Sourced note
A model bill of materials, before the buyer asks
A US federal order on DeepSeek now reaches third-party products built on its models, not only DeepSeek's own app, across federal civilian agencies. So list the four ways a model gets into your product, on one page, before a buyer asks.
Why this question is coming
In October 2026 the US Department of Homeland Security made public an order requiring civilian federal agencies to remove DeepSeek products, and "third-party products and services developed using DeepSeek implementations", and to stop buying them. The order itself was issued in July 2026 and published with a notice in the Federal Register (FR Doc. 2026-21447).
Leave the politics aside. The operational part is the second clause: it reaches products built on a model, not only the model's own app. The order applies to federal civilian agencies, not to private companies, and it covers "DeepSeek and DeepSeek-affiliate products", not AI models in general. My judgment is that large buyers' security reviews will start asking the same kind of question anyway: which model, where, and who checked?
The four rows
Models get into a product in more than one way. One page covers it:
| Row | What to write down | Where to look | Owner | Last checked |
|---|---|---|---|---|
| Direct API calls | Provider and model version each feature calls | Your code and provider invoices | ||
| Self-hosted weights | Which open-weight model, which version, where it was downloaded | Deployment configs | ||
| Fine-tuned or distilled models | The base model each one started from | Training records | ||
| Embedded third-party tools | The chat widget, transcription service, coding assistant or agent in your stack, and the models they use | The vendor's contract and docs; if they don't say, ask the vendor |
The third row is easy to miss, because it looks like your own model, but it still carries its base model. The fourth row is the one you control least, and it is the kind of dependency a clause like "developed using" is written to catch.
Put one name in the owner column: the person who keeps that row current.
A short answer for the buyer
When a buyer asks, an answer in this shape is a reasonable start:
Our product uses [provider / model, version] for [feature], called through [API / self-hosted]. [Feature] runs on a model fine-tuned from [base model]. Third-party tools in the product: [tool], which uses [model, per vendor docs dated ...]. [Name] owns this list; it was last checked on [date]. We will tell you when it changes.
This is a template, not legal advice. If you sell into a regulated sector, check the exact wording your buyer's rules use.
First step this week
Send your three biggest vendors one question: "Which models does your product use, and will you tell us when that changes?" Their answers fill the fourth row.
If you want help working through your own list, get in touch.