The Best Model Isn't Behind a Paywall Anymore. It's Behind a Background Check.

The longest delay I've ever caused on a launch was a PDF.

I was interim CTO at a startup selling into a mid-size insurer. The product worked. The team was ready. The customer wanted it. And then their procurement team sent over a security questionnaire, a SOC 2 request, a data processing addendum, and a request for our entity documents. None of it was hard. All of it required a human to sit down, gather things, chase a signature, and wait on someone else's legal calendar. Six weeks. The code had been done for two of them.

I think about that every time a founder tells me their AI roadmap is "just a budget question."

This month it stopped being one. Anthropic, Google, and OpenAI each shipped their best model twice: a public paid tier anyone with a credit card can hit, and a second, sharper tier that gates on verified organization identity, government ID, or trusted-partner status. Public prices barely moved. The better model isn't more expensive. It's just not for sale to you until somebody confirms who you are.

I haven't touched the gated tiers. Nobody outside the vetted lists has. But I've run vendor procurement and security reviews at enough startups to know exactly how this plays out, because it's the same shape as every enterprise gate I've ever sat through.

Money was the easy constraint

For three years, the mental model founders built was clean: capability costs money, money is a line item, line items are a spreadsheet problem. If the model gets better and pricier, you raise the budget or you wait for prices to fall. Either way, you control the lever.

Identity gating breaks that. You cannot solve it faster by spending more. You solve it by having a legal entity in good standing, a real business address, an identifiable set of officers, an acceptable use story, and in some cases a review that somebody at the vendor has to actually perform on you. That is a queue. Queues have wait times you don't set.

The founders I work with are usually great at unblocking things with money or hustle. This is a category where neither works. You're either eligible or you're in line.

The specific way this kills a launch date

Here's the failure mode, and it is boring, which is why nobody catches it.

Your technical person builds a demo. The demo uses whatever tier their personal or dev account has access to, because that's what was in front of them. It's sharp. It handles the messy inputs. It reasons through the edge case that makes the whole product feel magical to a customer. Everyone in the room sees it work.

Then you sell against that demo. You write the roadmap against that demo. You set a launch date against that demo.

And nobody in the building ever asked whether the production account, under the company's legal entity, with the company's billing, is eligible for that tier. The answer is often no, or "yes, after verification," which is the same as no until the verification finishes.

I've seen this exact pattern with cloud quotas, with payment processors, with app store review, with enterprise SSO providers. Never with model access, because until now model access was a credit card. That just changed, and the muscle memory hasn't.

What actually goes wrong is the ownership, not the paperwork

The paperwork is not hard. Entity documents, verified organization, a named person willing to put their ID behind an account, an enterprise agreement instead of self-serve terms. A competent ops person can assemble most of it in a couple of days of actual work spread over a few weeks of waiting.

The problem is that nobody owns it. Engineering assumes it's a business thing. The founder assumes engineering would've flagged it. Nobody is tracking the date. It surfaces the week of launch, when someone finally provisions the production key and hits a wall that says verification required.

This is the same reason compliance reviews sink launches. Not difficulty. Orphaned ownership plus a nonzero wait time.

So put a name on it. One person, this week, answers three questions in writing:

Which model tier does our product actually depend on, in production, under our company's account?
What eligibility does that tier require, and do we currently meet it?
If not, who is starting the application, and what date do they expect it cleared?

If the answer to the first question is "I'm not sure," that's your answer to whether your launch date is real.

The stance: assume you're on the public tier and build so you're not surprised

I'm not going to tell you to chase vetted-partner status. Most early companies don't need the sharper tier, and the ones that think they do usually have a retrieval problem or a prompt problem dressed up as a model problem.

My actual position is narrower and more annoying. Design and test your product against the tier you are certain you can call in production, and start the verification paperwork in parallel as an upgrade, not as a dependency. If the public tier gets you to a shippable product, you ship on time and the better model becomes a quality bump later. If it doesn't, you found out in month one instead of the week before your investor update.

That's a sequencing decision, and it's yours, not your engineer's. Engineers optimize for the best result available on their machine today. You're the one holding the calendar.

Two more things worth doing now, because they cost almost nothing and buy you optionality later. Get your company verified with your primary provider even if you don't need the gated tier yet, because clearing a queue you might need beats starting one you definitely need. And keep your model calls behind a thin internal layer so swapping tiers or providers is a config change instead of a rewrite. I've written about why that abstraction earns its keep in a market where the ground moves every quarter.

The frontier is still moving fast. It just stopped being purely purchasable, and the price of the good stuff now includes a form, a wait, and somebody willing to sign their name.

If you're staring at a roadmap that quietly depends on a capability nobody's confirmed you're allowed to use, put thirty minutes on my calendar. Ten of those minutes usually settles it.