The DeepSeek Ban Shows Open Weights Do Not Erase Where a Model Came From

On Monday the Department of Homeland Security made public an order telling every federal civilian agency to remove DeepSeek from its systems and stop buying it. That part was expected. Congress had already been circling DeepSeek for over a year, and a law passed last December covered intelligence systems. The part that matters for the rest of the market is one clause. The order also covers third party products and services "developed using DeepSeek implementations."

That language does not stop at the DeepSeek app or the DeepSeek API. It reaches software built on DeepSeek's open weights, the free downloadable versions that companies have been quietly running on their own servers since R1 shook the industry in January 2025. For a lot of founders, those weights were the whole appeal: frontier class reasoning at no licensing cost, running on hardware you control, with no data going back to China.

I think this order punctures a story the open model world has been telling itself, including me. Owning the weights solves the custody problem. It does not solve the origin problem. And origin is now something a buyer can ask you to certify.

Custody was never the whole question

Most of the DHS reasoning is about data. The order cites DeepSeek's handling of user information and the fact that a Chinese company can be compelled to hand data to Chinese authorities. If your concern is a government employee typing sensitive questions into a Chinese chatbot, the case is easy.

Running open weights locally answers that concern. I run open weight models, DeepSeek and Qwen among them, on hardware I own, so the prompts stay on my machines. That has been one of the strongest arguments for open models: you get the capability without handing your data to the lab that trained it.

But the order does not care where the model runs. It cares where the model came from and whether it shaped the product at any stage. That is a different kind of risk, and it is one that self hosting cannot fix. You can control every packet on your network and still be holding something a large customer has decided it will not buy.

The clause nobody can audit

TechTimes pointed out the practical problem. A vendor might run DeepSeek directly, which is detectable. But a vendor might also have used DeepSeek to generate training data, distilled its outputs into a smaller model, or fine tuned it into something that no longer contains the original weights. All of those count as "developed using" under a plain reading, and according to that reporting, no current audit standard tracks which models were used while a product was being built, only which ones run in production. CISA had not published guidance on that standard when the order was filed.

So every company selling AI software to federal agencies now faces a certification question it may not be able to answer with confidence. That is a real business cost, and it lands hardest on smaller vendors who grabbed the cheapest capable model in 2025 because it was the rational choice at the time.

The order technically applies only to federal civilian agencies. Private companies can still use DeepSeek however they like. But procurement rules rarely stay inside the government. Companies that sell to agencies tend to align their commercial products with federal requirements rather than maintain two versions. My prediction is that "what models did you use to build this" becomes a standard question on enterprise security questionnaires within a year, the same way questions about data residency did.

Who gains leverage

The obvious winners are American open weight providers. Meta launched Muse Spark Open last week and pitched it as a rival to leading Chinese models. Reflection has said it will release the weights for its 501 billion parameter Beam model under Apache 2.0 later this month. A week ago those were interesting alternatives. Today they come with a selling point the Chinese models cannot match for a big slice of buyers: a clean answer to the provenance question.

That changes how the price gap gets read. Chinese open models have been setting the price floor for capable AI. If a whole category of buyers now treats them as off limits, the effective floor for those buyers rises a little. Not dramatically, since the American open options keep getting better, but enough that model origin starts to function like a line item. Cheaper is no longer the only number that matters when two models are close in quality.

The closed labs gain something too. OpenAI and Anthropic have both accused DeepSeek of distilling their models, and this order validates their framing. But it also shows how far procurement rules can reach. Political risk is now attached to models in a way it was not two years ago, and no lab is fully exempt from that.

What this does to my thesis

I still believe open models win the long game. Models are commoditizing, and the durable value lives in workflow, data, distribution, and trust. This order does not change that. If anything it adds a new ingredient to trust. A model can be free, fast, and private and still lose a deal because of its passport.

What it does change is how I think about being model agnostic. I have always framed it as protection against price hikes and vendor lock in: if a lab raises prices or degrades a model, you swap it out. Now there is a third reason. A model you depend on can become unsellable overnight for reasons that have nothing to do with its quality. The companies that can swap a model out in a day will treat this order as a minor annoyance. The ones that baked a single model into their product, their fine tunes, and their training data will spend months untangling it, and some of them still will not be able to prove they are clean.

The other lesson is about records. Most small AI companies have no written history of which models touched which part of their product. That was fine when nobody asked. It is about to become one of those boring documents that decides whether a deal closes.

Here is the question I would want any AI vendor to answer before signing with them, and that every founder building on open models should be able to answer about their own product: if one of the models you used were banned tomorrow, how long would it take you to prove what it touched and replace it? If the honest answer is that nobody knows, the risk is already on the books, whether or not your customers have started asking.