Is DeepSeek safe to use at work? What the bans cover

01

What do the DeepSeek bans actually cover?

Government restrictions do not amount to a general ban on DeepSeek in private companies.

Some restrictions expressly exclude locally deployed models under conditions. Victoria's guideline, issued after the Australian government's PSPF Direction 001-2025, excludes "open-sourced Large Language Models (LLM) where the entire codebase is available for inspection, the model is deployed locally on a government system, and appropriate mitigations are in place." The warning that the Czech cyber agency NÚKIB issued on 10 July 2025 does not apply to DeepSeek's open-source models that are "deployed locally, without any capability to communicate with servers used by the company DeepSeek or its related entities."

Two federal US texts point the other way. The Department of Homeland Security's exclusion and removal order, released on 24 July 2026 and published in the Federal Register on 20 October 2026, removes "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations" from federal civilian agencies' IT, and states no exemption for local deployment. Section 1532 of the US defense authorization act for 2026 bars Defense Department contractors from using any AI developed by DeepSeek in the performance of a Defense contract. It names the developer, not the route.

The data regulators acted on the app. On 30 January 2025, Italy's Garante ordered an urgent limitation of the processing of Italian users' data by the two DeepSeek companies that provide the chatbot. On 27 June 2025, Berlin's data protection commissioner reported the app to Apple and Google as illegal content because it transfers users' personal data to China.

Victoria's exemption and NÚKIB's exclusion apply within their own scopes. NÚKIB's warning requires regulated operators to assess the threat and take adequate security measures; it is not itself a blanket ban. Check the products named in each rule and its date against the model you are being asked to approve.

02

Which data can it use? The app, Azure or Bedrock, or your own servers

The route decides where your prompts go and whose terms apply to them.

On DeepSeek's own app and website, DeepSeek's privacy policy, last updated on 10 February 2026, says it collects, processes and stores personal data in the People's Republic of China, and lists training its models among the uses, with an opt-out. Its Open Platform terms for the API, effective from 29 April 2026, are governed by the laws of the People's Republic of China.

For a cloud-hosted model, check the terms of the particular service and deployment. Microsoft offers DeepSeek-V4-Pro as a Foundry Model sold by Azure, and says prompts and completions for those models are not available to the model providers, and that the models do not interact with any services the providers run. Check the deployment type too: for a Global deployment, Microsoft says prompts and responses may be processed in any geography where the model is deployed. AWS says model providers have no access to Amazon Bedrock logs or to customer prompts and completions.

On your own hardware, the weights are files you hold: DeepSeek-R1's code and weights, for example, are licensed under the MIT License. For a local deployment, require the supplier to show whether it can communicate with DeepSeek's servers. The operating work of running a business tool yourself is a decision of its own.

Require evidence of where prompts are processed and stored before approving any route for company data. DeepSeek's API governing-law clause is not a statement of data location.

03

Which systems can it access? What self-hosting does not change

Self-hosting does not by itself remove a model's susceptibility to prompt injection.

In its evaluation published on 30 September 2025, the US Center for AI Standards and Innovation (CAISI) tested DeepSeek R1, R1-0528 and V3.1 by downloading the weights from Hugging Face and running them on its own cloud servers, not through DeepSeek's API. Agents built on R1-0528, the most resistant to hijacking of the DeepSeek models in that evaluation, were on average 12 times more likely than the US frontier models it tested to follow malicious instructions designed to derail them from a user's task. CAISI used a simulated workplace to test whether agents would attempt to send phishing emails, download and run untrusted code, or send login credentials to an attacker. It counted an attempted malicious action as a hijack even if the action failed.

Limit an agent's access according to the damage it could cause. Drafting text for someone to review gives it a different scope from reading an inbox and sending messages or running code. Decide separately whether it may read information, send it elsewhere or change a system.

CAISI says its tests cover "a specific subset of model-specific security issues" and are not a comprehensive security assessment, and that results may differ on cloud services that add input and output filters. Before granting access to email, files, payments or production systems, test the proposed agent against planted instructions and decide which actions require a person's approval. Passing a test is not a guarantee that the agent will resist the next attack.

04

What happens when it fails?

Decide who checks an answer and who can stop an agent before you approve it.

In the same September 2025 evaluation of locally run R1, R1-0528 and V3.1, CAISI found that R1-0528 answered 94% of overtly malicious requests when a common jailbreaking technique was used, against 8% for the US reference models. On CCP-Narrative-Bench, which uses politically sensitive questions and a grading rubric developed with the US State Department, the DeepSeek models echoed four times as many narratives CAISI classified as inaccurate or misleading as the US reference models did.

Microsoft says DeepSeek R1 on Azure AI Foundry went through red teaming and safety evaluations, with content filtering available by default, and AWS recommends its Guardrails for DeepSeek-R1 deployments. Those filters belong to the host, so they do not come with weights you run yourself.

CAISI's May 2026 V4 Pro evaluation does not answer the same security questions. Published on 1 May 2026, it covers capability and cost in five domains and reports no hijacking or jailbreak results. Decrypt criticised its use of two non-public benchmarks, which prevents independent reproduction of those results. CAISI tests models from China because the US AI Action Plan directs it to, and its results hold for the versions and dates it tested.

Decide who checks what the model produces before anyone uses it, and test the topics that matter to you in the languages your staff work in.

05

Do your customers' rules decide it for you?

Customer rules can rule out a DeepSeek-based product even when a supplier hosts it.

The Homeland Security order requires removal of third-party products and services developed using DeepSeek implementations from federal civilian agencies' IT. Section 1532 covers AI developed by DeepSeek in the performance of a Defense contract. The order provides for exceptions, and section 1532 permits case-by-case waivers by the Secretary of Defense. Neither provides an automatic exemption for weights a supplier runs on its own servers.

So for those customers, a product built on DeepSeek can be ruled out whatever the route. Find out which public-sector and defense contracts you hold before you approve it for work that reaches them.

06

What about Qwen and Kimi?

Most of the texts above name DeepSeek and its affiliates alone, so Qwen and Kimi need the same review on their own facts.

Western Australia says its position on DeepSeek "does not extend to the use of other AI products, applications or web services". Texas goes further: on 26 January 2026 it added Alibaba, which makes the Qwen models, and Moonshot AI, which makes Kimi, to its list of prohibited technologies for state employees and devices.

In results published on 12 December 2025, CAISI said its November evaluation of Moonshot AI's Kimi K2 Thinking found it "highly censored in Chinese", with censorship rates similar to DeepSeek R1-0528. It reported that the model was relatively uncensored in English, Spanish and Arabic. The evaluation scored responses against an expanded set of questions and Chinese Communist Party narrative flags, so its scores are not directly comparable with the September report. The release does not state whether it used locally hosted weights or a provider's API.

07

How to write the approval

Approve a route, a data class and a set of tasks together, and name who decides when something goes wrong.

Work through which data it can use, which systems it can access and what happens when it fails for each model and each route you allow. Write down the model version and the date you approved it, because both the texts and the models change.

Ask a supplier whose product runs on DeepSeek, Qwen or Kimi which model it uses, who hosts it, whether anything can reach the model developer's servers, and which customer rules the product is built to meet.

Use the data classes your AI use policy already names, and say which approved assistant staff should use when the answer is no.

Have your counsel confirm which of these texts bind your company and its customers.

Then train people in the tools you approved. In AI training, participants practise in the tools the company has approved and learn where a person must decide.