Homeland Security just ruled that where a model runs doesn’t matter. Who raised it does. Europe has been trying to say that about American clouds since 2018. Washington just wrote the brief.
Sovereign AI | theCUBE Research | Amit Eyal Govrin | October 2026
The ban that arrived three months late
Run the calendar back one week.
Saturday, October 17. DeepSeek posts a new checkpoint, V4.1-Flash-1017, to Hugging Face. 763 billion parameters, a one-million-token context window, MIT license. Free to download, fork, and run on any server you own. [1][2]
Monday, October 19, 8:45 a.m. The Department of Homeland Security files a notice for public inspection. The next morning, the Federal Register publishes it: an order “removing all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” [3]
The order itself is not new. Its original release date, printed on page one, is July 24, 2026, and it was signed by Secretary Markwayne Mullin. [3] CyberScoop reports that the letter ordering the exclusion is dated June 26. [4] Agencies had 60 days from issuance to request an exception. [3] Do the arithmetic. The exception window closed around September 22, roughly four weeks before the public could read what it was an exception to. [5]
Same day in Beijing, Foreign Ministry spokesperson Mao Ning said China “consistently opposes the overstretching of the concept of national security.” The Commerce Ministry expressed “strong dissatisfaction and firm opposition.” [6]
That’s the whole edition. The United States government just ruled, in writing, that a model’s address doesn’t matter. Its parents do.
Europe, take notes. You’ve been trying to make that exact argument about American clouds for eight years.
Why I’m with DHS on this one
Credit first, because this order is better work than the headlines suggest, and pretending otherwise cheapens the argument.
It uses a statute, not a press release. The order runs through the Federal Acquisition Supply Chain Security Act of 2018, after a Federal Acquisition Security Council recommendation. [3] It has a written exception process, reviewed by CISA, and a mandatory review “within one year and annually thereafter.” [3] That’s more due process than most model deprecation emails give you.
It shows its work. The appendix names its threat vectors and footnotes each one. [3] I have read a lot of sovereignty documents this year. Very few cite their sources.
And it understands where the supply chain actually is. Most early moves against DeepSeek targeted the app on the phone. This one goes after the implementation layer: the model inside someone else’s product. That’s the right layer. Most sovereignty frameworks are still arguing about the data center.
It’s also narrow. AP notes it is not a general ban on private or consumer use, and national security systems run under separate Department of War and intelligence community orders. [6][5] Washington didn’t ban a model. It decided what its own agencies run.
That is the most honest sovereignty document Washington has published this year.
Then you read the footnotes.
Read the reasons, then swap one word
Here is the load-bearing sentence of the order, verbatim:
“DeepSeek servers are located in the PRC, and the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure.” [3]
Read that twice. Then do what every European procurement officer is doing this week. Swap three letters.
Here is the United States Code, 18 U.S.C. § 2713, the CLOUD Act. A US provider must disclose data “within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.” [7]
Possession, custody, or control. Regardless of location. Last week I wrote that Europe got visitation rights and Microsoft kept custody. [8] It turns out custody is the actual statutory word.
In June 2025, Microsoft France’s director of public and legal affairs, Anton Carniaux, was asked under oath by a French Senate inquiry whether he could guarantee French data would never reach US authorities without French consent. “No, I cannot guarantee that,” he said, adding that it had never happened. [9] He was honest. The statute was too.
So the DHS reasoning is not a new sovereignty doctrine. It is the European sovereignty doctrine, with the flags swapped. The parent’s jurisdiction follows the product, wherever the product lives.
Contracts lose to statutes. In both directions.
Here’s the part nobody said out loud
Now look at the second half of the order. It reaches “third-party products and services developed using DeepSeek implementations.” [3] The order never defines the phrase. The Cloud Security Alliance went through it layer by layer. Self-hosted DeepSeek weights: “Very likely covered as a third-party implementation.” Fine-tunes and quantizations: “Likely covered; the weights inherit DeepSeek parameters.” [10]
Inherit. That’s a bloodline test.
Go back to the threat vectors and check which ones survive self-hosting.
Servers in the PRC? Not if the weights sit on your disk in Virginia. Account creation that “collects personally identifiable information” and may “digitally fingerprint users”? The order itself scopes that to “DeepSeek-hosted instances.” Prompts flowing to Hangzhou? Not from an air-gapped rack. [3]
One vector survives: “The models themselves may contain malware or other security vulnerabilities.” [3] May.
That’s a legitimate concern, and I’ll take it seriously in the pillars. But notice what is doing the work. Once you self-host, the order’s case rests on one “may” and one birth certificate.
Microsoft’s Foundry catalog lists DeepSeek V4 Pro as “Direct from Azure,” “Hosted on Azure.” [11] American landlord. American soil. American invoice. VentureBeat summed up the procurement logic in one line: “DeepSeek on an American server still counts as DeepSeek.” [12]
The house doesn’t matter. The parents do.
