OpenAI's updated Usage Policies take effect on November 20, 2026, announced on October 21, 2026 in the official blog post "Broad access through consistent standards" and a Help Center notice. The main target is not ordinary users but services that resell model access: model routers, AI gateways and similar intermediaries that provide direct access to OpenAI models will need OpenAI's review and approval before offering that access.
The boundary first: platform terms, not a national law
This update is a platform policy, not government legislation, and it applies regardless of country: access directly through OpenAI, through partners that host its models, or through reseller partners is governed by the same policies. It sits alongside national and regional AI laws rather than replacing them — passing OpenAI's bar does not by itself satisfy local data, privacy or sector rules. Until November 20, the current version remains in force, and existing agreements, including permissions expressly granted in them, continue to apply.
Who needs approval: services selling access itself
Prior review and approval will be required for services that provide direct access to the models; OpenAI names model routers and AI gateways. What they share is that they do not build the end product themselves — they distribute model access to downstream customers. A rough dividing line: if you use models to power your own product's features, you are a customer; if you resell or redistribute access itself as the product, you are an intermediary in scope. Every partner providing access to OpenAI models must also do three things: maintain safeguards consistent with OpenAI's own, actively investigate potential violations and act when concerns are identified, and coordinate enforcement with OpenAI so a restricted user cannot simply switch providers to get around a restriction. Each partner's implementation must meet or exceed OpenAI's own standards.
Three more clarifications regular API users should check
The other three changes listed in the Help Center reach further than the intermediary rule. First, the restriction on using OpenAI models or their outputs to train competing models intended as alternatives to or substitutes for OpenAI models or services has been clarified. Second, protections for children and teens and the requirements for high-stakes uses have been spelled out in more detail, so teams embedding models in products need to check their own setups. Third, national security principles have been formally incorporated, with approval requirements for national security and law enforcement uses. None of these makes headlines like a new approval gate, but they decide whether a specific use counts as a violation.
SafetyIDs are not live yet — do not build plans on them
The announcement also describes SafetyIDs, a mechanism still being developed with customers: customers supply these identifiers so OpenAI can distinguish individual end users during an abuse investigation without learning who those users are. When abuse comes through a compromised account or a leaked API key, action can be targeted at one person instead of disrupting everyone under the same customer account. OpenAI is explicit that this is work in progress, not a generally available feature, so for now it belongs on the roadmap — your own account controls and logging still have to do the job. On enforcement, OpenAI says restriction decisions rest on documented conduct and risk, are applied consistently, and are proportionate to the circumstances; when conduct, commitments or safeguards improve meaningfully, restrictions are revisited. In practice, your records and remediation history become your appeal file.
This is not an isolated move. In the same month, Anthropic updated the Claude usage policies, detailing boundaries for weapons software and surveillance, with the new version taking effect on November 12; in the EU, the first AI Act enforcement step sent formal information requests to OpenAI and Anthropic. Regulators are writing letters while platforms tighten their own distribution gates, and usage policies are turning from fine print into a real compliance checkpoint. Intermediaries should confirm before November 20 whether they fall in scope and engage early; regular developers should check their uses against the three clarifications — both are cheaper than fixing things after a restriction notice arrives.
