Customer-by-customer approval is not a product launch, it's a policy

OpenAI's most capable model does not go to a customer because that customer signed up, paid, and clicked deploy. It goes to them because the US government said yes. That is the current state of GPT-5.6's rollout: individual approvals, case by case, with Washington holding the queue.

This is not a launch. It is a rationing system. And the implications for anyone building AI products right now, whether you are a startup, an agency, or an enterprise team, go well beyond which model you get access to this quarter.

How we got here

The path to government-mediated AI access was not sudden. It was built in steps that each seemed reasonable at the time.

First came export controls. The US restricted which chips could leave the country, initially targeting China. Those controls expanded in scope and complexity through 2023 and 2024, eventually shaping which companies in which countries could even train competitive models.

Then came the executive orders. The Biden administration's October 2023 executive order on AI required frontier model developers to notify the federal government before deploying systems above certain capability thresholds. That notification requirement was a door. The current approval process is what happens once someone decides to lock it.

Now, with GPT-5.6, the logic has extended one step further. not just notify us, but wait for us to say yes before you hand this to a specific customer. That is a qualitatively different posture. It is a veto, not a filing.

What this actually means for agencies and builders

If you build products on top of frontier AI, you now have a dependency you did not negotiate. It is not in your contract with OpenAI. It is not in your SLA. It sits above both of them.

There are three concrete implications worth taking seriously.

Access is no longer symmetric. Two companies in the same industry, operating in the same market, can now be in different positions simply because of how they were prioritised in an approval queue. One team ships with GPT-5.6. The other waits, or doesn't get access at all. This is not a technical difference. It is a political one. Competitive advantage will start to accrue not just from how well you build, but from whether you were cleared to build at all.

Roadmaps have a new dependency. If your product roadmap assumes access to a specific model at a specific time, that assumption is now softer than it looks. A government-mediated approval process has a different failure mode than a standard API waitlist. It can be stalled, reversed, or scoped in ways that have nothing to do with your technical readiness or your vendor relationship. Agencies and product teams that have not stress-tested their roadmaps against this scenario are carrying a risk they may not have priced.

The compliance layer is becoming structural. For years, AI governance in a product team meant thinking about data privacy, output filtering, and model cards. Those concerns remain. But they now sit underneath a larger question: does your use case, your customer profile, and your geography clear the bar that a government approval process sets? That is not a legal checkbox. It is a strategic one.

The deeper shift. who shapes the frontier

The more unsettling question is not about GPT-5.6 specifically. It is about what this model of control normalises.

Once a government has demonstrated that it can and will gate access to a frontier model at the customer level, the incentive structure for every future deployment changes. OpenAI now knows that releasing a sufficiently capable model without government coordination creates regulatory friction. That knowledge shapes product decisions before they become policy decisions. It moves the negotiation upstream, into the design of the model, the framing of its capabilities, and the terms under which it is offered.

Other jurisdictions are watching. The EU AI Act creates its own tiered access logic, with high-risk system requirements that function as a different kind of gate. China's generative AI regulations require government approval before public release of models above a certain capability level. The US approach with GPT-5.6 is not an outlier. It is a data point in a global pattern where states are asserting that frontier AI is infrastructure, not software, and that infrastructure requires a licensing regime.

For agencies in particular, this pattern matters because clients will increasingly ask not just whether a tool works, but whether it is cleared. That is a new kind of due diligence.

What a sensible response looks like

None of this means stop building. It means build with a clearer understanding of what you control and what you do not.

A few things worth doing now.

Audit your model dependencies. If a specific model is load-bearing in your product, map what changes if access to that model is delayed, restricted, or re-tiered. Which parts of the product degrade? Which can fall back to a different model without the user noticing? Redundancy here is not paranoia. It is architecture.

Stop treating AI access as a commodity input. For a long time, the working assumption was that frontier model access is like cloud compute: available, scalable, and roughly interchangeable between providers. That assumption is weakening. Different providers sit in different regulatory relationships. Anthropic, Google, Mistral, and OpenAI are not equivalent in terms of their government entanglements. That matters when you are making a build decision that will be live in eighteen months.

Make the conversation with clients explicit. If a client is planning a product that relies on a specific model's capability, they deserve to know that access to that model may not be a purely commercial decision. Raising this early is not alarming them. It is doing your job.

The harder shift is cultural. Agencies and product teams have spent the last two years learning to move fast with AI. That instinct is right. But speed now has to sit alongside a kind of regulatory fluency that was not in the job description before. The teams that develop both will be in a stronger position than those who treat governance as someone else's problem.

Where this ends up

No one knows exactly how the approval regime around GPT-5.6 will evolve. It could loosen as the model is deemed less sensitive over time. It could tighten, or be extended to other models. What seems unlikely is that it disappears entirely as a mechanism. Governments do not tend to give back tools once they have demonstrated they can use them.

The more likely trajectory is that this becomes a standard feature of frontier AI deployment: not an exception, but a layer. A layer that sits between the model and the market, and that shapes, in ways both visible and opaque, who gets to build what.

For Studios like ours, the practical upshot is this. The craft of building with AI now includes understanding the political economy of AI access. That is not a comfortable expansion of scope. But it is an accurate one.