A small editorial note, because I read the whole appendix. Footnote 9 defines the affiliates of “DeepSeek AG.” [3] AG is a German company suffix. DeepSeek is still in Hangzhou. The paperwork has a few loose threads. The logic doesn’t.
And the family tree goes back further than you think. Nathan Lambert and Florian Brand at Interconnects asked whether the order reaches models trained on DeepSeek outputs, and floated Nvidia’s Nemotron as a possible example. [13] Meanwhile, Washington has accused DeepSeek of distilling American frontier models, which Beijing denies. [6] So the banned child may have American grandparents, and some American children may have a Chinese one.
Your model’s grandparents are now a procurement question.
Washington just wrote Europe’s brief
Let me be careful here, because this is where people pick teams. I’m not picking a team between Washington and Beijing. I’m grading the dependency, not the company. And the buyer just got a precedent.
The precedent is simple. A government may disqualify a technology because of the jurisdiction its developer answers to, regardless of where it runs, who hosts it, or the license.
Washington applied that rule to Hangzhou. It is a very short walk to apply it to Redmond and Seattle.
Watch the script. Beijing’s response was “overstretching of the concept of national security” and, from the Commerce Ministry, a complaint about suppression “under the guise of national security.” [6] The next time Brussels tightens the Cloud and AI Development Act’s sovereignty tiers, I’d bet on hearing nearly the same sentence from the other direction. Discriminatory. Overstretched. Same script, different accent.
Europe doesn’t have to win that argument anymore. Washington just signed it.
That’s not hypocrisy. That’s a precedent with your name on it.
The five pillars, under pressure
Same test I run on every vendor. This week the vendor is any open-weight model with foreign parents that you host yourself, and the buyer is anyone with a regulated customer, a public-sector contract, or a board that reads the news. Hi, federal contractors. Hi, Europe. Hi, everyone who self-hosted DeepSeek because it was the sovereign option.
01 Territorial
The question. Where do the weights and the compute physically live?
The story. On your disk, in your data center, behind your firewall. MIT license, no phone home. By every territorial test anyone has written, this is the sovereign configuration.
Under pressure. The order applies anyway. [3][10]
Verdict. Pass, and it didn’t matter.
02 Operational
The question. Who runs it, who holds the keys, who gets paged, and who can pull the plug?
The story. You do. Your team, your keys, your logs. No vendor can switch it off.
Under pressure. A vendor can’t switch it off. A regulator can make you switch it off. Under the federal contract clause FAR 52.204-30, contractors must run a “reasonable inquiry,” report covered articles within three business days of discovery, and update with mitigations within ten. [5]
Verdict. Holds until the ticket comes from legal instead of from a pager.
03 Technological
The question. Can you audit it, fork it, self-host it?
The story. Yes, yes, and yes. That was the whole point of open weights. But “may contain malware” is the one threat vector that survives self-hosting, and owning a weight file lets you freeze it and fork it. It does not tell you what is in it.
Under pressure. You fine-tune it, quantize it, rename it. On the CSA reading, the derivative inherits the parameters and the coverage. [10]
Verdict. Partial. You can fork the code. You can’t fork the birth certificate.
04 Legal
The question. Which jurisdiction governs, and can anyone enforce it on you?
The story. Two jurisdictions now claim a say over the same file. Washington says agencies can’t run it. Beijing has proposed its own approval regime for exporting advanced models, which I covered in the Permission Slip edition. [6][13] Your license says MIT. Neither government reads your license.
Under pressure. Your largest public-sector customer forwards the Federal Register link and asks for a lineage statement by Friday.
Verdict. Fail. The statute doesn’t care whose disk it’s on.
05 Financial
The question. Can you leave? On your timeline, at a survivable cost?
The story. This is where the order actually bites. A lot of teams picked DeepSeek because it was cheap, capable, and portable. The portability was real. The question is whether the swap is.
Under pressure. Three business days to report. Ten to show mitigation. [5] If replacing the model is a config change plus a regression run, you are fine. If it is a quarter-long migration, the order just sets your roadmap.
Verdict. Breaks, unless the swap is a config change.
Three out of five on the box. One out of five once the paperwork arrives. Open weights are necessary. They are not sufficient. I’ve been saying it for months, and a federal order just put it in writing.
The executive TCO
Three line items, none of which show up on the invoice:
- The paternity audit. You need a lineage record for every model in every product: base model, fine-tunes, distillation sources, and the vendors’ models inside your vendors. CSA’s point is the expensive one: training-data lineage “cannot be reliably reconstructed later.” [10] Record it now or pay a consultant to guess later.
