OpenAI will require approval for model routers and AI gateways from November 20

OpenAI is adding a rule that requires services to get approval before they let other people access its models directly. In an announcement on October 21, the company named model routers and AI gateways as examples of services covered by the rule. The updated Usage Policies take effect on November 20, 2026. This is an announced change that will take effect in the future. It does not mean that OpenAI has already reviewed every gateway.

The policy itself says that companies running platforms that connect people directly to OpenAI models, or other services that provide this kind of direct access, must have OpenAI review and approve them. Neither document gives a public list of approved gateways, says how long reviews will take, or explains exactly how to apply. A service not named in the announcement should not automatically be treated as approved or unapproved.

The updated policy clearly says that a product does not need this approval just because it uses OpenAI models to run its own features. This helps developers understand that not every product with AI is a service that resells direct access to a model.

For a product team, the key question is what its service lets customers do. An app that uses AI to provide a feature is different from a service that gives customers direct access to a model. The policy does not give a complete test for every business that does both. Teams offering both kinds of service need to check how the rule applies to their actual products and use OpenAI's review process to clarify any doubts. Simply calling a gateway an app does not answer the question of what users can actually access.

OpenAI says the approval rule is part of a wider effort to make safety rules consistent across its own services, partners that host its models, and reseller partners. The company says its partners must maintain safety protections that match its own, look into possible rule-breaking, and work together on enforcement so that restrictions remain effective across different services.

For customers, this means they should not assume that using a different way to access a model removes the provider's safety rules. Different services may still offer different models, business terms, and ways to connect the technology to other products. But this announcement makes consistent safety protections an explicit goal for how OpenAI distributes its models. The policy change comes as access through partners expands, including OpenAI models becoming available in Google Cloud's Model Garden.

OpenAI also describes its work with customers on SafetyIDs. The company says customers can share these identifiers to help identify individual users during an investigation without telling OpenAI who those people are. The aim is to avoid disrupting other users unnecessarily. This is OpenAI's description of how the system works and what it is meant to achieve. The announcement does not independently prove its privacy protections or show how well enforcement works in practice.

The company says misuse can involve individual users, accounts that have been taken over, or API keys that have been leaked. It also says enforcement decisions are based on documented behavior and risk. Restrictions may be reviewed again when meaningful changes address the concerns behind them. These statements describe OpenAI's intended approach, not a guarantee about the outcome of any particular investigation.

Companies that offer direct access to OpenAI models have a clear date to prepare for. They should work out which parts of their services fall under the direct-access rule, ask OpenAI to confirm which approval process applies, and keep a record of the answer alongside their arrangements for giving customers access. Customers who use an intermediary service can ask its provider how it plans to handle the change.

The next useful information would include instructions for applying, messages confirming approval status, and explanations of how the rule applies to products that combine their own features with direct model access. Until those details are available, the announcement gives companies a policy deadline to check, but it does not prove that any specific provider lacks approval. The policy that takes effect on November 20 is the main source for understanding the rule and its exception.

Figure by OpenTools Team; no third-party expressive material used. Original explanatory figure based on the linked OpenAI policy documents.