Should a Hotel or Tour Operator Build Its Own ChatGPT App? What OpenAI’s Plugin Rules, OTA Apps and Agentic Checkout Actually Require

Direct answer: **build one only if you have something ChatGPT cannot already get from an OTA, and only as a front door — not as a till.** ChatGPT apps (OpenAI’s developer docs now call them plugins, listed in the ChatGPT Directory) are real distribution: Booking.com and Expedia were launch partners in October 2025 (OpenAI), by April 2026 UK brands such as NatWest, Rightmove and MoneySuperMarket were listed there (NatWest, 30 April 2026), and hotel-tech vendors are selling direct-booking apps into it (Travolution, 6 March 2026). But OpenAI’s current rules say in-plugin commerce is approved only for physical goods, that purchases should complete on **your own domain** via external checkout, and that in-chat payment is a beta for select marketplace partners (Plugin guidelines; Checkout reference). For a hotel group, tour operator or DMC, that means the realistic 2026 build is a read-only search, quote and enquiry experience that hands the guest to your existing booking journey — and the work is mostly in your data, not the chat.

Kaize is a UK AI product studio for travel and hospitality. This article is based on OpenAI’s, Booking.com’s and Expedia’s own published documentation as read on 7 October 2026, plus named trade reporting. It is **not a case study** — we do not claim to have published a ChatGPT plugin for a client, and we make no claims about traffic or bookings from ChatGPT. Platform rules here are changing quickly; check the linked pages before you commit budget.

Three different ways a travel business can show up inside ChatGPT

Most boardroom conversations blur three things that have different owners, costs and rules. Separate them first:

• **Inside someone else’s app.** Booking.com and Expedia were among OpenAI’s seven pilot partners when apps launched on 6 October 2025 (OpenAI). Expedia’s own page describes the flow: live flight and hotel results with pricing and availability in the chat, then a **“Book on Expedia”** click that takes the traveller to Expedia to finish (Expedia). If your hotel is well represented on an OTA, you may already be appearing in these conversations — on the OTA’s terms and commission.
• **Inside an aggregator’s direct-booking app.** In March 2026 Lighthouse launched The Hotels Network app in ChatGPT, connecting subscribed hotels’ systems to ChatGPT over the Model Context Protocol (MCP); if a property is indexed it routes the user to the hotel’s own booking link, otherwise to an OTA link such as Booking.com, on a flat-fee, zero-commission model (Travolution). This is the “direct channel without building it yourself” option.
• **Your own plugin.** You build and run an MCP server, pass OpenAI’s review, and publish under your verified brand (Submit plugins). This is the only route where you control the tools, the content and the handoff — and the only one where you carry the engineering, review and maintenance cost.

There is also a fourth, paid route: ChatGPT advertising. OpenAI documents **hotel property feeds** for ads, but as a **limited beta for approved pilot advertisers only**. The feed is a full snapshot of properties, not rooms or dated stays; `base_price` is “a static starting price, not a quote”, and dynamic rates and stay-date availability are explicitly out of scope (Hotel property feeds). Ads may sit alongside a plugin strategy, but they do not replace one.

What OpenAI’s current rules mean for travel specifically

OpenAI’s Plugin guidelines are the minimum standard for anything listed in the ChatGPT Directory. Read with a travel booking journey in mind, these are the clauses that matter:

• **Commerce.** “Currently, plugins may conduct commerce only for physical goods.” The checkout reference repeats that “current approval is limited to plugins for physical goods purchases” while OpenAI works on wider use cases (Checkout reference). Hotel stays, tours and packages are services, so plan for no in-chat transaction today.
• **Checkout.** “Plugins should use external checkout, directing users to complete purchases on your own domain.” Embedded checkout with the ChatGPT payment sheet is a beta for select marketplace partners, and no other third-party checkout may be embedded in the plugin UI (Plugin guidelines).
• **Travel is named in the prohibited list.** “High-chargeback, fraud-prone, or abusive travel services” may not be sold, promoted or facilitated. A reputable operator is not the target, but expect reviewers to look harder at travel submissions — and be ready to show who you are, what you sell and how refunds work.
• **Restricted data.** Plugins must not collect information subject to PCI DSS, government identifiers (OpenAI’s example is social security numbers), or access credentials such as passwords and OTP codes. Our reading: treat passport and national ID numbers the same way, and never ask for card details in chat.
• **No penalty pricing, no promotions in the listing.** Plugins must not apply ChatGPT-specific fees or surcharges, must not offer a worse version of a feature available on your website, and descriptions must not advertise pricing, discounts or promotions.
• **Minimal inputs.** Tools must not request the full conversation history, and should rely on the coarse location ChatGPT shares rather than asking for precise location data.