- The forced swap. Re-evaluating, re-tuning, and re-certifying a replacement model on a regulator’s clock, not yours. Put a number on it.
- The lost discount. If DeepSeek was your baseline because the tokens were cheap, the savings were real until a customer’s compliance team priced them at zero. Model your unit economics at the price of your second-best option.
Same baseline-and-burst strategy as always, with one amendment. Baseline on open weights, and keep a second open-weight family from a different jurisdiction tested and ready. Two models with the same parents aren’t diversification. They’re siblings.
Own the crown jewels. Rent the edges. The model is an edge. Make sure you can prove it.
What to do Monday
- Inventory every model in production by lineage, not by name. Pull the base-model metadata and ask each supplier to attest to theirs.
- Start an AI bill of materials. CycloneDX and SPDX both have formats. [10] A spreadsheet beats a shrug.
- Run the 72-hour drill from the first edition of this newsletter. The model is prohibited. Not down. Prohibited. Can you keep operating?
- Keep one tested alternative from a different family and a different jurisdiction, with the regression suite already green.
- If you sell to the US government, check SAM.gov for new FASCSA orders every quarter. Crowell & Moring recommends the same cadence. [5]
- Ask every AI vendor one question: “Which models does your product run on, and who are their parents?” Then ask about the grandparents.
So who are your model’s parents?
Last week Europe got visitation rights, and Microsoft kept custody. This week Washington ran a paternity test, and it didn’t care whose house the kid lives in.
That’s the lesson for every buyer, on every side of every border. Residency was never sovereignty. Jurisdiction follows the parent. Washington just proved it about Hangzhou, which means Europe gets to use it about everyone else.
If you can’t name your model’s parents today, you don’t have a sovereignty posture. You have a model with no birth certificate, and a regulator who just started asking for one.
Amit
PS. On Saturday, AWS unplugged its European Sovereign Cloud from its global backbone for several hours to prove it can stand on its own. [14] AWS says results go to regulators and customers next. That’s next week’s edition. Keep the custody papers handy.
Amit Eyal Govrin is lead analyst for sovereign AI at theCUBE Research and CEO of Agentcy Labs, which designs and builds sovereign AI platforms for enterprises and governments. His research for theCUBE Research follows theCUBE Research’s editorial standards and is not sponsored or directed by Agentcy Labs. Agentcy Labs may hold commercial relationships with vendors covered in this research.
References
[1] Hugging Face, “deepseek-ai/DeepSeek-V4.1-Flash-1017,” model card (MIT license, 763B parameters), October 2026. Link
[2] Let’s Data Science, “DeepSeek ships a new model Saturday, DHS bans it from agencies Monday,” October 2026. Link
[3] U.S. Department of Homeland Security, “Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements,” 91 FR 66346, Doc. 2026-21447, Docket DHS-2026-0628, filed Oct 19, 2026, published Oct 20, 2026, with Appendix: Exclusion and Removal Order #2026-01 (original release date July 24, 2026). Link
[4] Derek B. Johnson, CyberScoop, “DHS to ban DeepSeek from federal civilian agencies,” Oct 19, 2026. Link
[5] Crowell & Moring, “FASCSA Orders Require Exclusion and Removal of DeepSeek AI,” Oct 21, 2026. Link
[6] Chan Ho-Him, Associated Press, “China defends DeepSeek after US ban of its AI from government systems,” Oct 20, 2026. Link
[7] 18 U.S.C. § 2713, “Required preservation and disclosure of communications and records” (CLOUD Act, Pub. L. 115-141, 2018), Cornell Legal Information Institute. Link
[8] Amit Eyal Govrin, “Europe Got Visitation Rights. Microsoft Kept Custody.,” Sovereign AI, theCUBE Research, October 2026. [link to last week’s edition]
[9] Paul Kunert, The Register, “Microsoft admits it ‘cannot guarantee’ data sovereignty,” Jul 25, 2025. Link
[10] Cloud Security Alliance AI Safety Initiative, “DeepSeek FASCSA Order: What ‘Developed Using’ Means for AI Supply Chains,” Oct 21, 2026. Link
[11] Microsoft Foundry model catalog, “DeepSeek-V4-Pro.” Link
[12] Carl Franzen, VentureBeat, “DeepSeek-V4.1-Flash-1017 arrives with improved benchmarks just as the U.S. government bans it from agencies — what enterprises should do,” Oct 19, 2026. Link
[13] Florian Brand and Nathan Lambert, Interconnects, “Latest open artifacts (#25): DeepSeek V4.1 Flash 1017, American-made models, and new regulatory controls in the US & China,” Oct 20, 2026. Link
[14] Stéphane Israël, AWS Security Blog, “AWS European Sovereign Cloud: Demonstrating an independent operation,” Sep 28, 2026. Link
