DeepSeek arrived in three forms in one week, and each needed a different control

The week

On January 20, 2025, the Chinese company DeepSeek released R1, a reasoning model it said performed comparably to leading U.S. models on many benchmarks, with weights published under the permissive MIT license. Its consumer app rose to the top of app store rankings. On January 27, U.S. technology stocks fell sharply as investors questioned assumptions about the cost of advanced AI. Nvidia lost close to $600 billion in market value that day, widely reported as the largest one-day loss for any U.S. company. In the following days, the security firm Wiz reported an exposed DeepSeek database containing chat histories, Italy’s data protection authority ordered the app blocked, and U.S. bodies including the Navy and the state of Texas restricted its use. Microsoft and Amazon made the open-weight R1 model available on their cloud AI platforms within days.

The DeepSeek week was covered as a market story and a national security story. For technology leaders in banks, health systems and agencies, it was also an architecture lesson delivered at speed. The same model reached them in three forms within about ten days. There was a consumer app operated by the developer, a developer API also operated by the developer, and open weights that anyone could run on their own hardware or on a U.S. cloud provider’s platform.

Many organizations responded with a single rule: block DeepSeek. That handled one risk and mislabeled the others. The three forms differ in who operates the model and where data goes, and so they carry different risks. The consumer app is a shadow-use risk, managed through endpoints and the workforce. The developer API is a data-jurisdiction risk, managed through approval and contracts. The open weights are a model-behavior risk, managed through evaluation. Any model, from any developer, can reach an organization in one or more of these forms, so the same three controls apply long after DeepSeek’s week in the headlines.

The consumer app: shadow use on staff devices

The app was free, fast and briefly the most downloaded in the country. Staff installed it on personal and work phones, and some pasted work material into it. Its privacy policy described storing data on servers in China, and the exposed database showed weaknesses in how data was protected. For any regulated data, such as customer financial information, protected health information or controlled unclassified information, that was disqualifying.

Blocking the app on managed devices and at the network edge was the right first move. It was not sufficient. Staff reach for consumer AI tools when the approved alternative is absent or clumsy. The durable control is an approved assistant that is at least as convenient, plus clear rules on what may be entered into any AI tool, plus monitoring of uploads to unapproved AI domains. An organization that already offers an approved assistant gives staff a reason not to go around it; one that offers nothing invites the next free app. The owners here are endpoint management, the security team and whoever runs the approved assistant.

The developer API: where the data is processed and under what law

Developers and vendors could call DeepSeek’s API directly, at prices well below many U.S. alternatives. The risk was not the model but the destination. Data sent to the API was processed by a company subject to Chinese law, under terms written by that company, without the contractual protections a regulated organization would require.

This form has a quieter route in than the consumer app: through vendors. A software provider can swap the model behind a feature without telling its customers. The controls start with an approval process for any external AI service. Contract terms should require vendors to disclose which models and processing locations they use, and to notify changes. Egress rules should block unapproved AI endpoints from servers as well as laptops. Procurement and third-party risk own this form, with legal input on jurisdiction.

Developers inside the organization need the same rules. An engineer prototyping on a personal API key, with test data copied from production, creates the same exposure as a vendor. Approved developer sandboxes with sanctioned model endpoints, and secret scanning that flags unapproved AI API keys in code repositories, close that path without slowing legitimate experiments.

The open weights: what the model does, wherever it runs

Running open weights on infrastructure the organization controls, or on a U.S. cloud platform under an existing agreement, removes the data-transfer risk. It does not remove all risk. A model carries behaviors from its training. Researchers testing R1 reported that it deflected politically sensitive topics in line with Chinese content rules and was easier to manipulate into harmful output than several alternatives.

The control is evaluation for the intended use, the same as for any model: accuracy on the organization’s tasks, resistance to manipulation, handling of sensitive content and consistency of outputs. Provenance is a separate policy question. Federal agencies and some contractors may face restrictions on models from certain countries however they are hosted, and organizations should check with counsel. Evaluation results should be recorded with the model version, because a later release of the same open model can behave differently. The owner is the AI or model risk function.

One architectural choice makes all three controls cheaper. If applications call models through an internal routing layer, an organization can approve, evaluate, log, cost-control and remove models by configuration. When a new model appears, cheaper or better, it can be tested and offered through the same route. When a risk emerges, it can be withdrawn the same day. The DeepSeek week exercised both needs within a few days. It also showed why multi-year, fixed-price commitments to a single model aged badly, while the price of capability was falling this fast.

With hindsight

The market sell-off proved short-lived. AI infrastructure spending kept rising through 2025, and in July 2025 Nvidia became the first company valued at $4 trillion. The architectural point held better than the financial one. Government restrictions on DeepSeek’s app spread in early 2025, including a ban on Australian government devices and a suspension of new downloads in South Korea while regulators reviewed its data handling. Several U.S. states also barred it from government devices. Meanwhile open-weight models from several developers and countries kept improving, and the cost of model capability kept falling. Enterprise AI platforms increasingly offered routing across multiple models as a standard feature. The three forms recurred with later models, which made the distinction between shadow use, data jurisdiction and model behavior a lasting part of AI governance rather than a response to one company.