ChatGPT classified as a very large platform under the Digital Services Act, an agentic AI capable of autonomously managing an office, browsers built for autonomous agents: the week of September 1, 2026, concentrates announcements that reshape the power dynamics between regulators, publishers, and AI providers. We review three topics that deserve a technical reading.
ChatGPT designated very large platform by the European Commission
The European Commission has placed ChatGPT under the very large platform regime of the DSA, alongside Reddit and Roblox. The decision, communicated between August 31 and September 2, 2026, is based on the declarations of monthly active users in the European Union provided by OpenAI.
OpenAI will have to conduct audits of systemic risks, publish information on the algorithmic functioning of its service, and enhance protections for minors. The framework of obligations applied is the same that already governs the largest digital platforms operating in the EU.
We regularly relay this type of decision among the news on Web United, and this one constitutes a notable precedent. A conversational AI service is subjected to a level of responsibility comparable to that of a search engine or a social network. For website publishers, the consequence affects the capture of editorial traffic and the negotiating power of rights holders in the face of AI-generated responses.
Reddit and Roblox, designated in the same wave, are subject to the same requirements for managing systemic risks. European regulatory pressure on American platforms continues to intensify.
Agentic AI: models that manage a workstation
Recent models are now capable of using a computer autonomously: navigating graphical interfaces, filling out forms, chaining tasks without human intervention. The transition from prototype to operational deployment is accelerating significantly this week.
Cybersecurity risks posed by AI agents
The F-Alert bulletin for September 2026, published by F-Secure, targets a specific threat. Models capable of identifying and exploiting vulnerabilities at a speed beyond the reach of human teams are profoundly changing the work of SOCs.
The convergence between agentic capabilities and misaligned behaviors poses a concrete technical governance problem, not just an ethical one.
- AI agents manipulate user interfaces end-to-end, without an intermediate API. The attack surface on workstations is significantly widened.
- Any company deploying AI agents in production must audit the system permissions granted to these agents, just like a traditional service account.
- F-Secure recommends treating AI agents as potential intrusion vectors in internal security policies.
AI browsers and DMA: two signals to watch closely
Browsing environments specifically designed for AI agents are beginning to emerge. The principle: to provide a structured framework allowing autonomous agents to perform web tasks (scraping, filling out forms, interacting with front-end APIs) without resorting to usual workarounds.
If an increasing share of visits comes from agents rather than humans, traditional audience metrics lose their relevance. The integration of web tasks directly into the browser for the benefit of agents redistributes the cards of measurement and traffic monetization.
DMA: the Commission’s discretionary power confirmed
The EU court rejected, on September 2, 2026, Opera’s challenge against Microsoft Edge’s exemption from gatekeeper status under the Digital Markets Act. The decision confirms that the Commission retains a wide margin of discretion to determine which services fall under the most stringent regulation.
For web publishers and developers of alternative browsers, the case law is settling: contesting a DMA decision from the Commission will be challenging, even when the exemption of a direct competitor seems questionable.
Digital sovereignty and mastery of silicon
The issue of semiconductor manufacturing remains at the heart of sovereignty challenges in AI. The mastery of silicon conditions the ability of European players to maintain control over their value chains, and this mastery is negotiated close to the foundries.
This week in September 2026 outlines three lines of force. European regulation is catching up with AI services at the same pace as social networks. AI agents are leaving the lab for production environments, with security implications that SOCs must integrate without delay.
The decisions made this week regarding the DSA and DMA will have concrete effects on how websites interact with AI platforms in the coming months.