OpenAI is tightening control over how its models reach developers through third parties. In a post published on October 21, 2026, the company said it has spent recent months working with customers and partners to align safety policies across every service that provides its models, and that it is updating its Usage Policies to make those requirements explicit. The new policies take effect on November 20, 2026.
The most concrete change targets intermediaries. Under the updated Usage Policies, services that give direct access to OpenAI models, which the company describes as model routers or AI gateways, will need OpenAI's review and approval before offering that access. These services typically let developers reach many providers' models through a single interface, so the rule brings a fast-growing layer of the AI stack under OpenAI's direct oversight.
The policy also extends to hosts and resellers. OpenAI says its rules now apply whether people use its models directly, through partners that host them, or through reseller partners. Those partners must keep safeguards consistent with OpenAI's own, investigate potential violations and act when concerns arise, and must coordinate on enforcement so that a restriction imposed in one place cannot simply be bypassed by switching to another service. OpenAI says it is working with each partner to make sure its implementation meets or exceeds the company's safety standards.
OpenAI frames the move as a response to growing model capability, citing GPT-6 Astra as an example of models that widen what developers can build. It describes a layered approach: evaluating risks before deployment, training models to refuse harmful requests, monitoring for abuse afterwards, and using trusted access programs that set eligibility conditions for its most powerful capabilities, with cyber misuse given as one area of focus. Some of those safeguards live inside the model, the company notes, while others depend on the systems around it, which is why it wants them to hold regardless of the access route. The announcement came on the same day OpenAI said its models were coming to Google Cloud, a reminder of how many channels now carry its technology.
Two tools are meant to make enforcement more precise. OpenAI points to its work on Private Safety Processing as a way to apply safeguards while giving customers more control over sensitive data, and it is introducing SafetyIDs, identifiers that customers can supply so OpenAI can tell individual end users apart during an investigation without learning who they are. The company says this should let it respond to misuse more narrowly and disrupt fewer legitimate users. It also promises to base enforcement on documented conduct and risk, act proportionately, and revisit restrictions when conduct or safeguards change.
Several questions remain unanswered. OpenAI has not published the approval criteria for routers and gateways, a timeline for reviewing existing services, or what happens to services that are not approved by November 20. It also has not said which partners have already aligned their safeguards. Those details will determine whether the policy mainly closes enforcement gaps or also reshapes competition among the platforms that resell access to frontier models.