DeepSeek
DeepSeek V3
vV3 · open-weights · Released December 26, 2024
Updated October 23, 2026
The US Department of Homeland Security directed all civilian federal agencies to remove DeepSeek products and third party services built on the DeepSeek model from their IT systems. The order also bars future acquisition of DeepSeek based products. DHS cited the risk of sensitive data transfer to China, potential intelligence collection on US persons, and possible malware embedded in the models.
Enterprise guidance
For any regulated enterprise use, deploy DeepSeek V3 as self-hosted open weights — do not use the DeepSeek API. DeepSeek's API routes data through China-based infrastructure subject to China's National Intelligence Law, which requires organizations to cooperate with state intelligence agencies on request and without notification. Self-hosted deployment via AWS, Azure, or GCP running the open weights eliminates this risk. Confirm that your chosen cloud host does not transmit data back to DeepSeek's own servers.
Active Compliance Flags2
Developed by a Chinese company. API service subject to Chinese National Intelligence Law (Art. 7). Self-hosting open weights removes API data residency risk.
DeepSeek API routes data through China-based servers. Financial services, healthcare, and defense organizations should use self-hosted deployment only.
Vendor compliance certifications
Key use restrictions
- —API: data subject to Chinese National Intelligence Law — not suitable for sensitive or regulated data
- —Self-hosted open weights: MIT-like license; suitable for most commercial use cases
- —DeepSeek AUP prohibits: harmful content, illegal content, content violating Chinese regulations
- —API outputs may be filtered to comply with Chinese government content requirements
Safety documentation
DeepSeek-V3 technical report published December 2024. Limited independent safety evaluation available. No published third-party red-team results.
Safety documentation →Related governance resources
Governance controls
Cross-Border Data Transfer Controls for AI
Govern international personal-data transfers through AI systems. Include transfers to AI service providers, model training systems, and cloud infrastructure in other jurisdictions.
AI Vendor Due Diligence
Assess AI vendors against security, governance, and compliance criteria before procurement and at defined intervals during the vendor relationship.
Self-Hosted Open-Weight AI Model Governance
Set intake rules for AI model files (weights) downloaded from public repositories and hosted internally. Check integrity, licensing, and safety before deployment. Manage ongoing updates separately from vendor-hosted AI procurement.
National Security and Dual-Use AI Risk Assessment
Assess AI systems and research with both commercial and national security or weapons applications. Address export controls from the US Commerce Department's Bureau of Industry and Security (BIS), defense-related ITAR arms export duties, dual-use research protocols, and monitoring for foreign adversarial misuse.
AI Procurement Risk Assessment
Assess technical, legal, privacy, and operational risks before approving an AI system or service purchase. Document the findings.
Playbook guides
How do we ensure third-party AI vendors meet our standards?
Review AI vendors for model transparency, data handling, bias testing, and contractual liability for their outputs.
How do we maintain data privacy compliance when using AI?
Review training data sources, data minimization, cross-border transfers, and applicable explanation duties under GDPR and the California Consumer Privacy Act (CCPA).
How are we managing third-party AI risks?
Govern external AI APIs and models embedded in vendor software. Review data handling, documentation, and ongoing monitoring.
Status history
October 23, 2026· yellow to red
The US Department of Homeland Security directed all civilian federal agencies to remove DeepSeek products and third party services built on the DeepSeek model from their IT systems. The order also bars future acquisition of DeepSeek based products. DHS cited the risk of sensitive data transfer to China, potential intelligence collection on US persons, and possible malware embedded in the models.
January 15, 2025· green to yellow
Elevated regulatory scrutiny of Chinese AI vendor jurisdiction risk following national security reviews in Western jurisdictions.