Skip to main content
OpenAI logo

OpenAI

FedRAMP evidence

openai.comAI infrastructureLast verified 17 Sep 2026
FedRAMP mark, CertReports state Verified as of 17 Sep 2026Verified

OpenAI and FedRAMP

OpenAI is listed in the FedRAMP Marketplace for FedRAMP (FedRAMP Authorized), dated 9 Jan 2026, assessed by Schellman Compliance, LLC. CertReports last verified this on 17 Sep 2026 from the registry.

Evidence

VerifiedFedRAMP Authorized
as of 17 Sep 2026 · confidence 100%
Kind
authorization
Issued or listed
9 Jan 2026
Auditor or assessor
Schellman Compliance, LLC
Impact level
20x Moderate
Products in scope
ChatGPT Enterprise and API Platform
Scope
Public Cloud
SourceCapturedQuoteLinks
FedRAMP Marketplace
Official registry · HTTP 200
17 Sep 2026OpenAI - ChatGPT Enterprise and API Platform: FedRAMP Authorized
Live pagesha256 395e7ad35d
Vendor-statedVendor states FedRAMP 20x on its trust centre
as of 17 Sep 2026 · confidence 90%
SourceCapturedQuoteLinks
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Sep 2026FedRAMP 20x
Live page Snapshotsha256 bdacda3d9f
Vendor-statedVendor states TX-RAMP on its trust centre
as of 17 Sep 2026 · confidence 90%
SourceCapturedQuoteLinks
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Sep 2026TX-RAMP
Live page Snapshotsha256 bdacda3d9f

What is not public

  • Impact level and authorization path come from the FedRAMP data file; the package itself and the agency ATO letters are not public.
What FedRAMP means, and what it does not

Status changes often and the official GitHub data file and its daily changelog are the source of truth. Legacy "Ready" status is being retired in 2026 under FedRAMP 20x.

Read the FedRAMP guide and browse all vendors with evidence

Questions buyers ask

Is OpenAI FedRAMP authorized?

OpenAI is listed in the FedRAMP Marketplace with status "FedRAMP Authorized" at impact level 20x Moderate as of 17 Sep 2026.

How does CertReports verify this?

Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.

Alternatives with FedRAMP evidence

Similar vendors (shared product tags or the AI infrastructure category) whose FedRAMP row is verified or vendor-stated, ranked by similarity.