OpenAI has updated its usage policy, and the new version takes effect on November 20. The biggest change targets neither content nor behavior but the channel of access: services such as model routers and AI gateways that directly offer third parties access to OpenAI models must be reviewed and approved by OpenAI before they launch.
Apps that simply call OpenAI models inside their own product features fall outside this approval requirement. According to the clause as quoted in media reports, the approval applies to platforms that “need prior review and approval before offering third-party access to OpenAI's models.” The line is drawn between using the models and reselling access to them.
Obligations for hosts and resellers
The new policy holds partners that host or resell OpenAI models to the same standard: safeguards must be consistent with OpenAI's own, potential violations must be investigated, and enforcement must be coordinated with OpenAI. OpenAI's stated reasoning is that a user restricted on one service should not be able to get around the restriction by switching to another channel.
A mechanism called SafetyIDs comes with it. OpenAI says it is working with customers to introduce these identifiers, which let abuse investigations tell individual end users apart without giving OpenAI access to those users' real identities. Some reports note that SafetyIDs is still being rolled out and is not yet fully available.
The revision also touches several other areas: it clarifies the rules on using OpenAI outputs to train other models, and updates requirements on protecting minors, restrictions on high-risk uses, and national security. For the exact wording of these sections, most secondhand coverage gives only headlines, so the details should be checked against OpenAI's policy page.
What has not been disclosed
Little is known about the approval process itself. OpenAI has not yet said which routers and gateways have been approved, how long a review takes, what the criteria are, or what happens to platforms that fail. With less than a month until the policy takes effect, it is unclear whether existing platforms can finish the review in time.
Over the past year, a number of AI gateway and router platforms have launched multi-provider routing, where a single entry point distributes requests to models from different vendors based on cost, speed or task type. By singling out this category of platform, OpenAI appears, judging by how the terms are written, to want visibility into who is using its models through someone else.
What it means for developers in China
Since July 2024, OpenAI's API has not been available in mainland China and other regions outside its supported list. A common way for developers in China to call GPT-series models is through overseas aggregation platforms or various relay services.
Under the new rules, platforms along this chain are likely to split into two groups. Larger routers and gateways with a formal relationship with OpenAI will most likely apply for approval and pass end-user identification information upstream as required. Relay services with no formal relationship, which stitch together quota from multiple accounts, already sit in a gray area of the terms and face a higher risk of being identified and banned after the effective date.
For teams already using an aggregation platform, there are two things worth doing now: ask whether the platform you use has applied for OpenAI's approval, and abstract your call layer so you keep the option of switching to other models or going direct through a cloud provider's channel. OpenAI's models are also being distributed through cloud platforms, for example the previously announced Google Cloud model garden partnership. OpenAI has not separately explained how the new rules affect such channels.
Sources: OpenAI official blog, Crypto Briefing, CocoLoop, PANews. The effective date, scope of approval and partner obligations follow OpenAI's announcement; the rollout status of SafetyIDs follows media reports.