In Introducing Images 2.6, OpenAI points to a separate system card covering Images 2.6 safety evaluation and mitigations. The ChatGPT Images 2.6 System Card (published November 4, 2026) states that the core safety stack builds on Images 2.5 and adds extra GIF protections; it also describes upstream refusals, downstream input/output blocking, and preparedness measures such as biological-risk policies. Commercial integrations should not read only the marketing page—they should put the system card, moderation parameters in the image generation guide, and organization verification requirements on the launch checklist together.

👉 Try the GPT Image 2.6 API on PoYo: per-image pricing and online playground.

Safety stack and evaluation framing

Per the system card, GPT‑Image‑2.6-side image safety includes: LLM policy checks before a request enters generation (upstream refusal); once inside the system, a safety reasoning model monitors inputs and outputs (downstream blocking)—input violations prevent generation, output violations prevent display. Training and data-pipeline sides also describe filters and classifiers that reduce the risk of harmful or sensitive content entering training. Preparedness-related evaluations state that neither tier crossed Bio High or Cyber High thresholds; even so, practices similar to 2.0/2.5 continue, applying image-side policies commensurate with High capability in biological-risk categories.

Offline evaluation used 3,077 adversarial requests against respective 2.5 baselines. The system card stresses that results do not represent how often violating requests or outputs appear in production traffic, nor a full online safety-system metric. The overall conclusion is framed as: the 2.6 series with moderation checks is broadly comparable to 2.5; some numeric swings may not be statistically significant after multiple-comparison adjustment. When citing those percentages, keep the “adversarial set, offline, not production frequency” qualifiers—do not rewrite them as “online violation rates.”

GIF-specific mitigations and provenance

GIF introduces risks that are harder to see on stills, such as sexualized motion or harmful meaning conveyed across frames. The system card explains that mitigations assess generated frame grids and generation instructions; GIF-specific rules intercept some categories more broadly than stills to cover inferred motion. Motion-related violations remain hard to catch completely—mitigations may not capture all violations. If a commercial product opens motion, evaluate motion categories separately in product policy rather than assuming still moderation automatically covers them. On provenance, the card describes continued C2PA metadata support and watermark layers such as SynthID across ChatGPT, Codex, and the API; public verification tools can check provenance signals on supported files. Jurisdiction-specific disclosure duties remain a matter for the integrator’s counsel.

Organization verification, API moderation, and a commercial checklist

The image generation guide states that for responsible use, organizations may need to complete Organization Verification in the developer console before calling GPT Image. For end-user-facing apps, pass a stable, hashed safety_identifier of at most 128 characters on every generation or edit request (the older user field is deprecated but still compatible). moderation may be auto (default) or low. On user-correctable errors such as moderation_blocked, change the prompt or input image—do not retry blindly; backoff retries suit quota and service faults. ChatGPT/Codex product availability does not automatically equal verification or quota status for a given API project.

Before commercial launch, confirm: organization verification done; safety identifiers wired; motion and still policies separated; error handling distinguishes moderation blocks from infrastructure faults; external copy does not misuse offline-evaluation percentages; brand and UGC sampling covers multi-turn edits and GIF. Neither the system card nor the product page replaces the customer’s own compliance review.

The image generation guide also notes that moderation-block errors may include coarse moderation_details (e.g., input/output stage, category labels), mainly for developer logs and light repair hints; end-user copy should stay general. moderation=low relaxes filtering—commercial products more sensitive to underage audiences or brand safety should not treat “lower limits” as a default marketing pitch. Rate limits vary by account tier; check the organization console rather than copying public figures from other models. Writing safety identifiers, moderation policy, and sampling frequency into change review is more durable than citing system-card percentages in a post-hoc PR defense.

Bottom line: Images 2.6’s safety narrative is “2.5 base + GIF hardening + continued provenance,” using offline adversarial sets to illustrate moderation effectiveness while stating their limits. A responsible commercial reading treats the system card as an evaluation briefing, organization verification and request-level moderation parameters as integration gates, and “possible misses” as operations playbook language—not as absolute safety promises.