OpenAI tells model hosts to match its safeguards and sets a November policy date

OpenAI published a policy update on October 21, 2026 that tries to keep its safety rules in place when people use its models outside OpenAI’s own products.

In “Broad access through consistent standards”, the company said it has spent recent months aligning safety policies with customers and partners that provide its models. It is also updating its usage policies, effective November 20, 2026, “to clarify the rules for safe model development and sensitive uses of AI.” The post names models such as GPT-6 Astra as an example of systems that expand what developers can build, and says safeguards have to stay effective as those capabilities grow. It does not describe GPT-6 Astra any further.

What OpenAI says it already does

Before a deployment, OpenAI said it evaluates capabilities and risks, trains the model to follow safety requirements, and tests whether safeguards hold when people try to bypass them. After deployment, it said it monitors for abuse and investigates concerns. On cyber misuse, the post says the company trains models to refuse harmful requests and uses systems that look for suspicious patterns across interactions. Trusted-access programs are another layer, with eligibility rules for the most powerful capabilities.

OpenAI draws a distinction that matters for the partner rules: some safeguards sit in the model, and others depend on the systems and people around it. Both, it said, have to work whether the person is using OpenAI directly or a partner.

What partners have to do

The company said developers should be able to choose where they access a model and still meet one safety standard. It said it wrote policies to align safeguards across providers and is working with each partner so the partner’s implementation meets or exceeds OpenAI’s. The policies apply to direct use, to partners that host the models, and to resellers.

Those partners have to keep safeguards consistent with OpenAI’s, investigate possible violations, and take action when a concern is identified. That includes coordinating enforcement so a restriction is not easy to route around by switching services.

The updated usage policies add a gate for a specific kind of product. Services that provide direct access to OpenAI models, such as model routers or AI gateways, will need OpenAI’s review and approval before they offer that access. The post says the company will keep explaining what is allowed, what is restricted, and how a customer or partner can raise a compliance question.

OpenAI described two mechanisms in the same document. Private Safety Processing is given as an example of work with customers and partners on safeguards that still leave customers more control over sensitive data. SafetyIDs, which it said it is introducing with customers, would let a customer help OpenAI tell end users apart during an investigation without OpenAI learning those users’ identities. The stated aim is a more precise response to misuse, with less disruption to everyone else.

On enforcement, OpenAI said decisions are based on documented conduct and risk, rules are applied consistently, and the response is proportionate. If it restricts access, it said it will revisit the restriction when meaningful changes in conduct, commitments, or safeguards address the concern.

What the post does not do

The document is a company policy statement. It is not a statute and it is not a regulator’s order. It does not include the full text of the November 20 usage policies. It does not name which partners are already covered, and it does not describe an enforcement action taken under the new partner standard.

The same day, OpenAI said its frontier models and Codex workflows are coming to Google Cloud. That announcement is a distribution deal. This one is the rule OpenAI says should travel with the models when another company hosts them.