For context: OpenAI said in March 2026 that the first version of Instant Checkout “did not offer the level of flexibility that we aspire to provide”, so merchants can use their own checkout while OpenAI focuses on product discovery, with deeper native experiences available through apps (OpenAI, 24 March 2026). Where agentic checkout does run, OpenAI is clear that the merchant remains merchant of record and handles refunds and chargebacks (Agentic commerce FAQ). Either way, the regulated part of the sale stays with you.

Why “front door, not a till” is the right design for UK travel

Handing the guest to your own booking page is not just a platform constraint — it is where your compliance already lives. Your booking journey is the place you have engineered the pre-contract information required for UK distance sales (our CCR 2013 article), the all-in total price under DMCC drip-pricing rules (total price article), ATOL information before a consumer chooses a flight-inclusive package (ATOL disclosure article), and a card flow kept outside any model (PCI DSS article). Rebuilding all of that inside a chat widget would duplicate your hardest-won controls in a surface you do not own. A plugin that searches, explains and quotes — then deep-links to a pre-filled booking page — keeps one checkout, one set of terms and one audit trail.

If you do build: what OpenAI will actually check

The submission process is more like an app-store review than a website launch (Submit plugins):

• **Verified identity.** Individual or business verification in your OpenAI organisation settings; the Directory shows the name tied to that identity.
• **One MCP server per plugin**, connected after a domain-verification challenge on your own domain.
• **Authentication done properly.** If users sign in (for example to see a loyalty rate or an existing booking), OpenAI expects an OAuth 2.1 flow that conforms to the MCP authorisation specification (Authenticate users).
• **Honest tool annotations.** Every tool declares `readOnlyHint`, `destructiveHint` and `openWorldHint`; irreversible transactions count as destructive, and annotations “do not grant permission or replace authentication, authorization and scope checks, input validation, or human confirmation for irreversible operations” ([Plugin guidelines]({GUIDE})).
• **Reviewer materials.** A dedicated test account with sample data that works without MFA, email or SMS codes; **five positive and three negative test cases**; and a video walkthrough. For a travel plugin, the negative cases write themselves: a request to pay in chat, to change someone else’s booking, or to share passport details.
• **A published privacy policy** covering data categories, purposes, recipients and retention, and real customer support contact details.

Country availability and translations are set in the submission (Submit plugins), and OpenAI notes app availability also depends on the user’s plan, region, workspace and interface (OpenAI Help Centre). When apps first launched they excluded the UK, EEA and Switzerland (OpenAI); UK consumer brands are live now, but check availability for your target markets rather than assuming it.

A minimum viable travel plugin: read-only first

The safest useful scope mirrors the control model we use for any agent touching booking systems (how travel companies should control AI agents): reads are generous, writes are narrow, and money never moves in the chat. Illustratively, for a tour operator or DMC:

• `search_departures` — dates, destination, party size → available departures from your own inventory source (read-only).
• `get_trip_details` — itinerary, inclusions, accessibility notes and the booking conditions summary, from the same content your website uses (read-only).
• `get_price_check` — an all-in indicative total for a specific departure and party, including mandatory fees, with a clear validity statement (read-only; no hold, no payment).
• `start_booking` — returns a deep link to your booking page pre-filled with the chosen departure and party; the guest completes terms, ATOL or package information and payment on your domain.
• `create_enquiry` — for bespoke itineraries, a write that creates a CRM enquiry the guest has explicitly confirmed (additive write, so `readOnlyHint: false`, `destructiveHint: false`).

Deliberately excluded from version one: taking payment, amending or cancelling existing bookings, and anything that writes to the reservation system. Those are exactly the actions where outside-authored text can steer an agent — see our prompt injection controls for travel AI — and where OpenAI’s own guidelines expect human confirmation for irreversible operations. A hotel group’s equivalent swaps departures for room types and rate plans, with availability read from the system of record rather than a cached copy (what actually stops overbooking).

The data problem underneath the chat

Every route above — OTA app, aggregator app, your own plugin, ads feed — consumes the same thing: structured, current, consistent data about your product. OpenAI’s restaurant reservation and local-services “Get Quote” conversion specs, both betas with approved partners, show the pattern: a business feed with stable IDs, names, addresses, coordinates and URLs that ChatGPT treats “as a search index”, plus a standardised MCP tool it can call when the user is ready to act (reservation spec; Get Quote spec). There is no published travel or hotel booking spec of that kind today, but the direction is clear: the businesses that convert in AI assistants are the ones whose inventory and content are machine-readable and match what they say on their own site.

