The DeepSeek Vendor Check – Mathew's Library

01 What the order covers

On October 20, 2026, the U.S. published an order from Homeland Security removing DeepSeek from every federal civilian agency. DeepSeek is the Chinese AI company behind a popular chatbot and some of the cheapest AI models you can use. The order was signed on July 24 and stayed out of public view for 87 days.

It tells agencies to do two things, both right away:

Stop buying. No new purchases from DeepSeek or the companies tied to it. Remove. DeepSeek's own products, plus other companies' products built using DeepSeek.

It's not only DeepSeek's chatbot. It's another company's app, with its own name on top and DeepSeek working underneath.

Not 60 days. Some reports said agencies have sixty days. The sixty days were for an agency to ask for an exception, in writing, with a strong reason, and that window had closed before the order was public.

The order rests on a 2018 security law that lets the government ban risky tech suppliers from its agencies. Its reasons: DeepSeek's servers are in China, signing up collects personal information, typing into its apps may send sensitive data to China, and the models themselves may contain malware or other security vulnerabilities. Note the word may.

02 What it leaves open

The order never defines which products with DeepSeek inside count, and nobody has published a list. Agencies, and the companies selling to them, have to work it out themselves.

Question Answer today

Does it stop a company or a person from using DeepSeek? No. It covers federal civilian agencies only.

Does DeepSeek's model on U.S. servers count? The order doesn't say.

Does a free copy running offline on your own laptop count? The order doesn't say.

Which products are covered? No definition and no public list.

Why it's hard to answer: there's no ingredients list for AI software, so nothing on a product tells you which AI models went into it. Microsoft and Amazon both rent out DeepSeek's models to business customers, according to CIO. Services like OpenRouter send a request for a model to one of several companies that run it, and you can tell it to pick the cheapest or the fastest. So the name on a tool tells you who you pay, not whose AI does the work.

03 Four questions for any AI vendor

Start with the tools your team uses every day for writing, coding, support and meeting notes, because that's where client data goes.

Ask which AI models it uses, and who runs them. In writing: which models today, which company runs them, and in which country.

Open the settings. If the tool lets you pick a model, or picks one automatically, find out which one it actually uses. Routing can change without telling you.

Read the subprocessor list. It's the vendor's list of outside companies that handle your data. If the company running the AI isn't on it, ask why.

If you sell to the government, read your contracts. See section 4 for the two duties.

The vendor email

Subject: Which AI models run inside [PRODUCT]?

Hi [NAME],

We use [PRODUCT] for [WHAT YOU USE IT FOR]. Before [DATE], could you tell us in writing:

1. Which AI models does [PRODUCT] use today?
2. Which company runs each of them, and in which country?
3. Does the product ever route our requests to a different model or company, for example to the cheapest one that day? If so, which ones?
4. Are the companies that run those models on your subprocessor list? If not, why not?

Thanks,
[YOUR NAME]

Read the silence. A vendor that can't answer in a week is telling you something.

04 If you sell to the government

According to The Hacker News, a federal contract with clause 52.204-30 of the Federal Acquisition Regulation says two things when a product like this one is banned:

Check for new orders at least every three months. Put a recurring date in your calendar.

Report a banned product within three business days of finding it. Know who in your company sends that report.

None of this means DeepSeek is off limits for you. The order doesn't touch private use. It means you should know where it is, and decide on purpose.

Sources

Federal Register: the Exclusion and Removal Order (published October 20, 2026) The signed order (public inspection PDF) The Hacker News: U.S. orders DeepSeek removed from federal civilian systems CIO: US bans DeepSeek across federal agencies, putting AI supply chains under scrutiny OpenRouter: DeepSeek model page and providers Reuters via WHBL: DeepSeek wrapping up $15 billion fundraising

Mathew's LibraryLibrary card

Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.