OpenAI Revises Its Usage Policies Effective November 20 - Intermediary Services Offering Direct Model Access Will Need Prior Review and Approval

On October 21, 2026, OpenAI published a revised version of its Usage Policies. The new text takes effect on November 20. Under it, any “model-access intermediary” platform or service that lets third parties reach OpenAI models directly must first be reviewed and approved by OpenAI ². In a blog post the same day, OpenAI named model routers and AI gateways as examples of what it has in mind ¹.

There is a second pillar. A new section prohibits using OpenAI’s models, or what they output, to create, choose, or hand over training material for models meant to replace OpenAI’s own models or services. Neither item appears in the current version that took effect on October 29, 2025 ³. Gateway operators, and teams that produce evaluation or training data, have something to check.

Prior approval for intermediaries, with app integrations excluded

The relevant passage is an item titled “Providing access to our models.” Anyone who runs a platform acting as a model-access intermediary, or another service through which third parties can call OpenAI models directly, has to get OpenAI’s review and approval beforehand ².

The same item also draws a boundary. Building OpenAI models into an application to power that application’s own features does not, by itself, trigger the requirement. What the text targets is a service that opens up direct access to OpenAI models for third parties.

The item sits as an example inside a newly added section called “OpenAI-approved use.” That section says OpenAI may, case by case, let individual partners do things the policies would otherwise prohibit, after looking at who the partner is, the intended use, the safeguards in place, and what compliance commitments the partner has made. Written terms may be required, and any approval covers only the specific partner, use, and conditions ².

In the blog post ¹, OpenAI says that over recent months it has worked with partners and customers to bring safety policies into line among the services through which its models are offered. According to OpenAI, those policies cover people who use OpenAI directly as well as those who go through partners that host the models or resell access, and they ask partners to keep safeguards consistent with OpenAI’s, look into possible violations, act when concerns are confirmed, and coordinate on enforcement. On October 21, OpenAI also announced plans to offer its models in Google Cloud’s model garden, adding another route to its models.

A section on using outputs to train other models

The other pillar is a new section titled “Training and developing models.” It opens with OpenAI’s reasoning: if another model learns from OpenAI outputs, capabilities can move over while the safeguards stay behind. The section then bars using OpenAI’s models, or what they output, to create, ready, pick, or provide data or signals that train models designed to stand in for OpenAI’s own models or services ². It lists three kinds of covered activity:

• Building training datasets, training tasks, rubrics, or RL environments
• Giving feedback that is used in training, such as scores, labels, preferences, rankings, corrections, or rewards
• Picking, screening, or checking trajectories, tasks, or training data

The scope is broad. The restriction applies whether someone does this work personally, on behalf of another party, or via an agent, and it applies even when that person never trains the resulting model. It also covers outputs obtained by using or evaluating a product that are later passed on or used for such training. Separately, the section prohibits attempts to extract protected reasoning by means of reverse engineering, unauthorized access, or bypassing safeguards ².

The section also states that, within these limits, OpenAI models may be used for research, building software, evaluating and benchmarking models, and developing products. Uses that an agreement with OpenAI expressly allows, including a “Permitted Exception” in the Services Agreement, are not prohibited by these restrictions ².

The current Usage Policies have no section on training. In the changelog of the revised version, however, OpenAI describes the change as a clarification of the limits on training other models with its models and outputs ². Whether documents other than the Usage Policies, such as terms of use or contracts, contain similar provisions is something each organization needs to check against its own agreements.

Measures against distillation, where a competitor trains on another company’s model outputs, have also come to the fore elsewhere. In its September threat report, Anthropic reported that it had identified distillation attacks by seven labs based in China (our coverage). In October it also published the effects and side effects of its distillation defenses.

Rewrites on high-stakes uses, minors, and national security

Comparing the revised text with the current version shows further changes beyond those two items ²³.

• High-stakes uses: The wording of what may not be automated without human review changes from high-stakes “decisions” to high-stakes “actions.” The revised text defines these as covering decisions, actions, submissions, transactions, and the like that have a significant effect on someone’s rights, safety, or ability to obtain essential services, among other interests, and lists areas such as housing, employment, education, medical, legal, insurance, credit, critical infrastructure, and migration
• Advice for which a license is needed: The current version is aimed at providing such tailored advice. The revised version instead targets whoever builds or offers an AI tool that gives others this kind of advice unless a licensed professional is suitably involved. It also prohibits claiming or suggesting that the AI has professional qualifications or authorization
• Minors: The “Keep minors safe” section becomes “Keep young people safe,” and its prohibitions are reorganized into two items: sexual abuse and exploitation of children, and teens’ use of the services
• National security: Law enforcement is now named alongside national security and intelligence among the uses that require OpenAI’s review and approval

According to the changelog, the revision incorporates the national security principles OpenAI already had and establishes approval conditions both for law enforcement and national security uses and for model-access intermediaries ².

No application process or grace period described

Much is left unsaid. Neither the blog post nor the revised Usage Policies describe how to apply for review and approval, how long review takes, or which services have been approved ¹². Nothing indicates how intermediary services without approval on November 20 will be treated, or whether there is a grace period.

No existing service is named either. We have previously written about model gateway layers such as OpenRouter, but the published materials do not say whether such services have already been approved or are about to start the process.

The blog post ¹ also mentions other efforts. OpenAI says abuse can reach customers via their end users, via hijacked accounts, or via API keys that have leaked. It says it is rolling out, together with customers, “SafetyIDs” supplied by those customers, so that OpenAI can tell individual end users apart during an investigation without learning who they are. OpenAI also says that when it restricts access, it reconsiders the restriction if behavior, commitments, or safeguards change in a meaningful way.

What to check before the effective date

Three groups are likely to be affected in practice.

The first is operators that offer OpenAI models to other companies or outside users in the form of a router or gateway. Because prior review and approval becomes a requirement from November 20, they will need to confirm the procedure with OpenAI.

The second is companies that use OpenAI models through such gateways. For now, public information does not show whether a given route has been approved. Asking the provider how it is handling the revision is the reliable option.

The third is teams that use OpenAI models to produce evaluation data, rubrics, labels, or training data. As written, if their output ends up training a model, in-house or elsewhere, that is meant as an alternative to OpenAI, they may be in violation even if they never train anything themselves. Evaluation and benchmarking as such are permitted, so it is worth confirming where the data will ultimately be used at the contract stage of any outsourced work.

Sources

1. Broad access through consistent standards - OpenAI official blog (October 21, 2026)
2. Usage policies - OpenAI Usage Policies (revised version, effective November 20, 2026)
3. Usage policies (October 29, 2025 version) - OpenAI Usage Policies (current version)