OpenAI aligns safety requirements across model access providers

OpenAI has set out a cross-provider approach to safety for services offering access to its models, including GPT-6 Astra. The company said partners, hosting providers and resellers must maintain safeguards consistent with OpenAI’s own, investigate potential violations and take appropriate action when concerns are found.

The announcement also introduces updated Usage Policies, effective November 20, 2026. Under those policies, services that provide direct access to OpenAI models, including model routers and AI gateways, must obtain OpenAI’s review and approval before offering that access.

Safety requirements across access channels

OpenAI said developers and businesses should be able to choose where they access its models without encountering materially different safeguards. Its policies are intended to apply whether access is provided directly by OpenAI, through a partner that hosts the models, or through a reseller partner.

Partners are expected to investigate suspected policy breaches and coordinate enforcement with OpenAI so that restrictions remain effective across services. OpenAI said the framework must account for differences in how services operate and how their customers use them, rather than imposing a single implementation pattern.

The company cited Private Safety Processing as an example of developing safeguards while allowing customers greater choice and control over sensitive data. It also described layered protections: pre-deployment capability and risk evaluations, training for safety requirements, testing against deliberate attempts to bypass safeguards, and post-deployment monitoring for abuse.

Enforcement, customer risk and identity protection

For cyber misuse, OpenAI said it trains models to refuse harmful requests and uses systems that identify suspicious interaction patterns to determine a response. Trusted access programmes add eligibility requirements and conditions for access to the company’s most powerful capabilities.

OpenAI noted that customers can encounter misuse through their own end users, compromised accounts or leaked API keys. The company said it works with customers to understand and address those cases, while its enforcement decisions are based on documented conduct and risk and are intended to be proportionate to the circumstances.

The policy context overlaps with concerns raised by government access and unresolved safeguard questions about government access and unresolved questions around safeguards, while OpenAI says consistent enforcement should remain in place across providers. Restrictions may be revisited when meaningful changes in conduct, commitments or safeguards address the original concerns.

SafetyIDs and business implications

OpenAI is also working with customers on SafetyIDs, identifiers that can distinguish individual end users during an investigation without revealing their identities to OpenAI. The company said this could enable more precise responses to potential misuse while reducing disruption for other users.

For businesses, the change makes safety governance a procurement and architecture issue: organisations using OpenAI models through gateways, routers, hosts or resellers should establish who investigates incidents, how enforcement is coordinated, and how compromised credentials and end-user misuse are handled.