Can EU companies legally use DeepSeek? The GDPR, the AI Act and the 2026 bans, explained

ai Nov 2, 2026 8 min read Caybles Research Desk

TL;DR

There is no EU-wide statute that prohibits companies from using DeepSeek, but there is also no clean legal answer. Data-protection regulators in Italy, Germany and Belgium have taken action against the hosted service, transfers of personal data to China face a structural GDPR problem, and the fully applicable EU AI Act adds transparency and deployer duties. Self-hosting the open-weight model is widely treated as the pragmatic compliance path, while hosted use of personal data is considered high-risk by most national guidance.

Few questions reach our desk more often from European engineering teams than whether DeepSeek is, in plain terms, allowed. The honest answer is that no single law settles it, and the landscape has been moving quickly — a United States government-wide removal order disclosed in October 2026, a Belgian ban for federal officials taking effect on 1 December, and a string of earlier actions by European data-protection regulators, according to reporting by BBC and Reuters. This piece sets out what is actually decided, what remains contested, and what compliance teams are doing about it.

What triggered the latest wave of restrictions

The most consequential recent step came from Washington, not Brussels. A determination signed by the Department of Homeland Security on 24 July 2026 and made public in October orders DeepSeek removed from most federal systems, citing the storage of user data in China and associated security risks, the BBC reported. The order targets government use rather than the private market, but its framing — that the data pathway itself is the risk — has travelled quickly through procurement offices elsewhere.

Belgium became the first EU member state to extend that logic to its own workforce: from 1 December 2026, all federal officials are barred from using DeepSeek, according to Reuters' October 2026 roundup of tightening scrutiny. They joined a longer queue. The Czech Republic excluded DeepSeek from public administration in July 2025, Luxembourg advised state employees against it, and Berlin's data-protection authority asked Apple and Google to pull the app from German app stores. Outside the EU, Australia, Taiwan and South Korea moved against DeepSeek on government devices in early 2025, according to contemporaneous reporting at the time.

Two features of this record matter for companies. The restrictions are nearly all aimed at the hosted service — the app and the API — rather than the model weights, which DeepSeek publishes openly. And the authorities involved are not coordinating through any single EU mechanism; each is applying national data-protection law to the same underlying concern.

Is DeepSeek actually illegal in the EU?

No. There is no EU statute that names DeepSeek, and no EU-level ban on using models trained in China. What exists is a patchwork of national actions, most of them grounded in the General Data Protection Regulation rather than in technology-specific law. Germany illustrates the distinction well: analysts advising German companies note that no formal statutory ban exists, but that data-protection authorities have taken action against the app and that the practical answer for processing personal data on the hosted service is usually no — while self-hosting the same model is treated as a different matter entirely, according to Compound's guidance.

That distinction — hosted versus self-hosted — is the single most useful cut through the confusion, because nearly every regulator action to date concerns the hosted service, where prompts leave the organisation entirely.

The structural issue is not the model's behaviour but the data pathway. Using the hosted service means personal data — and, for many enterprise use cases, customer data — is processed on infrastructure in the People's Republic of China. The GDPR permits such transfers only under specific safeguards, and China is one of the countries for which the European Commission has issued no adequacy decision. Transfers therefore require instruments such as standard contractual clauses plus a transfer-impact assessment, and privacy analysts have catalogued the compounding difficulties: Chinese law grants state access to data held by domestic companies, and DeepSeek itself has publicly taken the position that the GDPR does not apply to it because it is based in China — a position EU regulators have scrutinised rather than accepted, as Usercentrics' analysis recounts.

Italy's Garante, the data-protection authority that has led European enforcement on AI services, blocked DeepSeek's assistant within days of its European launch in early 2025. The speed of that action — and the absence of a comparable EU-level response — shaped how every subsequent national authority has treated the question: as a live data-protection matter rather than a settled one.

For companies that do not process personal data at all — some engineering, research or internal-analysis use cases — the GDPR analysis largely falls away, and the remaining questions are contractual and confidentiality-driven. Compliance is use-case dependent; there is no general yes-or-no, as comparative guidance on the question concludes.

