI toolkit, including information requests, model access and recall powers, with fines reaching 15 million euros or 3 percent of worldwide annual turnover.
What to put in the vendor file before autumn
List every AI service running in production, then find each one's published European user number. Anything within sight of 45 million should be planned for now, because the four-month clock starts without consulting your roadmap.
Then ask each vendor in writing what changes for European users after designation. Audits and risk assessments do not stay in the compliance department: they change what gets logged, what the model refuses, which defaults ship in the EU, and how quickly any of it moves.
The bottom line: a contract written against a United States product specification does not describe a supervised European one. The gap between those two documents is the thing to close this quarter.
Read next: Brussels Called the Audit Weak and Approved It | OpenAI Paid You Back in the Thing That Broke
