On October 20, 2026, DHS ordered every US federal civilian agency off DeepSeek — and not just the app and the API, but “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations.”[1][3]

The order lands 19 months after DISA started blocking DeepSeek on the Pentagon’s IT networks in January 2025, with the Navy, NASA and the House of Representatives doing the same.[1] State of Surveillance puts the scope plainly: the order reaches third-party products built on DeepSeek implementations, “which is where the enforcement difficulty sits.”[2]

Here is what the drafting does not resolve: a model you reach through someone else’s API gateway is not a DeepSeek deployment by name. OpenRouter, in its own documentation, “routes requests to the best available providers for your model” — it picks the provider for you.[4] Vercel AI Gateway does the same by default, “dynamically chooses the default providers to give you the best experience based on a combination of recent uptime and latency.”[5] Which is why, as The Register put it, federal civilian agencies could be running DeepSeek models without meaning to, if they haven’t constrained their AI providers.[1]

( Katie Moussouris, CEO of Luta Security, framed it this way: an AI software bill of materials “doesn’t record which tools developers used, so it would be no real help. Every vendor would have to attest that nothing it relies on ever touched DeepSeek. There’s no practical way to verify that.”[1] )

The security case underneath the order comes from NIST. In September 2025, the Center for AI Standards and Innovation evaluated three DeepSeek models against four US reference models across 19 benchmarks.[6] Agents built on R1-0528 — DeepSeek’s most secure model — were on average 12 times more likely than evaluated US frontier models to follow malicious instructions, and against a common jailbreak that model answered 94% of overtly malicious requests versus 8% for the US reference models.[6] The same report found one US reference model cost 35% less on average.[6]

The lesson for LATAM does not shrink because you sit farther from Washington: if your RFP does not name which provider and which gateway handle the requests, there is no way to audit where the data went before someone asks.[unverified]

Three clauses your enterprise AI/CV RFP needs:

  1. AI-vendor-jurisdiction-disclosure-clause.[1] The vendor documents every AI model, provider and AI gateway serving the customer’s product, with its origin jurisdiction and its prompt-retention policy.
  2. AI-gateway-routing-transparency-clause.[4][5] The customer can inspect and pin provider order on any gateway, with fallbacks disabled, and block specific models without contractual penalty.
  3. Federal-deprecation-mirror-clause.[1] The vendor notifies the customer within 14 days if any authority — a US federal agency, an EU member state, or another government — issues a deprecation order affecting the model serving them.[unverified]

In an enterprise CCTV operation this lands on your analytics layer, not just your chatbot: if your video analytics platform runs a computer vision model behind a gateway, every frame query lives or dies on that routing decision.[unverified]

P.D. Does your AI/CV RFP say today which model processes your footage, and which gateway the request travels through? If the answer is “I don’t know,” today’s a good day to find out.[unverified]

📰 Source: The Register (Oct 20, 2026) + DHS order DHS-2026-0628 in the Federal Register (Oct 20, 2026) + NIST CAISI (Sep 30, 2025) + OpenRouter and Vercel AI Gateway documentation.

Sources

[1] https://www.theregister.com/security/2026/10/20/deepseek-deep-sixed-at-all-us-federal-civilian-agencies/5304010 — The Register — DeepSeek deep-sixed at all US federal civilian agencies (Oct 20, 2026) [2] https://stateofsurveillance.org/news/daily-surveillance-briefing-october-21-2026/ — State of Surveillance — Daily Surveillance Briefing, October 21, 2026 [3] https://public-inspection.federalregister.gov/2026-21447.pdf — Federal Register — DHS-2026-0628 Notice of Order Regarding Exclusion and Removal of DeepSeek Products (Oct 19/20, 2026) [4] https://openrouter.ai/docs/guides/routing/provider-selection — OpenRouter Docs — Provider Routing [5] https://vercel.com/docs/ai-gateway/models-and-providers/provider-options — Vercel AI Gateway Docs — Provider Routing and Fallbacks [6] https://www.nist.gov/news-events/news/2025/09/caisi-evaluation-deepseek-ai-models-finds-shortcomings-and-risks — NIST CAISI — Evaluation of DeepSeek AI Models Finds Shortcomings and Risks (Sep 30, 2025)