Why the US government is removing DeepSeek — and what it signals for everyone else
The US Department of Homeland Security has ordered DeepSeek removed from most federal government systems, citing the storage of user data in China and associated security risks. The order covers government use, not the private market — but its reasoning, that the data pathway itself is the risk, is already reshaping procurement rules in allied capitals and inside companies. For vendors and buyers alike, the practical lesson is to segregate use cases by data sensitivity before a regulator or client does it for them.
When Washington moves against a Chinese technology product, the details of how it moves tend to matter more than the headline. The DeepSeek case is no exception: the order now reshaping federal IT practice is narrow in scope, sweeping in implication, and — for companies outside the US government — mostly a question of what it teaches procurement offices everywhere about the way they think about Chinese AI services.
What the order actually says
A determination signed by the Department of Homeland Security on 24 July 2026 and made public in October directs the removal of DeepSeek from most federal government systems, according to BBC reporting. Two findings anchor the order. The first concerns data: user information processed by the service is stored in China. The second concerns consequence: that storage arrangement is assessed as a security risk to the systems and the users connected to them.
The scope deserves as much attention as the findings. The order addresses government systems, not the American market. Nothing in it prohibits a private company, a university or an individual from using DeepSeek, and the model's open weights remain freely available — including to the US researchers who helped make the model's cost efficiency famous in the first place. The distinction is deliberate. Washington has, in effect, split the question into two: whether the model is useful (uncontested) and whether the hosted service's data pathway is acceptable inside government systems (answered in the negative).
The company of restrictions it keeps
The US order arrived after, not before, a long sequence of comparable moves by other governments. Italy's data-protection authority blocked the hosted assistant within days of its European launch in early 2025. Australia, Taiwan and South Korea restricted DeepSeek on government devices the same season. The Czech Republic excluded it from public administration in July 2025; Luxembourg advised state employees against it; Berlin's data-protection authority asked Apple and Google to remove the app. Belgium's federal workforce ban takes effect on 1 December 2026, according to Reuters. Our companion analysis follows the European thread in detail.
Read together, the sequence shows governments converging on a shared premise from different legal starting points — privacy law in Rome and Berlin, procurement and security law in Washington, workforce rules in Brussels. The premise itself is unglamorous: a hosted service operated by a company subject to Chinese jurisdiction presents a data pathway that government systems cannot accept.
Why the reasoning matters more than the ban
For organisations that will never run a federal system, the operative question is not whether DeepSeek is banned — in most markets it is not — but which parts of the reasoning will generalise.
The answer, on the evidence so far, is nearly all of it. The order's logic does not depend on DeepSeek specifically; it depends on the category — a hosted AI service whose data lands under a jurisdiction with state data-access powers. That same logic reaches other Chinese model providers with hosted services, and procurement teams in both the public and private sector have begun applying it as a screening question rather than waiting for each vendor to be named. It also explains why self-hosted deployments of open-weight models are treated so differently across these same government actions: when the data never leaves the buyer's infrastructure, the pathway finding has nothing to attach to.
The counterpoint worth holding onto
It remains possible to over-read the signal. The US order says nothing about model quality or capability, and the same month's reporting shows DeepSeek continuing to expand commercially in markets where no restriction applies, as ai-regulation.com's review of the model's first year notes. Open-weights distribution means the underlying technology circulates regardless of hosting policy. And none of the actions to date, American or European, establishes that the model itself is unsafe — the findings are about data governance, a narrower claim.
The open question, and it is genuinely open, is whether hosting restrictions harden into broader technology controls. Export-control specialists have long modelled that escalation path; nothing in the current record requires it.
What this means for companies
Three practical consequences follow from the record so far.
- Assume clients will ask. Government-adjacent vendors in the US and EU should expect questionnaires about Chinese-origin hosted services in their stack — including tools adopted by individual teams without central approval.
- Segregate by data pathway, not by vendor. The distinction every regulator has drawn is hosted versus self-hosted. Internal architectures should mirror it, so that an answer to a client's question is one sentence rather than a project.
- Track the instruments, not the announcements. The decisions that matter arrive as filings, determinations and standards documents, usually weeks before coverage. The policy tracker indexes those primary documents as they are published.
Frequently asked questions
Did the US ban DeepSeek nationwide?
No. The order covers most federal government systems. Private-sector and research use remain lawful, and the open model weights are unaffected.
Does the order affect companies that sell to the US government?
Indirectly, and significantly. Prime contractors and their suppliers face assurance requirements on the tools in their delivery chain; a hosted Chinese AI service in a delivery pipeline now has a specific named precedent against it.
Is this an export control?
Not as drafted. The determination governs federal system hygiene rather than technology transfer. Analysts watch the export-control channel separately.
Will other Chinese AI services be next?
The order's reasoning is category-based, not vendor-specific. Nothing announced extends it — but procurement screening based on the same logic is already observable.
Sources
- BBC — US orders DeepSeek removed from government systems (October 2026)
- Reuters — Governments and regulators increase scrutiny of DeepSeek (October 2026)
- AI Regulation — DeepSeek one year later: regulatory storm, global surge
Tracking where this goes next: the Caybles policy tracker follows the primary documents from CAC, MIIT, NDRC and MOFCOM as they are published, and Signal analyses what they mean.