Many developers do not call OpenAI directly. They go through a model router or AI gateway that sends each request to whichever provider is cheapest, fastest or still online, or through a cloud host or reseller. OpenAI is now tightening the rules for that whole layer. Under updated Usage Policies taking effect on 20 November 2026, services that give direct access to its models, such as routers and gateways, will need OpenAI's review and approval before they can offer them.
The change sits inside a broader effort to make safeguards consistent wherever OpenAI's models are sold. OpenAI says it has spent months aligning safety policies with partners, and that anyone hosting or reselling its models must keep safeguards consistent with its own, investigate possible violations, act when problems are found and coordinate on enforcement so that a restriction imposed in one place cannot be dodged in another. The motivation is clear from its other recent work: as models such as GPT-6 Astra gain cyber capabilities, a safeguard that only applies on OpenAI's own API is easy to route around.
It is also introducing SafetyIDs. Customers can attach an identifier to each of their end users, which lets OpenAI tell those users apart during an investigation without learning who they are. In principle that means one abusive user of a large app can be cut off without the whole app losing access, which is a real improvement for businesses that serve the public. OpenAI says enforcement will rest on documented conduct and risk, be proportionate, and that restrictions will be revisited when circumstances change.
For developers, the practical step is simple: if you rely on a gateway or router for OpenAI models, check whether it has approval, or is seeking it, before 20 November 2026. Services we review, such as the OpenAI API itself, are unaffected; it is the intermediaries that carry the new obligation.
The trade-off is control. Routers exist partly to give developers choice and failover across providers, and requiring OpenAI's sign-off makes it a gatekeeper over that layer. The announcement does not publish the approval criteria, a timeline for decisions or what happens to services still under review on the deadline. Nor does it say whether the same rules will apply to OpenAI's own cloud partners in the same way. Until those details are public, smaller gateway operators carry most of the uncertainty.