You Own the Weights. That Doesn't Mean You're Allowed to Use Them.

Open weights are sold as sovereignty. The continuity half of that promise is real — a copy of the weights on your disk is not something a vendor can revoke. The permission half is not. On October 20, 2026, the US Department of Homeland Security published an order excluding DeepSeek products from federal civilian IT, and — in the clause that decides this whole piece — ordered the removal of "third-party products and services developed using DeepSeek implementations" (DHS Notice of Order, 91 FR 66346). The order attaches to the implementation, not the host. "We self-host it" is not an exemption. The same day, DeepSeek open-sourced DeepInfer, the inference framework that runs its own production services, making self-hosting easier in the exact week the government made self-hosting irrelevant to admissibility (DeepInfer, Apache-2.0; CryptoSlate, Oct 20 2026).

That collision is the story, and it is not about DeepSeek. It is about the difference between two questions every "we self-host, so we're sovereign" claim quietly merges into one:

  • Continuity:** can this keep running if the vendor cuts us off?
  • Permission:** are we allowed to operate it where our customers are?

Open weights buy you the first. They answer nothing about the second. By the end of this piece you will be able to separate the two, run a four-axis audit on every model in your stack (jurisdiction, possession, permission, swappability), and put a model behind an adapter with a named fallback — so that a procurement bar, a licence gate, or a jurisdiction call cannot reach the product you actually sell.

---

1. The claim under pressure

Here is the claim as it is usually stated, in the market's own words. Promoting the new Kimi K3.1, a post in this week's release feed put it plainly: "most importantly, it has open weights. You truly own it. It belongs to you. It's in your hands... this is about to become the most intelligent model you can actually own. Download it, and it will stay on your hard drive forever, free from the control or restrictions of any big company. Forever yours." (@ElainaNotes, Oct 23 2026)

That is the meme under pressure. It is also the reason a lot of solo founders and small teams are picking open-weight models right now — cheaper than frontier APIs, runnable on your own hardware, and, so the pitch goes, nobody can switch it off. If your customers sit in a regulated market, or you depend on a single model provider, this is the decision in front of you.

The claim has a true part and a false part, and they are welded together so tightly that most operators never notice the seam.

2. What the evidence actually says

The true part: possession is enforced by physics. Once a copy of the weights is on your cluster, no vendor can revoke it. That is a real guarantee — the one thing an API can never give you. When Anthropic suspended Claude Fable 5 and Mythos 5 on June 12, 2026 after a Commerce Department directive required cutting off access for any foreign national, inside or outside the US, the models went dark for every user worldwide because nationality cannot be verified in real time; controls were lifted June 30 and Fable was restored globally July 1 (Carlo Torniai, "Sovereignty Is What You Already Have On Disk," Jul 30 2026). A locally held copy is not exposed to that switch. Continuity is real.

The false part: possession is not permission. The DHS order's own sentence names both levers at once. It excludes IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co. — and removes "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology" (91 FR 66346). That second clause is the whole thesis. The restriction follows the implementation, so a product built on a restricted model can be barred from federal procurement even when nobody is hosting anything on DeepSeek's servers.

Reporting on the order reads it the same way: "Hosting DeepSeek technology on private infrastructure would not automatically exempt a product from the federal order, which expressly covers third-party implementations" (CryptoSlate). CIO.com frames it as a supply-chain problem, quoting an analyst who notes firms use DeepSeek "indirectly, through vendors... without necessarily knowing what's operating underneath" (CIO.com, Oct 20 2026).

To be precise about what is text and what is reading: the order's operative words — "third-party products and services developed using DeepSeek implementations" — are the document's own. The conclusion that this reaches a self-hosted product is the standard reading of those words by the reporting and analysts, not an adjudicated outcome. No court or regulator has yet tested how far a Federal Acquisition Supply Chain Security Act removal order reaches a commercial product sold outside the federal government. So state it as the order's plain text plus its standard reading — not as settled law.

