AI, in your work.

The announcement and effective date

OpenAI announced on October 21 that routers and gateways providing direct access to its models will need prior review and approval. The measure forms part of its initiative to apply consistent safeguards across providers, as explained in its official announcement.

The Help Center note confirms that the changes take effect on November 20, 2026. The previous version applies until then. Existing agreements and other applicable terms continue to be relevant.

Which services the requirement covers

The model-access section of the Usage Policies requires prior authorization when an intermediary platform or another service enables third parties to access OpenAI models directly. It clarifies that integrating models to power an application’s features does not, by itself, trigger this requirement.

Nexo interpretation: describe what customers can do and who provides access before classifying a product by its commercial name. The following hypothetical examples help prepare that discussion; they are not OpenAI decisions about specific services.

Responsibilities for access providers

In its announcement, OpenAI also assigns partners responsibilities to maintain safeguards consistent with its own, investigate potential violations and coordinate enforcement so that restrictions remain effective across services.

Separately, sections 2.2 and 3 of the Services Agreement provide for integrating the API into applications for end users and make customers responsible for activity under their accounts. They also prohibit buying, selling or transferring API keys with third parties.

What to prepare and what remains unspecified

The announcement, policies and Help Center note reviewed do not specify an application channel, response times or transition arrangements for existing gateways. How the requirement applies to an internal gateway also needs confirmation from the provider.

For technical and product preparation, Nexo suggests:

• Prepare a diagram of users, credentials, models and access paths.
• Document safeguards, owners and responses to potential misuse.
• Request written clarification of the process, the status of an existing service and applicable conditions before committing to a launch.