Cloudflare announced on August 7, 2026, the unification of Workers AI and AI Gateway into a single control plane that routes inference requests through zero-trust policies. The change attaches verified identities from Cloudflare One to every AI call and logs full prompts, responses, token counts and latency for compliance teams.
Unified API and observability features
The single endpoint, accessed through env.AI.run() or the /ai/run REST path, now handles both Cloudflare-hosted models and external providers. On the first authenticated request the system automatically provisions a gateway that records every interaction, applies rate limits, caches responses and tracks costs against prepaid credits.
Enterprise customers receive the same billing flow for frontier models with higher rate limits. Prepaid AI Gateway credits apply directly to Workers AI usage, removing the need for separate procurement processes. Model-first routing for failover and load balancing across providers remains in pilot as of October 2026.
Workers AI continues to run more than 50 models across Cloudflare’s edge network in over 200 cities. Standard requests carry zero data retention for training purposes, and pricing stays at $0.011 per 1,000 neurons after the daily free tier of 10,000 neurons.
Zero-trust security and compliance controls
Integration with Cloudflare One and Access attaches user or service identities to each inference request. Administrators can enforce data-loss-prevention rules, block prompt patterns that risk exfiltration, and restrict access through MCP server policies. Shadow AI reporting, first introduced in August 2025, now surfaces usage across the unified gateway.
Audit logs from AI Gateway combine with account-level logs that Enterprise plans retain for up to 18 months. Logpush exports allow teams to stream records into existing SIEM platforms. The Workers runtime maintains its published 99.99 percent monthly uptime target, with service credits available when the threshold is missed.
Organizations gain a single pane for cost tracking, latency monitoring and policy enforcement without deploying additional proxies. The setup reduces the surface area for unauthorized model calls while preserving the low-latency benefits of edge inference.
Next steps and ongoing development
Cloudflare continues to expand the model catalog and plans further enhancements to smart routing and custom-model support through the remainder of 2026. Teams evaluating the platform can test the unified binding in existing Workers scripts and review the new identity-aware gateway logs in the dashboard.
Security and compliance leads should map current Shadow AI policies to the new gateway rules and confirm Logpush destinations before wider rollout. The service addresses the practical requirement for traceable, policy-controlled AI usage at production scale.
Frequently asked questions
How does the unified Cloudflare AI inference endpoint work?
A single API call routes requests to both Cloudflare-hosted models and third-party providers while automatically creating a gateway that logs prompts, responses, tokens and costs.
What zero-trust features apply to AI requests?
Verified identities from Cloudflare One attach to every request, enabling DLP rules, prompt protection and Shadow AI reporting without separate infrastructure.
What audit and logging options exist for enterprises?
AI Gateway stores full prompt and response data. Enterprise plans retain account and zero-trust logs for up to 18 months and support Logpush export to external systems.
Does the service carry an explicit SLA beyond the Workers runtime?
The published Workers runtime target remains 99.99 percent monthly uptime. No separate public SLA was announced specifically for the combined AI inference service as of October 2026.
By YasTech Editorial
Comments 4