The part that has nothing to do with confiscation at all. Wharton's Ethan Mollick supplies the crux, quoted in Torniai's essay: "No one is taking away your downloaded weights, but it is entirely possible to make any company avoid using them due to their higher risk." A government can make a model one that no regulated firm will put into production without touching a single byte on your disk. You keep the weights; you lose the market. Torniai's one-liner is the cleanest statement of the whole idea: "Downloading Chinese weights into Frankfurt buys jurisdiction and continuity. It buys no exemption."

That mechanism is jurisdiction-general, not an argument about one country's lab. Run the same logic in reverse — a US model used in the EU, the CLOUD Act, the AI Act, procurement screening — and the split holds. Possession is a fact about your hardware. Permission is a fact about someone else's rules.

3. Where the claim is right and where it falls apart

The open-weights sovereignty claim is right about the vendor's off-switch: a copy you hold is not revocable, and that buys genuine continuity. It is right that self-hosting moves you out of reach of a vendor's kill switch.

It falls apart the moment it is used to mean "therefore nobody can stop me." Two facts sit under that name:

  • The ban can attach to the implementation.** The DHS order reaches "third-party products and services developed using DeepSeek implementations," so self-hosting a restricted model does not exempt your product from the procurement bar. You escaped the vendor's switch and stepped onto the government's list.
  • Permission can be withdrawn without possession being touched.** Mollick's point: the weights stay with you, but the model can become one no regulated buyer will accept. You can lose the market while keeping the artifact.

And there is a third, quieter problem the marketing never prices: the same move that buys continuity hands you three new jobs. A hosted API means the vendor owns the sandbox — the evaluation environment, the egress policy, the guardrails, the uptime. Put the weights on your own cluster and every one of those becomes your configuration decision, your compliance decision, and your bill. As one analysis puts it: "When a model is served through an API, the vendor owns the sandbox. When the weights are on your own cluster, you own it." (AI in Asia, Aug 7 2026) Sovereignty is not a download. It is an operating commitment.

4. The better version: a four-axis model-dependency audit

The better claim is narrower and more useful: open weights buy continuity, not sovereignty. Possession is necessary but not sufficient. The same model can be perfectly runnable on your hardware and still unmarketable where your customers are, because jurisdiction attaches to the implementation and to the deployer, not to your disk.

So treat model choice as a supply-chain decision, on four axes. Ask all four of every model in your stack, before you build on it.

1. Jurisdiction — whose law governs this model and its supplier, and can a foreign order reach my product or my supplier?

The DHS order binds federal civilian agencies and their procurements; whether it reaches a product sold outside the government is untested. But the question is the point: if a regulator in one jurisdiction deems your model's lineage risky, can it reach your product through your supply chain, or your customers' procurement rules? Name the law that governs the model, the supplier, and each market you sell into.

2. Possession — do I hold runnable weights, or only an endpoint?

This is the continuity question, and it is the one open-weights advocates answer well. If the vendor went dark tomorrow, what still runs? A downloaded copy answers it; an API key does not. But note the trap: DeepSeek open-sourced DeepInfer, a serving framework, not the model weights — those are a separate artifact (DeepInfer). You need both a model and a runtime to be sovereign, and a runtime you do not have is not sovereignty either.

3. Permission — is this model admissible in every market I sell into, under its own licence and my customers' rules — and can I prove which model I shipped?

Two layers here, and operators routinely check only one. The first is procurement and sector rules (a government bar, financial or healthcare rules, the EU AI Act's deployer duties). The second is the model's own licence — and "open weights" is not "open licence." The Kimi K3 assessment records a custom, non-OSI "Kimi K3 License" with a $20M/12-month Model-as-a-Service separate-agreement gate and a 100M-MAU / $20M-monthly-revenue branding clause; training data, training code, and token/compute counts are undisclosed; and because the training compute is unpublished, the EU AI Act's 1e25-FLOP systemic-risk threshold is unknown while the licence most likely does not reach the open-source exemption — leaving an EU deployer to self-assemble the compliance material (AI Ownership Index, Kimi K3). That source is a single analyst's structured reading and explicitly marks some inputs unverified, so treat the FLOP determination as an inference, not a settled classification. The operational takeaway stands: admissibility is not one checkbox. And permission is only checkable if you can name the exact model you shipped — so keep provenance: version and weight hash.

