OpenAI aligns safety requirements across model providers

OpenAI’s October 21 announcement sets expectations for safeguards across its own service, hosting partners and resellers. Partners providing model access must investigate potential violations and coordinate action so restrictions remain effective across services. The company also describes SafetyIDs: identifiers intended to distinguish end users during investigations without learning their identities, helping reduce disruption to other customers.

The English usage policy, effective November 20, 2026, makes a specific distinction for developers. A service that gives third parties direct access to OpenAI models must obtain OpenAI’s review and approval beforehand. An application does not face this requirement solely because it uses those models to power its own features. That separates a model-access intermediary from ordinary feature integration; this is a provider policy, not a replacement for applicable legal requirements.

For implementation, OpenAI’s developer guidance recommends, but does not require, safety identifiers for products where individuals interact with models. Developers send a unique user string through safety_identifier, hashing a username or email instead of sending that identifying information. An unsigned-in product preview can use a session identifier. These identifiers help trace misuse and reduce the chance that one person disrupts an organization’s access. They do not carry across APIs or sessions: applications must supply the same stable value separately where needed.