OpenAI will require approval for model routers and AI gateways from 20 November

OpenAI is changing the usage policies for its models from 20 November 2026. Services that provide direct access to OpenAI models, such as model routers and AI gateways, will then need OpenAI's review and approval before offering that access. The company says so in a post published on 21 October 2026, listed in OpenAI's news feed at 23:00 Oslo time.

For organisations that reach OpenAI models through an intermediary service rather than directly from OpenAI, the provider's standing with OpenAI becomes a new item to check before the deadline.

What OpenAI is changing

OpenAI writes that it has spent recent months working with customers and partners to align safety policies across the services that provide its models. According to OpenAI, the policies apply whether the models are accessed directly through OpenAI, through partners that host them, or through reseller partners.

Partners that provide access to OpenAI models must maintain safeguards consistent with OpenAI's own. They must investigate potential violations, take action when concerns are identified, and coordinate enforcement with OpenAI, so that a restriction at one service cannot be bypassed at another.

The updated usage policies take effect on 20 November 2026. OpenAI says they will clarify the rules for safe model development and sensitive uses of AI. The concrete new requirement in the post is the approval obligation for services that provide direct access, with model routers and AI gateways given as examples.

What the post does not say

The post does not describe how approval works, how long it takes, or what happens to services that are not approved by 20 November. It names no routers or gateways, and it does not say whether internal gateways that an organisation runs for its own staff fall under the requirement. The full policy text is not reproduced in the post.

Whether a specific provider is affected is therefore not stated in this source. That needs to be clarified with the provider and in the updated usage policies once they are available.

SafetyIDs and enforcement

OpenAI is also introducing SafetyIDs with customers. A customer can provide such an ID to help OpenAI distinguish between individual end users during a misuse investigation, without OpenAI learning who those users are. The company says the aim is to respond more precisely and cause less disruption to others.

OpenAI notes that misuse can come from a customer's end users, compromised accounts or leaked API keys. The company says enforcement will be based on documented conduct and risk, and that restrictions will be revisited if circumstances change. OpenAI also cites Private Safety Processing as an example of safeguards that give customers more control over sensitive data.

What it means for organisations

Hogby.ai's assessment is that the change is mainly about supplier dependency. If you use a model router, an AI gateway or a reseller to reach OpenAI models, ask the provider whether it has applied for or received approval, and what the plan is if approval is not in place by 20 November.

If you run your own gateway in front of the OpenAI API, this source leaves it open whether the requirement applies to you. That is worth settling before the deadline, not after.

SafetyIDs are worth a look for services with many end users. Without a way to tell users apart, one user's misuse could in the worst case affect the whole integration. Leaked API keys are a known risk that OpenAI itself points to, so key management belongs in the same review.

Sources and media

• OpenAI: Broad access through consistent standards, published 21 October 2026, listed in OpenAI's news feed at 23:00 Oslo time. The source was checked on 22 October 2026.

Illustration: AI-generated with Grok Bot / hogby.ai