4. Swappability — can I replace this model without a rewrite?

If it is not behind an adapter, with a tested fallback and a documented rollback, then any of the first three axes turning against you becomes an outage or a rewrite. Swappability is what turns a model ban from an existential event into a Tuesday. This is the axis that manufactures your options.

And the framing rule that sits over all four: continuity ("can it keep running?") and permission ("are we allowed to operate it here?") are different questions with different owners, and "we own the weights" answers only the first. The two are enforced by different instruments. Possession is enforced by physics. Permission is enforced by jurisdiction and the market. Two levers, two owners — and the operator who only asked "can I run it?" has not asked the question that decides whether they can sell it.

5. Two worked examples

Example one: the self-hosted model that is still barred. You are a three-person team with a federal-adjacent customer — a contractor that resells into a civilian agency. You chose a specified open-weight model partly because you can self-host it; the weights are on your own cluster, no vendor can switch you off. Run the audit. Possession: pass — you hold runnable weights, continuity is real. Jurisdiction: the model's lineage falls under a foreign order that binds your customer's federal procurement. Permission: your product is "developed using" a restricted implementation, and the order reaches third-party implementations — so your customer may be required to assess whether your product can keep serving the government. Swappability: if the model is hard-wired into your prompts, evals, and output formatting, replacing it is a quarter of work, not a config change. Three of four axes fail, and the one that passes — possession — is the one you optimized for. The continuity you bought did not buy you the market.

Example two: the licence gate you never read. You string up an open-weight model behind an API you resell to customers — a thin wrapper product. You "own the weights," so nobody can cut you off. Run the audit. Possession: pass. Permission: the model ships under a non-OSI custom licence with a scale-linked Model-as-a-Service gate and a branding clause, and your wrapper is exactly a Model-as-a-Service offering — so the licence term you skipped reaches your business model, not just the weights. Admissibility under your customers' rules is a second, separate check you have not run. Swappability: the wrapper is a rewrite if the fallback does not speak the same contract. The lesson is not "open weights are bad." It is that "I own the weights" is a true statement about a question one layer away from the one that decides whether you can operate. The AI in Asia note lands here too: procurement templates ask whether a model is safe, but "almost none ask whether the evaluation environment the model was tested in was network-isolated, egress-filtered and verified" — the compliance burden moves onto you the moment the weights do.

6. The bill that was not on the box

Three costs arrive with the move, and none appears in the sovereignty pitch.

The compute and operations bill. Running a frontier open-weight model is not a download. Moonshot's own serving guidance for Kimi K3 is a supernode of 64+ accelerators — roughly eight H100/B200-class servers — plus power, cooling, and at least two engineers. At low token volumes that is several times the cost of the same work through an API, and the crossover point is workload-specific (via Torniai; attribute the figures to Moonshot's serving guidance, not a universal spec). The cost of sovereignty scales with the workload you do not have yet.

The containment and compliance burden. Every guardrail the vendor used to own — egress filtering, network isolation, the evaluation environment, uptime — is now your configuration decision and your liability. The EU AI Act attaches to how a system is deployed, not to where the weights live, and its open-source carve-out narrows toward nothing past the systemic-risk thresholds. A licence with scale-linked gates (see the Kimi K3 terms) can trigger on how you operate, not on what you downloaded.

The dependency that sits below and above the model. Below it: the compute and the chips — US export licensing reaches the accelerators a model was trained on and the hardware you run it on, which is why a "sovereign" model can still be exposed one layer down. Above it: the licence and the deployer duties. The model was the wrong place to plant the flag. Torniai's formulation is the one to remember: sovereignty is not a download; it is what you already hold, on hardware you can still reach, operated by a party nobody abroad can instruct.

