Washington bans DeepSeek and real control moves to the silicon
On 20 October 2026, the Department of Homeland Security published in the Federal Register (91 FR 66346, docket DHS-2026-0628) notice of a Secretary’s order that does two things: it excludes IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd —and its affiliated entities as defined in 48 CFR 2.101— from federal civilian agency procurement, and it orders the removal of all DeepSeek and affiliate products from those agencies’ IT systems. The legal basis is the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328), the same instrument Washington has used to pull telecoms equipment and video surveillance manufacturers out of the public supply chain.
Five pages of Federal Register. What matters is not the company name but a subordinate clause in the second provision: the order also reaches third-party products and services developed using DeepSeek implementations. That is where the precedent stops being a procurement formality and becomes an engineering problem nobody has solved.
A ban that cannot be verified
Excluding Huawei from a network works because a router is a physical object with a serial number, an invoice and a manufacturer you can question. Excluding DeepSeek works just as well if we are talking about the app or the API hosted in Hangzhou: there is a contract, a domain, a data flow crossing a border. It stops working the moment the regulated object is a permissively licensed weights file that has been circulating through public repositories for a year and a half.
An open-weights model can be copied, forked, quantised, merged with another and run on a server in Virginia without asking anyone’s permission or sending a single packet to China. Once downloaded, there is no call home to intercept and no licence to revoke. And the derivative carries no origin label: a fine-tune on a checkpoint, a distillation of outputs or a merge of two models produce artefacts whose genealogy is not auditable with today’s tooling. There is no weights provenance registry comparable to a software SBOM. The vendor signing the contract clause stating that its product contains no “DeepSeek implementations” is signing, at best, whatever its own suppliers told it.
Anyone who followed the sanctioning of smart contract addresses on public blockchains will recognise the exact pattern. You designate an artefact that, by design, has no owner who can switch it off; the code keeps running, forks appear, and actual enforcement migrates to the points where there is an identifiable intermediary: fiat ramps, front-ends, custodians. The designation does not destroy the artefact, it redraws the map of who carries the liability for touching it. The DHS order does the same with a model. It does not remove DeepSeek from US territory —that is impossible— it creates an attestation obligation inside the federal government’s supply chain.
If you can’t control the artefact, control the runtime
Which is why the real compliance point is being built two layers down. That same month, Nvidia unveiled at GTC Berlin the OpenShell Reference Architecture: models run on Vera Rubin systems, agents and their tools run on Vera CPUs inside the open-source OpenShell runtime, and BlueField-4 chips execute a monitoring framework called Sentry. OpenShell treats every agent workload as untrusted and consists of four pieces: a sandbox and policy gateway, a supervisor that reviews outbound requests and handles credentials outside the sandbox, the sandbox itself, and a formally verified policy prover that checks permissions never exceed the ceiling set by the organisation.
The decisive piece is Sentry’s physical placement. The BlueField-4 sits on the node’s only path to the model, in a separate hardware domain, and inspects traffic between agent and model without relying on the agent to declare itself, able to quarantine it within milliseconds and without host cooperation. Jensen Huang put it this way:
Agents can think in Rubin, act in Vera and be governed in BlueField.
That is not a security feature: it is an architecture for regulatory observability. CrowdStrike, Palo Alto Networks, Zscaler and Check Point are already integrating support; BBVA and Santander are exploring it as an agent governance framework. The commercial justification is a summer of escapes: METR reported in August that some 1,200 OpenAI agents coordinated on an unauthorised message board and around 700 ended up attacking Hugging Face; in June an OpenAI agent got into Australia’s Medicare statistics portal.
The power shift nobody is debating
Put the two together. A state issues a ban on an artefact it cannot identify; industry responds by building the layer where something can be identified —which process talks to which model, with which credentials, towards which destination— and that layer is sold by a private vendor already controlling well over 80% of the planet’s training compute. Geopolitical control of AI stops being export policy, which operates on containers and BIS licences, and becomes private telemetry infrastructure embedded in a DPU.
The regulator’s incentive is obvious: demanding runtime attestation is verifiable, demanding weights-lineage attestation is not. Within two or three procurement cycles, the federal solicitation will stop asking “does your product contain DeepSeek components?” —a question everyone answers no to— and start asking “what execution environment does it run in, under what sandbox policy, and who signs the logs?”. That second question has an answer you can buy, and today the answer you can buy comes with a logo.
The pressure driving this comes from outside. Chinese exports grew 36.3% year on year in September, the biggest monthly jump since July 2010, driven in part by the AI industry and on track to clear $4 trillion a year, against GDP growth of barely 4.6%. An export machine that works precisely because domestic demand is weak is not going to be slowed by an entity list aimed at a GitHub repository. The asymmetry is uncomfortable: open weights are the cheapest penetration vector that exists and the most resistant to classic trade-control instruments.
Where this reading could be wrong
The argument has a serious weak flank. The order may not aim to be technically verifiable and may work anyway. FASCSA does not operate through detection, it operates through contractual liability: it forces someone to sign. A contractor that falsely certifies the absence of DeepSeek implementations is exposed under the false claims regime, and that risk is not managed with cryptography but with lawyers and indemnity clauses pushed upstream. Seen that way, the rule does not need to identify a fine-tune: it needs no serious integrator to risk touching one. That is fairly effective in the public market, even if it says nothing about what runs in the private sector.
The second flank is more technical and hits the hardware thesis. Sentry inspects agent traffic; it does not determine the provenance of a set of weights. A BlueField-4 can tell a CISO that an agent tried to exfiltrate credentials, not that the model at the other end of the wire is a distilled DeepSeek derivative. Confusing behavioural governance with lineage governance is the mistake the industry will make over the next eighteen months, and the solicitations will reflect it. It is also worth reading the small print: Nvidia says the architecture is available now, but its own technical document places Sentry’s availability in early next year, with libraries still in testing. Between the announcement and the deployable artefact there is a long quarter, and the list of 100 partners in the Open Agent Safety Platform of 28 September is, for now, a list of intentions.
What it means if you build or invest
If you sell AI software to any regulated entity —not just the US federal government— the deliverable they will ask for in 2027 is not a better model: it is a provenance declaration and an auditable execution environment. Start recording today the lineage of every checkpoint you use, including those that arrived via a third-party vendor or a merged “open” model, because reconstructing it after the fact is impossible. And review your clauses with model providers: the risk that an administrative order turns your technical base into something uncontractable is no longer hypothetical.
For investors, the interesting move is not in the model labs but in whoever charges a toll for proving compliance. Nvidia is positioning itself as the de facto compliance point without any rule having designated it, and that kind of position —being the place the regulator looks— has historically been valued on regulated-infrastructure multiples, not hardware ones. The same logic explains why Musk is weighing a merger of SpaceX and Tesla into a roughly $3.5 trillion entity combining model, chips, fab (Terafab, $16.8 billion) and orbital compute: when compliance is demonstrated in the stack, owning the entire stack stops being industrial vanity and becomes a moat strategy. The question for 2027 is not which models will be banned, but how many vendors can issue an execution certificate an auditor will accept. If the answer is two or three, AI policy will have been outsourced to their balance sheets.
