OpenAI's terms for dots make you responsible for what they do

The change

On September 29, 2026, OpenAI updated its Service Terms, the document that sets the rules for specific OpenAI products such as the API, ChatGPT Enterprise, GPTs, and apps. The previous version was dated September 21, 2026 and ended at Section 13. The new version adds two sections: Section 14, "Dots and Agentic Features," and Section 15, "Sign in with ChatGPT." Nothing else in the document changed.

The same day, at DevDay 2026, OpenAI launched dots, which it describes as always-on agents in ChatGPT. A dot works toward a goal the user sets, keeps going between conversations, and can act in the apps the user lets it reach. The rules for it take up three short clauses. One day earlier, OpenAI had updated a related document, which we covered when its app terms began to cover ChatGPT calling your app on its own.

What changed

• Responsibility. Section 14(a) says the user decides how to use dots and related agentic features, "including what access, authority, and instructions you give them," and adds: "You are responsible for actions they take and content they share on your behalf."

• Oversight. Section 14(b) makes the user "responsible for providing oversight appropriate to the task and its potential consequences." That includes "setting clear instructions and appropriate limits and reviewing actions and communications."

• Purchases and payments. Section 14(c) says: "You are responsible for transactions made on your behalf." The user must have permission to use any account or payment method they provide, give "appropriate purchase guidance," monitor their accounts, and "promptly raise any errors with the relevant financial institution or payment provider."

• Sign in with ChatGPT. Section 15 says a user who connects a ChatGPT account to another service agrees to share the information needed to authenticate them, "including name, email, and/or profile photo," and, "where relevant, your ChatGPT usage." Developers who add the sign-in option to their own product are pointed to the separate Sign in with ChatGPT Terms.

The new part is "on your behalf"

The Service Terms already had a sentence about actions. Section 7, which covers apps that connect ChatGPT to third-party services and did not change in this update, makes users "solely responsible" for "the actions you take using Apps." That sentence is about what the user does.

Section 14 is about what the agent does: "actions they take and content they share on your behalf." A dot keeps working while the user is away, so the action in question may be a message sent, a file shared, or a record changed when nobody was watching. Section 14 does not distinguish between actions the user approved and actions the agent took on its own initiative.

OpenAI's own documentation is direct about the limits of the product. At the time of publication, its help page for dots says: "Your dot can make mistakes, including when following your rules." The launch announcement asks users to always review consequential work. The terms then say who is responsible for the result.

OpenAI is the third large vendor we have covered since mid-September to write this into its terms. One day earlier, Stripe made AI agent actions legally binding on its users, and earlier in September, HubSpot made customers answer for what its AI agents do.

Oversight is now a duty in the contract

Section 14(b) does not set a fixed standard. The oversight has to be "appropriate to the task and its potential consequences," so a dot that drafts a summary and a dot that emails customers call for different levels of review.

The product gives users tools for this. According to OpenAI's help page, for some actions a user can set rules for what a dot can share, purchase, or access, and each rule tells the dot to act without asking, act only if the action was pre-approved, ask first, or hand the step back to the user. OpenAI's announcement adds that an automatic review checks actions that could affect the user's accounts or share information.

Section 14 does not say that setting rules is enough. It makes the user responsible for "setting clear instructions and appropriate limits and reviewing actions and communications," which means the review of what the dot actually did is part of the duty, not only the setup.

Purchases: errors go to your bank or payment provider

Section 14(c) covers money in four sentences. The first is about authority: "You must have permission to use any account or payment method you provide." For an employee, that means a company card or a shared account should go to a dot only if the company allows it.

The second is the core of the clause: "You are responsible for transactions made on your behalf." The third names the route for mistakes, which is to "promptly raise any errors with the relevant financial institution or payment provider." Section 14 does not describe a refund or dispute process with OpenAI. The last sentence adds: "Third-party terms may also apply to these transactions."

What Section 15 says about Sign in with ChatGPT

Sign in with ChatGPT lets developers offer users a way to connect their ChatGPT accounts to a tool, application, or website. The feature itself was already mentioned in the Service Terms, in the section on OpenAI Academy. What is new on September 29 is a section of its own.

For users, Section 15 lists what is shared: name, email, and/or profile photo and, "where relevant, your ChatGPT usage." After that, the information is "subject to that service's terms, policies, and configuration." The Service Terms do not define "ChatGPT usage." The Sign in with ChatGPT Terms describe the feature as letting people link a ChatGPT account to a developer's app and run that app's AI features on their own eligible ChatGPT plan.

For a SaaS company, this has two sides. If employees sign in to third-party tools with a work ChatGPT account, their identity details and, where relevant, their ChatGPT usage go to a tool that handles them under its own terms. If the company adds the sign-in option to its own product, the Sign in with ChatGPT Terms apply to the company. Knowing which outside tools connect to your AI accounts is part of monitoring AI subprocessors.

What did not change

• Sections 1 to 13 are word for word the same as in the September 21 version.

• The opening paragraph still says that if the Service Terms conflict with a customer's main agreement, "the Service Terms will control."

• Section 2 still says features offered on a beta basis are provided "as-is" and are "excluded from any indemnification obligations." OpenAI's announcement describes dots for Enterprise, Edu, and Healthcare workspaces as a beta that an admin has to enable.

• Section 7 still tells users not to add or enable an app unless they know and trust the application behind it.

Why this matters

For a SaaS company, the people most likely to try dots are employees who already use ChatGPT for work. Once a dot can reach work email, chat, documents, or a CRM, it acts in the company's name: it sends messages, shares files, and changes records while its owner is doing something else.

In a business workspace, the contract with OpenAI is the company's, not the employee's. At the time of publication, the OpenAI Services Agreement, the contract for business customers, lists the Service Terms among the policies that apply, and says that when a customer starts using a service newly added to those terms, the policies in effect at that time govern that use. No signature is involved. Switching the feature on is what brings Section 14 into the relationship.

The sentence about who is responsible for the result sits in a legal document that changed on launch day, separate from the product. That is the gap vendor contract monitoring is meant to close.

Potential impact

For a company whose employees use ChatGPT, the update raises six practical questions:

• Who in the company can create a dot today, and if you are on ChatGPT Enterprise, has an admin switched the beta on?

• Which apps and accounts can each dot reach, and can it send messages or share files outside the company?

• Which actions are set to run without asking, and which need approval or are handed back to a person?

• Has anyone given a dot a company card or a shared account, and did they have permission to?

• Who reviews what dots have done, and how often?

• Which third-party tools do employees sign in to with a work ChatGPT account?

How Venpo detected it

Venpo monitors OpenAI's legal documents as part of continuous vendor risk monitoring. It flagged the new Service Terms and marked Sections 14 and 15 as inserted text, with the rest of the document unchanged. Every quote in this article was checked against the redline and the live page. The full redline is on the OpenAI change page, and every monitored OpenAI document is listed on the OpenAI vendor profile.

Business outcome

Teams that track OpenAI got the wording of Section 14 while dots were still rolling out. That leaves time to decide who may use them, set approval rules, and keep payment methods away from agents until someone owns the review. The alternative is reading the clause for the first time after a dot has sent, shared, or bought something nobody approved.

Key takeaway

OpenAI's September 29 Service Terms put the actions, messages, and purchases of dots and other agentic features on the user, and make supervising them a duty in the contract. The clauses were published on launch day, in a document separate from the product, which is why the reliable way to keep up is to monitor vendor terms of service every time they change.