Gartner is preparing its first Magic Quadrant for AI Gateways, expected in 2026, and the market has already moved twice under it. The Market Guide that defined the category published October 13, 2025. Palo Alto Networks acquired Portkey on May 1, 2026, and Gartner's response to that deal, a First Take titled "Palo Alto Networks' Portkey Deal Signals the Importance of AI Gateways," reads like the quadrant's first question answered early.
The control layer between teams and models
An AI gateway is the intermediary between your applications and the AI services they call. Every model, every agent, every API request passes through it, and the gateway is where security, governance, cost, and observability get enforced.
That is why Gartner elevated the category this fast: emerging category in 2024, Market Guide and Innovation Insight in 2025, first Magic Quadrant in 2026. Two years from watchlist to quadrant is unusually quick, and the speed is the finding. The gateway is where AI strategy becomes infrastructure.
Different teams want different things from the same layer. Security wants every call inspected. Finance wants every token priced. Platform teams want routing and failover. Governance wants policy. One control layer, five stakeholders, and the gateway is the only place their requirements can coexist.
The 2025 guide the quadrant will build on
The Market Guide for AI Gateways published October 13, 2025, authored by Andrew Humphreys, Manjunath Bhat, Keith Guttridge, Shrey Pasricha, and Deepak Seth. Its definition sets the bar: an AI gateway acts as an intermediary between applications and various AI services or models, providing a central control plane to secure, govern, and observe AI workloads.
Its projection sets the urgency: by 2028, 70 percent of software engineering teams building multimodal applications will use AI gateways, up from 25 percent in 2025.
The guide groups the field into three vendor camps, and the camps are the market's tension. API management vendors adding AI extensions: AWS, Google's Apigee, IBM, Kong, Tyk, Solo.io, F5, Gravitee, and others, security and traffic expertise bolted onto model traffic. AI platform vendors with built-in gateways: Cloudflare, Databricks' Mosaic AI Gateway, TrueFoundry, Vercel, and more, convenience for the platform's own customers. And purpose-built open-source and open-core vendors: Envoy, LiteLLM, Helicone, Portkey, NeuralTrust, APISIX, Traefik Labs.
Three vendor groups, one market
The three camps disagree about the most basic question: is the gateway a feature or a product?
The API management vendors answer that it is their product, extended. The AI platform vendors answer that it is a feature of the platform you already bought. The purpose-built vendors answer that neither camp can be neutral about models, and neutrality is the whole job.
Embedded gateways are features. Standalone gateways are products. The buyer's architecture decides which answer is right, and most large organizations will end up with both, which is exactly the mess Gartner's First Take addresses.
The acquisition that pre-empted the quadrant
Palo Alto Networks buying Portkey changed the category's geometry. A security giant absorbing one of the strongest purpose-built gateway vendors is the market voting that the gateway is primarily a security control point.
Gartner's First Take draws the buyer's conclusion explicitly: organizations must manage their AI gateway strategy independent of the AI gateways embedded within larger platforms, due to the likely limitations of embedded gateways. Its recommendation is a federated approach, a centralized control plane for consistent standards and governance, independent of any single vendor.
The acquisition answered the quadrant's first question before it was published: standalone or embedded, the analysts say, and their answer is both, coordinated from the center.
What the first quadrant will have to decide
No vendor placements exist yet, and none are announced. The quadrant is expected in 2026, and its first edition will have to make decisions the Market Guide only named.
Who qualifies: the API giants, the platform vendors, the open-source projects, or some defensible subset? How an open-source gateway like Envoy or LiteLLM is scored on Ability to Execute is not obvious. And whether the Portkey-shaped hole in the purpose-built camp gets filled by acquisition or by new entrants before the scoring begins.
The first quadrant will also inherit the guide's 70 percent projection as its clock. A category moving that fast does not wait politely for its first scorecard.
Four questions before the quadrant lands
Standalone, embedded, or federated? Gartner's own guidance points to a centralized control plane independent of any platform. Check whether your current architecture makes that possible.
Who sees every call? The gateway is a choke point, which means it is also a privacy and compliance surface. Ask what the vendor itself can see and where the logs live.
What happens when the model changes? Routing, pricing, and policy should survive a model swap. Test it with a model you do not use.
Is the open-source option real? LiteLLM and Envoy are production infrastructure in many shops. Ask why the commercial gateway is worth its price before paying it.
Analyst Source
Gartner Market Guide
This article draws on Gartner's coverage of AI gateways. The first Magic Quadrant for AI Gateways is expected in 2026 and is not yet published; no placements have been announced. The published anchor is the Market Guide for AI Gateways, published October 13, 2025, authored by Andrew Humphreys, Manjunath Bhat, Keith Guttridge, Shrey Pasricha, and Deepak Seth, which defines an AI gateway as an intermediary between applications and AI services providing a central control plane to secure, govern, and observe AI workloads, and projects 70 percent adoption by 2028. Gartner's First Take on the Palo Alto Networks acquisition of Portkey, published May 1, 2026, recommends a federated gateway approach with a centralized control plane.
Source research
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
Worth reading alongside this one is AI Governance Platforms. More than a hundred vendors market AI governance capability; Gartner's inaugural quadrant found only thirteen that actually enforce policy at runtime rather than just reviewing it.
The related category on this site is API Management Software. API management was built around a person reading documentation before calling an endpoint. That assumption is being dismantled as AI agents become the primary consumers of enterprise APIs.