7. What to do first

Pick the one model your product most depends on and write the four answers down — not the intentions, the answers:

  • Jurisdiction:** whose law governs it, and can an order reach my product or my supplier?
  • Possession:** runnable weights or just an endpoint — and if the vendor went dark, what still runs?
  • Permission:* admissible in every market I sell into, under its licence and* my customers' rules — and can I prove which model I shipped (version, weight hash)?
  • Swappability:** is it behind an adapter, with a tested fallback and a documented rollback?

Where an axis fails, that is the gap, and it is usually cheaper to close now than after you have built on it. Then do the two things that cost the least and buy the most: put the model behind an adapter so it is swappable, and write down the named fallback with provenance for the exact weights you ship. If you can replace the model without a rewrite, a ban or a licence gate becomes a migration instead of a funeral. If you can prove which model you shipped, admissibility becomes a document you can produce rather than an argument you have to win.

---

Open weights buy continuity, not sovereignty. Possession is necessary but not sufficient: the same model can be perfectly runnable on your hardware and still unmarketable where your customers are, because jurisdiction attaches to the implementation and to the deployer, not to your disk. "We self-host" answers one question — can it keep running — and leaves the one that decides the outcome — are we allowed to operate it here — untouched. Audit your model dependencies on four axes: jurisdiction, possession, permission, swappability. Keep the model behind an adapter, with a named fallback and provenance for the exact weights you ship. The point of sovereignty is not that you possess the model. It is that you can still sell the thing that uses it.

---

Sources

  • DHS Notice of Order, 91 FR 66346; Docket No. DHS-2026-0628; FR Doc. 2026-21447 (published Oct 20 2026) — exclusions under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328); the operative clause: removal of "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology." Covers federal civilian executive-branch agencies including Treasury, State and Justice; excludes private consumers, the general public, state/local governments, and DoD national-security systems.
  • Public-inspection PDF of FR Doc. 2026-21447 — the order as filed (Oct 19 2026) before publication.
  • CryptoSlate (Oct 20 2026) — scope/timing (signed July 24 2026; 60-day CISA exception window; covers third-party products built using DeepSeek models) and the same-day DeepInfer/deepseek-recipe release; "hosting DeepSeek technology on private infrastructure would not automatically exempt a product from the federal order, which expressly covers third-party implementations."
  • CIO.com (Oct 20 2026, Taryn Plumb) — enterprise-supply-chain framing; CISA "compelling justification" exceptions; affected agencies; the five stated threat vectors; DeepSeek's "Open models. Open kernels. Open inference" post; the analyst line on indirect, unlabeled use.
  • github.com/deepseek-ai/DeepInfer (Apache-2.0) — "the high-performance inference framework that powers DeepSeek's large-scale production services"; supports DeepSeek-V4.1-Flash; built on vLLM. A serving framework, not the model weights.
  • Ethan Mollick, quoted in Torniai — "No one is taking away your downloaded weights, but it is entirely possible to make any company avoid using them due to their higher risk." (via search snippet / quoted in Torniai, not opened directly.)
  • Carlo Torniai, "Sovereignty Is What You Already Have On Disk" (Jul 30 2026) — the June 2026 Fable/Mythos suspension and restoration; the three sovereignty conditions; the Mollick quote; the Kimi K3 serving-cost figures (attributed to Moonshot's own guidance); "Downloading Chinese weights into Frankfurt buys jurisdiction and continuity. It buys no exemption."
  • AI Ownership Index — Kimi K3 assessment — "open_weights, not open-science"; custom non-OSI "Kimi K3 License" with the $20M/12-month MaaS gate and the 100M-MAU/$20M-monthly branding clause; EU AI Act 1e25-FLOP systemic-risk threshold unknown; open-source exemption likely not reached. (Single secondary source; some inputs marked unverified.)
  • AI in Asia (Aug 7 2026) — the self-hosting-transfers-risk mechanism: "When a model is served through an API, the vendor owns the sandbox. When the weights are on your own cluster, you own it."; procurement templates that nearly never ask whether the evaluation environment was isolated.
  • @ElainaNotes on Kimi K3.1 (Oct 23 2026) — the claim under pressure: "You truly own it... Forever yours." (Discovery input / the meme being tested, not evidence of anything.)

