OpenAI announced on October 21, 2026 that it has worked with customers and partners over recent months to align safety policies across the services that provide its models, and is updating its Usage Policies effective November 20, 2026. According to OpenAI, the policies apply whether people access its models directly, through partners that host them, or through reseller partners. The company says partners must maintain safeguards consistent with its own, investigate potential violations, and coordinate on enforcement so restrictions remain effective across services. The updated Usage Policies will require services offering direct access to OpenAI models, such as model routers or AI gateways, to obtain OpenAI's review and approval before offering access. OpenAI states that before deploying a model it evaluates capabilities and risks, trains the model to follow safety requirements, and tests whether safeguards hold up against deliberate bypass attempts, and that it monitors for abuse after deployment. The announcement references GPT-6 Astra as an example of expanding capabilities. OpenAI also describes 'Private Safety Processing' and 'SafetyIDs,' which it says allow customers to help distinguish individual end users in an investigation without OpenAI learning those users' identities. The company says enforcement decisions are based on documented conduct and risk.
- Updated Usage Policies take effect November 20, 2026
- Policies apply to direct access, hosting partners, and reseller partners
- Model routers and AI gateways must get OpenAI review and approval before offering access
- OpenAI introduces SafetyIDs and references Private Safety Processing and GPT-6 Astra
What it means for you
If your organization uses OpenAI models through a third party — a model router, an AI gateway, a reseller, or a cloud host rather than OpenAI directly — the rules of the road are being standardized across all those routes, effective November 20. In plain terms: the same safety requirements and enforcement now follow the model wherever you access it, and some middleman services will need OpenAI's approval to keep operating. For most teams this is background housekeeping, not a fire drill, but it's worth knowing which door you're actually using to reach these models.
Try this
Spend ten minutes confirming how your team actually accesses OpenAI models — directly, through a cloud provider, or through a reseller or gateway — and note it down. Knowing your real path matters if a provider's status changes.
Who should care
Whoever owns your AI vendor relationships or developer tooling, and anyone relying on a third-party gateway, router, or reseller rather than OpenAI directly.
Skip this if
You don't use OpenAI models, or you access them directly from OpenAI and already follow their usage policies — nothing here requires action from you.
Sources: OpenAI — read the original