OpenAI models come to Google Cloud, and OpenAI's new usage rules start on 20 November

On 21 October 2026, OpenAI and Google Cloud said OpenAI's models and Codex workflows are coming to Model Garden, Google Cloud's catalogue of AI models. OpenAI aims the move at regulated industries that need control over who can reach sensitive data. Its post also says Microsoft remains OpenAI's primary cloud partner.

Google names three models. GPT-6 Astra is for demanding work in coding, computer use, professional tasks and scientific research. Google describes GPT-6.1 Sol as close to Astra's intelligence at a lower cost. GPT-6 Luna is its fast, low-cost model for everyday work at scale.

The three models are rolling out in private preview to select enterprise customers, and Google says more are coming. OpenAI says general availability is planned in the coming weeks. Both companies have a form for requesting access.

Customers buy the models through Google Cloud Marketplace. Usage appears on a single Google Cloud invoice and draws down existing Google Cloud spend commitments. It also counts toward Google's Flexible Savings Plans, which apply across model providers. Google says customers can swap models without separate vendor contracts.

Google says prompts, context and outputs stay inside the customer's chosen data perimeter and are never used to train foundation models. Zero Data Retention options are marked as coming soon.

The models run on dedicated Google Cloud infrastructure, and Confidential Compute is also coming soon. Requests pass through separate, locked-down gateways, and data in transit stays inside Google Cloud. Google says third-party model providers get no unauthorised access to the customer's cloud environment.

Every agent and model call runs under a verified identity. The calls sit inside VPC Service Controls, Google's security boundary around a customer's cloud resources, and are recorded in one audit log.

Google says that from 21 October customers can build with the models through its APIs. Developers can also point local Codex CLI and Desktop work at Google's Gemini platform for inference. OpenAI says its models will soon be in Google Antigravity and the Gemini Agent, and Google lists Gemini for business and Antigravity as coming soon.

For a buyer with a Google Cloud commitment, OpenAI models go on the same invoice and are paid from money already committed to Google. Google says customers can switch between models without separate vendor contracts, which can shorten the route from a pilot to a signed order.

The controls Google lists are ones a security team already uses on Google Cloud: identity, VPC Service Controls and audit logs. A risk team may be able to review the OpenAI models as part of its existing Google Cloud assessment, with no new supplier to onboard.

Two items a regulated buyer may need aren't ready yet. Zero Data Retention and Confidential Compute are both marked coming soon. Neither post names a region or a data residency location. UK, EU and Gulf buyers with residency rules may need that answer before they plan production.

OpenAI updated its Usage Policies on 21 October 2026, and the new version takes effect on 20 November 2026. OpenAI says it worked with customers and partners to line up safety policies across the services that offer its models.

The policies apply whether a model is reached directly from OpenAI, through a partner that hosts the models, or through a reseller. Partners must keep safeguards consistent with OpenAI's own. They must also investigate possible violations, act on them and coordinate enforcement with OpenAI, so a restriction holds across services.

From 20 November, a platform or other service that lets third parties reach OpenAI models directly needs OpenAI's review and approval first. The policy calls these model-access intermediaries. OpenAI's safety post gives model routers and AI gateways as examples. The policy says an application doesn't need approval just because it uses OpenAI models to power its own features.

OpenAI also introduced SafetyIDs. A customer can send one for each end user, so OpenAI can tell users apart in an investigation without learning who they are. OpenAI says this lets it act on misuse more precisely, with less disruption for others.

OpenAI notes that misuse can reach a customer through its end users, a compromised account or a leaked API key. It says enforcement is based on documented conduct and risk, and is proportionate. Restrictions are revisited if conduct, commitments or safeguards change.

The policy's wording fits a company that resells access to OpenAI models. It also fits a platform whose customers call those models through it, and a vendor that sells an AI gateway. Each likely needs OpenAI's approval by 20 November to keep offering that access.

A company may also run its own gateway that routes staff and internal apps to several model providers. The policy speaks of third parties, and it doesn't say whether a gateway serving only a company's own staff counts. A company whose gateway also serves contractors or partners has more reason to ask OpenAI before the date.

A customer buying through Google Cloud is likely still covered. OpenAI says the policies apply through partners that host its models and through resellers, and that partners coordinate enforcement with it.

SafetyIDs are most useful to a business that serves many end users through one OpenAI account. OpenAI offers them so that action against one misuser lands on that user, with less disruption for the rest.

OpenAI's changelog entry of 21 October lists three sets of rules the update clarifies. They cover training other models, protecting children and teens, and high-stakes uses. The update also brings OpenAI's existing national security principles into the policy.

On training, you may not use OpenAI models, or what they produce, to make training material for a model meant to replace OpenAI's. That includes training data, training tasks, scoring rubrics and reinforcement-learning environments.

Feedback used in training is covered too, such as labels, scores, rankings, preferences, rewards and corrections. So is choosing, filtering or checking training data.

The rule applies if you do the work yourself, do it for someone else or have someone do it for you. It applies even if you never train the model. Within those limits, the policy allows research, software development, product development, and model evaluation and benchmarking. Anything your agreement with OpenAI expressly permits is not affected.

On high-stakes uses, a model may not take high-stakes actions in sensitive areas without a person reviewing them. These are actions, decisions, transactions or submissions that seriously affect someone's rights, safety, access to essential services or other important interests.

The sensitive areas include critical infrastructure, education, housing, jobs, credit and other financial activities, and insurance. Legal, medical and essential government services are on the list. So are safety parts of products, national security, intelligence, law enforcement and migration. Work in national security, intelligence or law enforcement also needs OpenAI's review and approval.

A data team might use an OpenAI model to label or score data, then fine-tune another provider's model or an open-source model on it. If the new model is meant to replace an OpenAI model or service, that work can fall inside the training rule.

The policy allows evaluation and benchmarking. On that basis, a pipeline where an OpenAI model grades another model's answers reads as allowed. The pipeline can still fall inside the training rule if those grades later become training signals for a model meant to replace OpenAI's.

The high-stakes rule asks for human review of the use. On our reading, a lender whose model approves or declines credit with no person checking likely needs a review step. An employer whose system screens candidates out automatically is in the same position.