OpenAI is tightening the rules on who can resell access to its models. Updated Usage Policies dated October 21 require that services giving third parties direct access to its models — model routers and AI gateways — get OpenAI’s review and approval before offering that access. The new rules take effect on November 20, 2026, giving affected platforms roughly a month to adjust.
The change targets what OpenAI calls model-access intermediary platforms: the services sitting between developers and the underlying models. The company says it spent the past few months working with customers and partners to line up safety policies across every service that offers its models, and the updated text puts that work in writing. Partners that provide access must keep safeguards consistent with OpenAI’s own, investigate possible violations and take action when they find problems, and coordinate with OpenAI on enforcement so a restriction in one place cannot be dodged somewhere else.
The New Approval Requirement
The headline rule is simple: any service operating a model-access intermediary platform or AI gateway that lets outside parties reach OpenAI models directly must obtain prior review and approval. The rule applies equally to direct OpenAI access, hosting partners and reseller partners.
The distinction OpenAI draws is between using the model and redistributing access to it. An application that simply integrates an OpenAI model into its own features — a writing app, a support bot — is not covered by the approval requirement. A router that dispatches prompts across multiple providers, or a gateway that sells API access to OpenAI’s models as a service, is. For developers who rely on third-party gateways, the practical advice is to check whether your provider is approved before November 20, ask how it handles misuse reports, and keep a fallback plan such as direct OpenAI access.
What Else Changes On November 20
The approval rule did not arrive alone. The refresh clarifies the ban on using OpenAI models or their outputs to train alternative models: prohibited activities include preparing, selecting or supplying training data and signals for models intended to replace or compete with OpenAI, such as building training tasks, setting up reinforcement-learning environments, or providing feedback through scores or rankings. The update also prohibits extracting protected inference content through unauthorised access or reverse engineering.
Other sections clarify protections for children and teens, requirements for high-stakes uses with human review, and approval requirements for national security and law enforcement applications. OpenAI is also developing SafetyIDs, identifiers customers can provide during misuse investigations that distinguish individual end users without disclosing their identities to OpenAI. The company also points to Private Safety Processing, a program built with customers and partners that it says shows safeguards can work while giving customers more control over sensitive data.
What This Means For Developers
If you only use ChatGPT or the OpenAI API directly, little changes day to day. The bigger impact lands on teams whose infrastructure routes requests through intermediaries — a pattern that has become standard as middleware projects promised clean separation between application logic and model suppliers. Agent pipelines, which often route requests through several services at once, should pay particular attention.
The economics behind the move are straightforward. Frontier model clusters require immense capital expenditure and fixed depreciation schedules that must be amortised over billions of steady inference tokens. When an intermediary routes routine traffic to cheap open models and forwards only the hardest, most context-heavy prompts to the frontier API, the frontier provider absorbs the operational volatility. OpenAI’s answer is a single rulebook for its models, no matter whose storefront they are sold through.
Why It Matters
This is OpenAI extending its safety perimeter beyond its own platform and onto every service that sells access to its models. The enforcement design will decide how the industry reads it: a fair, consistent standard applied to every gateway, or a gatekeeper power that lets OpenAI decide which intermediaries survive. OpenAI says it will base enforcement on documented conduct and risk, apply rules consistently, and revisit restrictions if a customer’s behaviour or safeguards meaningfully change.
The move also arrives in the same week OpenAI asked California to mandate shutdown controls and audits for frontier developers — the two stories share a philosophy. Whether the lever is state law or contract terms, OpenAI is pushing the industry toward a world where safety rules follow the model wherever it runs. Developers building on ChatGPT at enterprise scale or through OpenAI’s expanding partner network should read both moves together: the compliance surface is growing, and November 20 is the first deadline.
Background
OpenAI’s usage policies have been the quiet contract governing its ecosystem since the API’s earliest days, but the intermediary economy they now target is new. Multi-provider routing matured over the past two years as engineering teams treated inference as a fungible commodity — dispatching routine summarisation to low-cost open models and falling back to frontier APIs when latency spiked or reasoning failed. The October 21 revision is the first time OpenAI has required those middlemen to get explicit permission, and it comes as the company’s models reach users through more partners than ever, including the deal that put OpenAI models on rival Google Cloud.
Source: AI Parabellum, TokenPost
0 Comments