If you are an online travel seller rather than a supplier, there is another option: build your own AI experience on top of OTA inventory. Booking.com’s MCP server exposes tools such as `accommodations_search` and `accommodations_room_search` to partners — scoped to your affiliate ID and Demand API key, with `tools/list` as the authoritative, account-specific tool list (Booking.com MCP guide). Note what it is not: it is a way for an affiliate to sell Booking.com inventory, not a way for a hotel to get listed in ChatGPT. For the difference between MCP and airline distribution standards, see NDC is not MCP.

Build, partner or wait: a practical decision test

Build your own plugin when most of these are true:

• Your product is **not well represented by OTAs** — multi-day tours, tailor-made itineraries, villa collections, small-group departures, B2B DMC programmes.
• You have an **API or stable data source** for availability and prices, and a booking page that accepts deep links with pre-filled selections.
• Your booking journey is already compliant and you are happy for it to remain the only place a contract is formed.
• You can **own the maintenance**: tool changes are re-scanned, review feedback arrives by email, and the test account must stay working for future reviews.

Partner (OTA or aggregator app) or wait when most of these are true:

• You are a single property or small group whose inventory already flows through a channel manager to the major OTAs.
• Your website content, rates and policies are not yet consistent across channels — fix that first, because every AI surface will expose the inconsistency.
• You cannot staff OAuth, privacy policy, support and review obligations for a plugin you would publish under your own name.

Checklist before you brief anyone to build a ChatGPT plugin

• Decide the job: discovery and quote, enquiry capture, or signed-in service for existing guests — not “sell in ChatGPT”.
• Confirm the checkout stays on your domain and the deep link carries the selection through.
• List every tool with its read/write/destructive classification before writing code.
• Remove restricted data from scope: no card data, no passport or ID numbers, no passwords or OTPs in chat.
• Make prices in the plugin match the website exactly — no ChatGPT-only fees, and an all-in total wherever a price is shown.
• Write the five positive and three negative test cases now; they double as your acceptance tests.
• Prepare the privacy policy, support contact and verified business identity.
• Check country availability for your target markets and plan what UK guests will see.
• Decide how you will measure it honestly: referral traffic and deep-link conversions you can observe, not assumed visibility.

Frequently asked questions

Can guests pay for a hotel or tour inside ChatGPT today?

Not as a general option. OpenAI’s checkout reference says external checkout on your own domain is the recommended, generally available approach; approval is currently limited to physical goods; and embedded payment-sheet checkout is a beta for select marketplace partners (Checkout reference).

Are ChatGPT apps available to UK users?

They launched outside the UK, EEA and Switzerland in October 2025 (OpenAI), and by April 2026 UK brands including NatWest, Rightmove and MoneySuperMarket were listed in the directory (NatWest). Availability still varies by app, plan, region and interface (OpenAI Help Centre).

Will a plugin make ChatGPT recommend us in ordinary answers?

There is no published evidence that it does. OpenAI says plugins with strong utility and user satisfaction “may be eligible” for directory placement or proactive suggestions (Plugin guidelines) — a possibility, not a ranking promise. Treat a plugin as a channel you measure, not an SEO tactic.

Does the Booking.com MCP server get my hotel into ChatGPT?

No. It is a partner API for affiliates building their own AI applications on Booking.com inventory; available tools depend on your affiliate configuration (Booking.com). Your hotel’s presence in Booking.com’s own ChatGPT app depends on your Booking.com listing.

Is this legal advice?

No. It summarises platform rules and connects them to UK travel obligations we have written about. Take advice on your own booking terms and regulatory position.

What this is not

• Not an endorsement of OpenAI, Booking.com, Expedia, Lighthouse or any vendor.
• Not a claim that any plugin will generate traffic or bookings.
• Not a case study — no Kaize client launch, metric or result is described.
• Not a substitute for reading the current platform terms, which change frequently.

Kaize point of view

ChatGPT is becoming a place where trips start, and travel businesses should be present there — but the 2026 rules make the right shape obvious: **make ChatGPT a front door, not a till.** Let it search, explain and quote from data you control; send the guest to the booking journey where your contract terms, total pricing, ATOL and package information, and payments already live. The companies that do well in AI distribution will not be the ones with the cleverest chat widget; they will be the ones whose inventory, prices and policies are clean enough that any assistant — an OTA’s, an aggregator’s or their own — represents them correctly. That is the same groundwork as connecting booking systems and CRM without a second system of record.

If you are a tour operator or DMC or a boutique hotel group weighing a ChatGPT plugin against OTA and aggregator apps, and want the tool list, data readiness and handoff designed before anyone writes code, discuss a project with Kaize.