DeepSeek✓

Stav AI Act assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

• transparencyUnknown

  Flagship models (R1, V3, V3.2, V4-Pro, V4-Flash) released under MIT licence with full model weights on HuggingFace. MIT licence permits commercial use, derivative works, and distillation without restriction — explicitly confirmed in Terms of Use Section 4.2. Enables self-hosted EEA deployment that entirely eliminates the Chinese-server data path.

• transparencyUnknown

  Detailed technical reports and arXiv preprints published for all major model releases; DeepSeek-R1 paper subsequently published in Nature (September 2025); V4 technical report released April 2026. Academic-quality disclosure of model architecture, training methodology, and benchmark results is a genuine strength.

• transparencyUnknown

  Privacy policy updated February 10, 2026 to include an EEA/Switzerland/UK supplemental clause mapping processing purposes to GDPR legal bases and listing EU data subject rights. Terms of Use updated March 27, 2026 with an improved in-app opt-out toggle for model training ('Improve the model for everyone') — an improvement from prior email-only opt-out, though it has not resolved enforcement actions.

• securityUnknown

  Responded promptly to Wiz Research's responsible disclosure of the ClickHouse database exposure, securing the unauthenticated database within approximately one hour of notification — demonstrating incident-response capability even in the absence of a formal CVD programme.

• communityUnknown

  Active open-source community with 34+ GitHub repositories and a prolific HuggingFace presence. V4-Pro accumulated 174K+ downloads in its first week post-release; NVIDIA released an NVFP4 quantized variant in May 2026, signalling broad institutional adoption. Open-weights approach enables independent security research, red-teaming, and academic study.

• stabilityUnknown

  Operationally active and releasing new models as of April–May 2026, with V4-Pro (the largest open-weights model at the time of release) and V4-Flash launched April 24, 2026 under MIT licence. High-Flyer's financial backing from quantitative trading provides an unusual degree of independence from external commercial pressure.

Privacy policy

https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html

Flagged issues

2

• Italy's Garante issued an immediate definitive ban on processing Italian users' data (January 30, 2025) after DeepSeek initially claimed GDPR does not apply and provided a response deemed 'totally insufficient'. Berlin DPA escalated to Apple/Google under DSA Article 16 in June 2025, characterising DeepSeek as 'illegal content', coordinated with four German DPAs. Active formal GDPR investigations span at least seven EU member states. No SCCs, adequacy decision, GDPR Art. 27 EU representative, or DPA template for enterprise API customers have been put in place.critical
• User chat inputs are used to train models with a settings opt-out (improved from prior email-only opt-out in Terms of Use updated March 27, 2026). GDPR requires a clear legal basis and meaningful consent architecture. No Data Processing Agreement template is available for EU enterprise API users. The EEA supplemental clause added in February 2025 has not resolved EU DPA enforcement actions.medium

Privacy policy review

Country

🇨🇳 China

Open-weights policy

Mixed

Models in catalogue

0

Website

https://www.deepseek.com

GitHub

https://github.com/deepseek-ai

HuggingFace

deepseek-ai · Verified · 130,267 followers

HF published

87 models · 2 datasets · 26 papers

Creator profile

DeepSeek is a privately held Chinese AI research organisation, founded in 2023 and headquartered in Hangzhou, whose models (R1, V3-series, V4) are released under the MIT licence as open weights. While not CLOUD Act exposed, all user data is processed and stored in China, making it subject to Chinese national security and cybersecurity laws that can compel government access — a critical concern for EU regulated enterprises. The organisation has faced a formal Italian DPA ban, active GDPR investigations across multiple EU member states, a major unauthenticated database exposure, documented links between its researchers and PLA-affiliated institutions, and hardcoded connections to China Mobile in its consumer app code; EU enterprises should evaluate these risks carefully before deploying any DeepSeek API or consumer-facing service, though local self-hosted deployment of the open weights may substantially mitigate the data-sovereignty risk.

Stav editorial summary