The US government has ordered federal civilian agencies to remove DeepSeek products and third-party services built using its technology, according to reporting by TechCrunch. The stated reason is national security concerns. While the decision applies to US federal agencies rather than private companies or European organisations, it is another signal that AI model sourcing, vendor dependence and data exposure are becoming procurement and security issues, not just technology choices.

What happened

According to the source report, US authorities instructed federal civilian agencies to remove DeepSeek AI products from their systems. The order also covers third-party services that rely on DeepSeek technology.

Based on the source provided, the scope is a US federal government directive tied to national security concerns. The report does not, on its own, establish any new legal requirement for European businesses, nor does it confirm broader bans outside the US federal context.

Why it matters for European businesses

For European companies, especially those using generative AI tools across teams, the main issue is AI supply-chain risk. Many businesses do not only use a named AI model directly; they also access AI through SaaS tools, embedded assistants, coding platforms, customer support software or workflow products. If a government order targets both a model provider and third-party services built on that model, companies may need to know much more clearly which AI technologies sit underneath their software stack.

The development also matters because security and compliance teams are increasingly treating AI tools like other critical external services. Questions that were once mostly technical now affect procurement, governance and risk management, including:

• Where prompts and uploaded files are processed
• Whether business data could be retained or reused by the provider
• Which subcontractors or foundation models a SaaS vendor depends on
• How quickly an organisation could replace a blocked or restricted AI provider
• Whether internal policies distinguish between approved and unapproved AI tools

For European organisations in regulated sectors or public procurement chains, international scrutiny of AI vendors can also influence customer expectations. Even where there is no formal restriction, clients may ask for more transparency about model provenance, hosting arrangements and data handling.

Who may be affected

The immediate order is aimed at US federal civilian agencies, but the wider implications are relevant for several business groups in Europe:

• SMEs using AI assistants for internal productivity, customer service, document work or software development
• IT and security teams responsible for vendor reviews, acceptable-use policies and SaaS risk management
• Digital agencies and software providers embedding third-party AI models into client services or products
• Regulated businesses that must document controls around data processing, outsourcing and security
• Companies selling to governments or large enterprises that may face stricter supplier due diligence on AI components

Businesses may be particularly exposed if they do not have a current inventory of which external AI models are being used directly by staff or indirectly through software vendors.

What companies should consider

European businesses do not need to assume that a US federal directive automatically changes their legal obligations. However, they may want to use this development as a prompt to review AI governance and third-party risk.

• Map AI usage: identify where staff, teams and suppliers are using external AI tools or APIs, including embedded AI features in SaaS products
• Check vendor dependencies: ask software providers which foundation models or AI subcontractors they rely on and whether alternatives exist
• Review data exposure: confirm what information employees are allowed to submit to AI tools, especially customer data, source code, contracts and internal documents
• Plan substitutions: assess how easily key workflows could move to another provider if a model becomes restricted, unavailable or commercially risky
• Update policies: make sure internal AI-use rules cover approved tools, prohibited use cases and review procedures for new services
• Align security and procurement: treat AI tooling as part of normal supplier risk assessment rather than as an isolated experimentation issue

For European companies, the practical lesson is less about one specific provider and more about resilience. As AI adoption grows, organisations may need better visibility into the models behind their software, clearer controls on business data and contingency plans for rapid vendor changes driven by security, regulatory or geopolitical concerns.