Honest-scope note: The DHS order's operative wording is primary and quoted verbatim; the conclusion that it reaches a self-hosted product sold outside the federal government is the standard reading by the reporting and analysts (CryptoSlate; CIO.com's analyst), not an adjudicated outcome — no court or regulator has tested how far an FASCSA removal order reaches a commercial product off the federal market. The Kimi K3 licence and EU-AI-Act details come from a single analyst publisher (AI Ownership Index) that explicitly marks some inputs unverified; the 1e25-FLOP systemic-risk determination is an inference, not a settled classification. The June 2026 Fable/Mythos off-switch sequence is relayed via Torniai's secondary essay and should be re-verified against Anthropic's own post before being quoted as fact; it is kept here because the mechanism — control attaching to a class of users defined by passport rather than to a country or a data centre — is the point. The operational-bill figures (64+ accelerators, ~8 servers, 2+ engineers) are attributed to Moonshot's own serving guidance as relayed by Torniai, not asserted as a universal spec; actual cost depends on quantization, batch size and utilization. DeepSeek open-sourced a serving framework (DeepInfer), not the model weights — those are separate artifacts, and this piece depends on keeping them distinct. This piece does not claim DeepSeek models are malicious or that any breach occurred; the documented fact is the restriction. It does not claim open weights are a bad choice or that self-hosting is futile — it claims possession answers only the continuity question, and the operator consequence is to also answer permission, admissibility and swappability. The possession-vs-permission split is jurisdiction-general: the same logic runs in reverse for a US model used in the EU. Write and read this as "as of the October 2026 DHS order" — the exception clock (roughly mid-December 2026), the DeepInfer repo, and the specific model licence terms are dated and will move; the structural tension and the four-axis audit are not.

---

X entryway list (distribution entryways named in the approved angle)

Hook type, the one claim each post carries, and whether it links to the article:

  • Hook: surprising proof point.* The DHS order's own sentence names both levers at once: remove all DeepSeek products and* "third-party products and services developed using DeepSeek implementations." The clause after the comma is the whole story — the ban attaches to the implementation, so self-hosting a restricted model does not exempt your product. The same day, DeepSeek open-sourced DeepInfer, making self-hosting easier and admissibility irrelevant in one move. → Links to the article (the two-facts-in-one-paragraph collision is the entry; the article is the mechanism behind it).
  • Hook: mechanism.** Possession is not permission, and the two are enforced by different instruments. Weights are enforced by physics — no vendor can switch off a copy on your disk (continuity). Permission is enforced by jurisdiction and the market — a government can bar your product from procurement, or make a model one no regulated firm will buy, without confiscating anything: Mollick, "No one is taking away your downloaded weights." "I own the weights" answers only the first question. → Links to the article (the mechanism stands alone; the article delivers the audit).
  • Hook: workflow.** The model-dependency audit — four axes before you build on any model: jurisdiction (whose law governs it, and can an order reach you); possession (runnable weights or just an endpoint — what runs if the vendor goes dark); permission (admissible in every market you sell into, and can you prove which model you shipped); swappability (behind an adapter, with a tested fallback). Continuity and permission are different questions with different owners. → Links to the article (the checklist is the reusable unit; the article is the full worked version).
  • Hook: risk.* Self-hosting quietly moves the risk from the vendor to you. A hosted API means the vendor owns the sandbox, the egress policy, the guardrails, the uptime. Put the weights on your own cluster and every one of those becomes your configuration decision — and your compliance decision, since the EU AI Act attaches to how a system is deployed*, not to where the weights live. → Links to the article (the risk consequence is the emotional entry; the article names the containment, licence, and compute bill in full).
  • Hook: result.** The exit from vendor dependence is not a download; it is a stack you can operate and a market that will accept it. Own the weights, keep the model behind an adapter with a named fallback, keep provenance, and treat admissibility as a first-class constraint — because the point of sovereignty is not that you possess the model, it is that you can still sell the thing that uses it. → Links to the article (the result stands alone; the article is the framework that gets you there).

Note: actual X posts are not written here — that is the distribution stage, after this draft is reviewed and the entryways approved.