1. What do the new OpenAI usage policies require?
OpenAI has revised its Usage Policies to require operators of model routers and AI gateways to obtain its review and approval before they offer third-party access to its models. The revision is dated October 21, 2026, and the new requirement takes effect on November 20, 2026, which leaves affected platforms roughly one month to prepare.
In plain terms, a platform that lets outside parties reach OpenAI models directly can no longer simply switch that access on and keep running. It must first go through a review by the company and receive explicit sign-off. Operators that already offer such access have until the effective date to get that approval in place, and those planning to launch similar services face the same checkpoint.
The rule is narrow in one important way. It is aimed at the businesses that sit in the middle of the model supply chain, not at the far larger group of companies that build products on top of OpenAI models. Understanding where the line falls is the key to judging who is affected and who can carry on as before.
Readers searching for the OpenAI usage policies will find that the practical test is whether a service hands third parties a path to the models themselves. If it does, approval comes first. If a service only uses a model internally to deliver its own product, the new gatekeeping step does not apply to it.
2. Who counts as a model-access intermediary?
The policy language focuses on what OpenAI calls model-access intermediary platforms. These are services positioned between developers and the underlying models. A developer connects to the intermediary, and the intermediary in turn connects to one or more model providers, passing requests along and returning the results.
Two product categories fit this description most clearly. A model router receives a request and decides which model should handle it, often weighing cost, response speed or the nature of the task. An AI gateway is a broader layer that can handle authentication, billing, logging, usage limits and routing for many models behind a single interface. Both are popular with development teams that want to avoid being tied to a single provider.
Multi-provider routing is the feature that makes these platforms attractive. One platform can direct a simple request to an inexpensive model and send a demanding one to a more capable model, all without the developer rewriting any code. In the period leading up to the revision, several gateways and routers have been adding this kind of routing along with safety measures of their own, which is the market context in which the new approval step arrives.
The revised policy states that these platforms need OpenAI's explicit approval when they allow outside parties to access its models directly. That wording places the emphasis on the act of providing access, rather than on the technology used to provide it.
Part of the appeal of an intermediary is that it hides complexity. A team can write against one interface, swap providers as prices or performance change, and keep a single invoice. The same convenience is what makes oversight harder for a model provider, since requests arrive bundled together under the intermediary's name rather than under the name of each underlying customer.
3. Which applications are not covered?
Applications that merely use OpenAI models to power their own features are outside the approval requirement. A customer-support tool that calls a model to draft replies, a coding assistant that uses a model to suggest edits, or a writing product that generates text for its users all fall on the exempt side of the line.
The distinction can be framed as using a model versus redistributing access to it. A company that integrates a model into a product is a customer of the model provider. A company that packages access to the model so that others can call it is behaving more like a reseller, and it is this second activity that now requires clearance.
For the majority of developers, the practical change may therefore be small. Teams that connect directly to OpenAI, or that build their own features on top of its models, are not asked to do anything new under this particular rule. The burden falls mainly on the operators of the intermediary platforms themselves, who face a review they did not need before.
Companies sitting near the boundary will want to read their own arrangements carefully. A product that exposes model access to outside parties as a feature, even if it is not the main business, may look more like redistribution than use. The clearest safe harbor is a product whose users interact only with the finished feature and never receive a route to the model itself.
4. A wider overhaul of the policies
The gateway requirement is only one part of a broader refresh of the Usage Policies published in the October 21 revision. The same update clarifies the rules on using OpenAI outputs to train other models, a subject that matters to developers who generate data from one model to improve another.
Other sections touched by the refresh deal with the protection of minors, restrictions on high-stakes uses, and national-security requirements. These provisions appear alongside the new approval requirement in the revised document, and together they show a company tightening how its technology may be accessed and applied, rather than adjusting a single clause.
Reading the changes as a package helps explain the gateway rule. Several of the themes in the refresh, including safeguards for younger users and limits on sensitive applications, depend on knowing who is actually using a model. Rules of that kind are straightforward to apply when a company deals with a developer directly. They become harder when another business stands in between.
Taken together, the revisions point in a consistent direction: clearer expectations for the people who build on the models, and a more defined role for the businesses that pass access along. The October 21 date marks when those expectations were published, while November 20 marks when the gateway-specific rule begins to bind.
5. Why did gateways become a policy question?
Gateways became a policy question because they change who OpenAI can see and hold accountable. With a direct connection, OpenAI knows the developer behind an account and can enforce its terms against that account if something goes wrong.
Through a gateway, the end user is one step further away. The gateway becomes a middleman with its own customers, and each of those customers may in turn serve their own users. Enforcing protections for minors, limits on high-stakes uses and national-security requirements is harder in that arrangement, because each of those rules depends on understanding who the end user is and what they are trying to do.
An approval process gives the company a checkpoint. Before a platform is allowed to resell access, OpenAI can review how it operates and what controls it has in place. That does not eliminate the distance between the model provider and the end user, but it creates a moment at which the provider can ask questions and set expectations.
The approach is also a familiar one in technology and finance. Companies that supply a core service commonly require downstream partners to meet standards before they can offer that service to others, since responsibility for misuse does not disappear simply because a business has been added to the chain.
Accountability is the underlying theme. When a request passes through several hands, a problem can be difficult to trace to its origin. Requiring approval up front is one way for a provider to reduce that uncertainty, because it learns which businesses operate as intermediaries and can set conditions for them before access is offered rather than after an incident.
6. What does this mean for developers and intermediaries?
The most direct impact falls on gateway and router operators. They now have a deadline of November 20, 2026, and a process they need to complete. Platforms in this position will need to decide whether they can satisfy OpenAI's review, how long it may take, and what they will tell customers while it is under way.
Developers who reach OpenAI models through third-party gateways have a reason to pay attention to their provider. If a gateway has not obtained approval by the effective date, access that runs through it could be disrupted. That makes it sensible to ask any intermediary about its approval status well before the deadline, and to consider whether a backup route to the models is worth having.
Operators weighing their next steps have a short list of practical questions: whether their service qualifies as an intermediary under the policy wording, what information a review is likely to involve, and how to communicate the timeline to customers who depend on uninterrupted access. Customers, for their part, can ask the same operators where they stand.
Developers who connect straight to OpenAI, or who simply embed its models in their own products, are in a different position. The policy as described does not ask them to seek approval, and their access should not be affected by this rule.
More broadly, the change is a reminder that the ecosystem of tools around large language models depends on the terms set by the companies that build the models. Convenience layers such as routers and gateways exist because developers want flexibility, but they operate within permissions that can be revised.
7. What happens next?
The next fixed date is November 20, 2026, when the approval requirement takes effect. By then, operators of model routers and AI gateways that offer direct access to OpenAI models are expected to have completed the review process and received explicit sign-off.
The policy changes that were announced on October 21 leave several practical questions that will become clearer as the deadline approaches, including how many intermediaries seek approval and how the process works in practice. Those details were not part of the revision as described, and they will shape how disruptive the change turns out to be.
For now, the message to the market is simple. Anyone offering a gateway to OpenAI models has about a month to get approved, and anyone relying on such a gateway has about a month to find out whether it will be.