DHS discloses order barring DeepSeek AI from civilian federal agencies, including tools built on it

The Department of Homeland Security has barred federal civilian agencies from buying or using artificial intelligence products from the Chinese developer DeepSeek, including other companies' software built on its models, under an order signed in July that the department made public on Monday, Oct. 19.

What the order requires

The Department of Homeland Security has ordered federal civilian agencies to stop buying artificial intelligence products from the Chinese developer DeepSeek and to remove them from their computer systems. The order also covers other companies' products and services built using DeepSeek's technology.

The ban is not new. The order, signed by Homeland Security Secretary Markwayne Mullin, carries an original release date of July 24, 2026. DHS made it public on Monday, Oct. 19, by filing a notice with the Federal Register, which is publishing it on Tuesday, Oct. 20.

The order, numbered 2026-01, was issued under the Federal Acquisition Supply Chain Security Act of 2018, a law that lets the government shut risky technology suppliers out of federal systems and purchasing. It tells civilian agencies to do two things. First, exclude DeepSeek, its affiliates and their products from agency purchasing, including approved-product lists and e-commerce buying channels. Second, remove DeepSeek products, along with third-party products and services "developed using DeepSeek implementations," from agency IT systems.

It applies to civilian executive-branch agencies, such as the Treasury, State and Justice departments, which the BBC listed as examples. National security systems and secure compartmented information systems are carved out, and the Pentagon and intelligence agencies fall under separate authorities.

Why DHS calls DeepSeek a risk

The order says DeepSeek's models "present multiple threat vectors." It notes that the company's servers are in China and that Chinese law gives government cyber and intelligence agencies broad access to private company infrastructure. It says DeepSeek's own hosted services collect personal information and may track and digitally fingerprint users.

Because DeepSeek's apps work by sending users' prompts to the model, the order says, their use "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors." It adds that the models themselves may contain malware or other security flaws, citing outside research that found multiple critical vulnerabilities in DeepSeek's iOS app.

DeepSeek is the only Chinese AI developer named in the order, according to CyberScoop, though other open-weight Chinese models, including Moonshot AI's Kimi and Alibaba's Qwen, have also worried national security officials or drawn accusations of copying U.S. models.

Why vendors should pay attention

The third-party clause is what gives the order reach beyond DeepSeek's own chatbot. DeepSeek publishes its models openly, so developers can run them on their own servers and build them into other software. The order's definition covers third-party implementations of DeepSeek "used to provide products and services to civilian agencies," which puts the burden on contractors and software sellers to know what models sit inside the tools they supply.

DeepSeek's models are also available through U.S. platforms. The BBC noted that Snowflake, Vercel and OpenRouter all offer them to customers. Nothing in the order limits what those companies sell to private businesses; it governs what civilian agencies may buy and run.

Agencies that wanted to keep a covered product could ask for an exception, but only in writing within 60 days of the order's issuance and with a "compelling justification," such as harm to a mission-critical function. The Cybersecurity and Infrastructure Security Agency, part of DHS, reviews those requests. Counting from July 24, that window closed around Sept. 22, nearly four weeks before the order was made public.

Until removal is complete, the order encourages agencies to monitor traffic in and out of their networks, add logging and controls against data exfiltration, and flag unusual activity. DHS must review the order within a year and every year after that.

From a patchwork to one rule

Federal limits on DeepSeek had been piecemeal until now. The Commerce Department and the Navy had already banned its use on government devices, and states including New York, Tennessee and Virginia took similar steps, Reuters reported. Agencies had largely used their own discretion; this order sets one rule across the civilian government.

It also comes as DeepSeek's reach grows. Its free chatbot app ranks among the most downloaded in Apple's App Store, and startups have adopted its models because they cost a fraction of closed rivals to use. Anthropic and OpenAI have accused Chinese AI companies, DeepSeek among them, of copying their models.