The US bans DeepSeek in federal agencies. Companies need due diligence instead

The United States has ordered federal civilian agencies to stop buying and to remove DeepSeek products and services, including third-party products built on DeepSeek technology. The Department of Homeland Security warned that data handled by the company could be accessible to Chinese authorities under Chinese law (TechCrunch).

Others handled the same question differently. When DeepSeek appeared, the Swiss data protection commissioner told netzwoche in February 2025 that data protection in China is significantly lower than in the West and named three principles for every provider: transparency, proportionality and purpose limitation. That statement is from early 2025 and should be read as such.

The two approaches are a division of labour. A ban is simple and suits a government protecting its own systems. Companies in open markets need more: know where data is processed, under which law, and which model sits inside the products they buy. Open-weight models on your own servers are a legitimate option for sensitive work.

Asking these questions, reading the answers and documenting them is procurement work that every organisation now needs. It is a skill that office and administrative staff can add in a short course, and it makes them harder to replace.

Practical step: ask each AI vendor in writing where data is processed and which model is inside, and keep confidential data out of services that cannot answer.