diff --git a/deployment/tripleo-packages/tripleo-packages-baremetal-puppet.yaml b/deployment/tripleo-packages/tripleo-packages-baremetal-puppet.yaml
index 21f474d975..8faa41978a 100644
--- a/deployment/tripleo-packages/tripleo-packages-baremetal-puppet.yaml
+++ b/deployment/tripleo-packages/tripleo-packages-baremetal-puppet.yaml
@@ -94,7 +94,12 @@ parameters:
     default: 'false'
     description: Set to true to skip the update all packages
     type: boolean
-
+  SkipRhelEnforcement:
+    default: "false"
+    description: Whether to avoid or not RHEL/OSP policies enforcement on Red Hat.
+                 Mainly for CI purpose.  It shouldn't matter on other distributions
+                 where it's disabled in the role. Set to true to skip the enforcement.
+    type: string
 
 outputs:
   role_data:
@@ -442,6 +447,15 @@ outputs:
                 name: tripleo-transfer
                 tasks_from: cleanup.yml
       update_tasks:
+        - name: Enforce RHOSP rules regarding subscription.
+          include_role:
+            name: tripleo-redhat-enforce
+          vars:
+            skip_rhel_enforcement: {get_param: SkipRhelEnforcement}
+          when:
+            - step|int == 0
+            - ansible_distribution == 'RedHat'
+            - not (skip_rhel_enforcement | bool)
         - name: Check for existing yum.pid
           stat:  path=/var/run/yum.pid
           register: yum_pid_file
diff --git a/deployment/undercloud/undercloud-upgrade.yaml b/deployment/undercloud/undercloud-upgrade.yaml
index 3813695dfd..38fe7ef295 100644
--- a/deployment/undercloud/undercloud-upgrade.yaml
+++ b/deployment/undercloud/undercloud-upgrade.yaml
@@ -30,6 +30,12 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  SkipRhelEnforcement:
+    default: 'false'
+    description: Whether to avoid or not RHEL/OSP policies enforcement on Red Hat.
+                 Mainly for CI purpose.  It shouldn't matter on other distributions
+                 where it's disabled in the role. Set to true to skip the enforcement.
+    type: string
 
 outputs:
   role_data:
@@ -45,6 +51,15 @@ outputs:
         step_config: ''
         config_image: ''
       upgrade_tasks:
+        - name: Enforce RHOSP rules regarding subscription.
+          include_role:
+            name: tripleo-redhat-enforce
+          vars:
+            skip_rhel_enforcement: {get_param: SkipRhelEnforcement}
+          when:
+            - step|int == 0
+            - ansible_distribution == 'RedHat'
+            - not (skip_rhel_enforcement | bool)
         # With the layered product packaging, the key package is rhosp-openvswitch. It depends on
         # a openvswitch package that includes the version as part of the name (e.g openvswitch2.10).
         # This requires some additional special handling: