OpenAI will require approval for model routers and AI gateways from November 20

What OpenAI changed

OpenAI has rewritten its Usage Policies, and the change with the widest commercial reach is about who may sell access to its models rather than what people may do with them. From 20 November 2026, any service that lets third parties directly use OpenAI models, such as a model router or an AI gateway, will need OpenAI's "prior review and approval" first. The company explained the change on 21 October in a post titled Broad access through consistent standards, and the new text is already live on its Usage Policies page, which now carries the line "Effective: November 20, 2026."

The update is broader than the gateway rule. The policy's changelog says it also clarifies limits on using OpenAI models and outputs to train other models, tightens protections for children and teens, sets requirements for high-stakes uses and folds in approval requirements for national security and law enforcement work. OpenAI's Help Center summary says the previous version stays in force until 20 November, and that existing agreements, including any express permissions in them, continue to apply.

Who counts as a model router or AI gateway

The new clause sits under a heading called "Providing access to our models". It reads: "If you operate a model-access intermediary platform or other service that enables third parties to directly access OpenAI models, you must obtain our prior review and approval." OpenAI's post names "model routers or AI gateways" as examples.

That describes a fast-growing layer of the AI market. Routers and gateways let developers reach many providers' models through one account, one API key and one bill, often switching between them automatically on price or speed. OpenRouter is the best-known independent router, and cloud and developer platforms run their own gateways; Vercel's, for example, publishes a usage index of which models its customers call. OpenAI does not name any company, and none of the obvious candidates had said publicly by 22 October how the rule affects them.

The carve-out matters as much as the rule. The approval requirement "does not apply solely because an application integrates OpenAI models to power its features or functionality." A writing tool that uses GPT-6 Astra behind the scenes is not an intermediary. A service whose product is raw access to the model, passed through to its own customers, is.

Why OpenAI says it needs the rule

OpenAI frames the change as closing gaps between channels. Some safeguards are trained into a model, the post says, while "others depend on the systems and people around it," and both "need to be effective whether people access our models directly or through a partner." It cites its cyber defences as an example: models are trained to refuse harmful requests, and separate systems look for suspicious patterns across many interactions. A router that strips away account history or blends traffic from thousands of users can make that second layer much harder to run.

The company says it has spent "the past few months" aligning policies with customers and partners, and that partners which host or resell its models must "maintain safeguards consistent with our own, investigate potential violations, and take appropriate action when concerns are identified," including coordinating on enforcement. The rule arrives as OpenAI's own distribution widens: on the same day it said its frontier models and Codex are coming to Google Cloud, putting them on all three large US clouds. Writing the gateway requirement into the public policy turns what had been individual partner contracts into a rule that applies to everyone.

The training clause aimed at rival models

The second big change targets model training. The new text says users "must not use OpenAI models or their outputs to generate, prepare, select, or supply training material or signals for models that are intended as alternatives to or substitutes for OpenAI models or services." It spells out what that covers: creating training data, tasks, rubrics or reinforcement-learning environments; giving labels, scores, rankings, preferences, rewards or corrections used in training; and selecting, filtering or validating training data.

The clause applies whether someone does the work themselves, for another party or through a contractor, "even if you do not train the resulting model," and it also covers outputs from ordinary product use or evaluation that are later passed on for training. A separate line bans attempts to extract protected reasoning by unauthorised access, reverse engineering or circumventing safeguards. OpenAI justifies the rule in safety terms: "Training another model on OpenAI outputs can transfer capabilities without carrying those safeguards over."

This is the formal version of a fight already under way. Last month OpenAI said it had disrupted a distillation campaign tied to people associated with Moonshot, the developer of Kimi, and Anthropic has described its own defences against distillation. The new wording still allows "research, software development, model evaluation and benchmarking, and product development, within these boundaries," so using GPT models to grade a benchmark stays permitted; using those grades to train a competing model does not.

High-stakes automation, teens and national security

Several other changes will matter to companies building agents. "Automation of high-stakes actions in sensitive areas without human review" is now listed as a prohibited use. The policy defines that as actions, decisions, transactions or submissions that materially affect a person's rights, safety or access to essential services, in areas including critical infrastructure, education, housing, employment, credit, insurance, legal and medical matters, government services and migration. An agent that screens job applicants or approves loans on its own, with no person checking, would fall foul of it.

Tools that give tailored advice requiring a licence remain banned without a licensed professional involved, and products may not "state or imply that the AI itself holds professional credentials." National security, law enforcement and intelligence uses now need OpenAI's review and approval, under a new "OpenAI-approved use" section that lets the company grant specific partners case-by-case exceptions with written terms. The teen section adds explicit bans on exposing minors to age-inappropriate content, promoting unhealthy dieting, body-shaming and underage sexual or violent role-play.

SafetyIDs and how enforcement will work

OpenAI also announced SafetyIDs, identifiers that customers can attach to requests so the company can tell individual end users apart during an abuse investigation "without OpenAI learning those users' identities." The idea is to cut off one bad actor rather than a whole customer account. The post notes that customers can face misuse through end users, compromised accounts or leaked API keys, which has been a recurring problem for gateway-style services that hold keys for many providers at once.

The company promises enforcement "based on documented conduct and risk," applied consistently and "in proportion to the circumstances," and says it will revisit restrictions when conduct, commitments or safeguards change. It also mentions Private Safety Processing, work with customers on safeguards that keep sensitive data under their control, but gives no detail on how it works.

What builders should do before 20 November

For most developers who call OpenAI's API inside their own product, the gateway clause changes nothing on its own; the rest of the policy still applies. Two practical checklists published after the update, by OneSignalDesk and CellCog, reach the same reading. Teams that run a router, reseller or bring-your-own-model platform that passes OpenAI models through to customers should contact OpenAI before 20 November. Teams that reach OpenAI through a router should watch whether their provider is approved.

Anyone with a training or fine-tuning pipeline should audit it for GPT-generated data, rubrics, labels or synthetic evaluations, and ask whether the resulting model could be described as an alternative to OpenAI's. Products that make consequential decisions about people need a human review step before the action takes effect. Gateways have also been adding their own safety layers; OpenRouter, for instance, recently launched Armor, a classifier for risky agent tool calls, the kind of control OpenAI may now want to see in a review.

What OpenAI has not said

The policy leaves important questions open. OpenAI has not published how a router applies, how long a review takes, what safeguards it will require, or what happens on 20 November to services already offering its models without approval. It has not named any approved intermediaries. It is also unclear whether open-source gateway software that a company runs only for its own staff counts as a service for "third parties." Anthropic's 2026 Usage Policy, which takes effect on 12 November, centres on elections, deceptive campaigns and high-risk uses and contains no comparable intermediary rule.

The training clause is also hard to police from the outside. OpenAI can see API traffic, not what a customer later does with outputs, so enforcement will rely on detection systems, partner cooperation and contracts. How strictly OpenAI applies both rules in the first months will show whether this is a safety measure, a commercial lever over the routing layer, or both.