The self-hosting workaround — and its limits

Because DeepSeek publishes open model weights, a company can run the model entirely on its own infrastructure, inside its own jurisdiction, with no data leaving the organisation. Most national guidance and legal commentary treat this as the pragmatic compliance path, and engineering teams have standardised on it for exactly that reason.

The workaround has boundaries worth stating plainly. First, EU AI Act obligations attach to the deployer of an AI system regardless of where the model runs: transparency duties toward users, and — for certain use cases classified as high-risk — documentation and human-oversight requirements that apply from the Act's general applicability on 2 August 2026, as the European Commission's regulatory framework page sets out. Self-hosting changes the data story; it does not switch off the Act. Second, security hygiene remains the buyer's problem: a capable model run on under-hardened infrastructure is still an incident waiting to happen. Third, corporate policy moves faster than law — several multinationals have restricted Chinese-origin models altogether, self-hosted or not, as a matter of risk appetite.

The EU AI Act layer on top

The Act's obligations now apply in full, and they reach Chinese models without naming any of them. Providers placing general-purpose models on the EU market face transparency and documentation duties, with additional obligations for models designated as carrying systemic risk. Deployers — the category most companies reading this fall into — carry duties that scale with the use case: informing users when they interact with AI, labelling synthetic content in certain contexts, and the heavier high-risk regime where employment, credit, essential services and similar domains are touched. Our side-by-side comparison of the Chinese framework and the EU AI Act maps the two systems against each other.

Brussels has also debated targeted delays to parts of the high-risk rulebook through its digital-omnibus package — a reminder that although the Act's architecture is settled, implementation dates can still move, and compliance plans should track the Commission's calendar rather than a fixed assumption.

What compliance teams are doing about it

The pattern we observe across European organisations is less a decision about DeepSeek than a decision about hosted Chinese services in general, of which DeepSeek is only the most prominent example. A workable posture looks like this:

Segregate use cases by data sensitivity. Hosted services only where no personal or confidential data flows; anything else self-hosted or avoided.
Treat the transfer question as primary. Where personal data touches a hosted Chinese service, the GDPR analysis dominates, and the absence of an adequacy decision does the heavy lifting.
Run the AI Act deployer checklist per use case. The Act attaches to what you do with a model, not to where it was built.
Watch the tracker, not the headlines. The regulatory instruments underneath these developments — filings, security assessments, standards — surface in the policy tracker well before they reach procurement guidance.

Frequently asked questions

Is DeepSeek banned in the EU?

No EU-wide ban exists. Individual member states have restricted it for their own workforces, and Italy's data-protection authority has blocked the hosted service. Private-sector use remains lawful in principle, subject to GDPR and EU AI Act obligations.

For the hosted service, most privacy guidance answers no for any use involving personal data: transfers to China lack an adequacy decision and DeepSeek has disputed the GDPR's applicability outright. Self-hosted deployments avoid the transfer problem and are treated as a different case.

Can I run DeepSeek on my own servers in Europe?

Yes. DeepSeek publishes open model weights, and self-hosting on EU infrastructure keeps data on-premises. EU AI Act deployer obligations still apply to the use case, but the GDPR transfer problem is removed.

Did the US government ban DeepSeek entirely?

The October 2026 order covers most federal government systems, not the private market. Its significance for companies is the signal it sends about the data pathway, which is reshaping procurement rules well beyond Washington.

What about other Chinese models — Qwen, Kimi, GLM?

The analysis is substantially the same, because it turns on the hosted-versus-self-hosted distinction and the transfer pathway rather than on any single vendor. Expect the Belgian-style workforce bans to widen across hosted Chinese AI services generally.

Sources

For a private briefing on what the restriction wave means for your organisation, talk to us.

Not advice. This article is published for general information and analysis only. It is not legal, regulatory, investment or professional advice, and it should not be relied upon as such — please do your own due diligence and consult qualified counsel for your specific situation. Regulatory positions described here may have changed since publication.