US federal agencies must remove DeepSeek, including third party products built on it. Know which models your client automations call

If a client asked you today which AI models their automations call, could you answer in five minutes?

What happened

The US Department of Homeland Security ordered federal civilian agencies to stop buying products and services from DeepSeek and to remove them from government IT systems, TechCrunch reports. The order goes beyond DeepSeek's own products. It also covers third party products and services built using DeepSeek technology, though agencies can request exceptions.

According to TechCrunch, the DHS cited concerns that sensitive data from US government users could be accessible to Chinese authorities under Chinese law. The Decoder reports the order rests on a 2018 US law on supply chain security in federal procurement, sets no deadline, and leaves open what "built with" means, including whether AI gateways like OpenRouter fall under it. China's foreign ministry objected to the move.

My take

Most of my clients are not federal agencies. But some sell to them, and many sell to companies that copy federal rules into their vendor questionnaires. The question "does your product use model X anywhere" is going to show up more, and most automation stacks cannot answer it quickly.

The usual blind spots:

1. Gateways and routers that pick a model for you based on price.
2. Low code nodes where the model is set once and forgotten.
3. Third party tools inside the workflow that run their own AI under the hood.

What I set up for clients:

• A simple inventory: every workflow, every AI step, which provider and model, and where the data goes.
• Models set in one config place, not hardcoded in twenty nodes, so a swap is one change.
• Pinned models for anything touching regulated or government data, instead of automatic routing.

This is not a call about which lab is better. Rules like this change fast, and the teams that know their stack can adapt in an afternoon instead of a quarter.