The Department of Homeland Security has issued a sweeping order requiring federal civilian agencies to remove all products and services from Chinese AI company DeepSeek from their IT systems, marking one of the most significant federal actions against a foreign AI provider to date. The DHS DeepSeek ban, signed by Secretary Markwayne Mullin on 24 July 2026 but only made public on 19 October, gives agencies 60 days to complete the removal and prohibits future procurements of the technology.
Key takeaways
- DHS ordered removal of all DeepSeek AI products from federal civilian IT systems under supply chain security authority
- Agencies have 60 days from late July to complete removal; the ban also covers third-party services built using DeepSeek implementations
- Order cites data storage in China, transmission of user prompts to PRC servers, and identified security vulnerabilities
- Ban excludes Department of Defense, intelligence community, and national security systems
- CISA’s FASCSA Order Implementation Team will oversee compliance and monitoring
Scope of the Federal DeepSeek Prohibition
The order targets Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and critically, any third-party offerings built using DeepSeek implementations, according to MeriTalk. This broad definition means federal agencies must audit not only direct DeepSeek API integrations but also commercial software and services that incorporate DeepSeek models under the hood.
The ban applies exclusively to federal civilian executive branch agencies. Notably excluded are procurements by the Department of Defense, the intelligence community, and national security systems—suggesting those entities either maintain separate controls or have already addressed DeepSeek through classified channels.
DHS published the order through a Federal Register notice scheduled for 20 October, though the restrictions had already taken effect nearly three months earlier when Secretary Mullin signed the directive on 24 July under the Federal Acquisition Supply Chain Security Act of 2018.
Security Rationale Behind the Ban
The order asserts that “DeepSeek presents multiple threat vectors that pose significant risk to the cybersecurity of U.S. government systems,” according to the signed directive. DHS identified three primary concerns that drove the decision.
First, DeepSeek collects and stores user data on servers located in China, where national security laws grant the Chinese government broad authority to compel data access from domestic companies. Second, the department determined that user prompts and AI-generated responses transmit to servers in the People’s Republic of China during normal operation. Third, forensic analyses reportedly identified security and privacy vulnerabilities in DeepSeek’s implementations.
DHS warned that these practices could expose sensitive information about U.S. users and government programmes, and that even when combined with publicly available data, such information “could produce actionable intelligence on U.S. persons and/or government programmes.” The department also flagged DeepSeek models’ potential to generate inaccurate, biased, or harmful content—a concern that applies to many large language models but takes on heightened significance in a government context with potential adversary access.
Implementation Timeline and Agency Requirements
Agencies received 60 days from the late July effective date to fully remove covered technology from their systems. During this removal period, DHS advised agencies to implement enhanced security controls including network traffic monitoring, increased logging, data loss prevention measures, and other steps to mitigate the risk of data exfiltration.
The Cybersecurity and Infrastructure Security Agency will oversee implementation through its FASCSA Order Implementation Team, providing the operational structure for tracking compliance across the federal civilian enterprise.
Agencies can request exceptions, but must submit their request 60 days in advance and provide “compelling justification” such as an inability to fulfil a mission-critical function or other national security considerations. This high bar suggests DHS expects near-universal compliance rather than routine exception processing.
DeepSeek Models in the AI Landscape
DeepSeek has emerged as one of China’s most prominent AI companies, offering open-weight models that compete on both capability and cost with Western alternatives. The company’s DeepSeek V4 family includes models with pricing as low as $0.14 per million input tokens for the Flash variant and up to 1 million token context windows for the Pro version.
The relatively low cost and strong performance of DeepSeek models had made them attractive options for organisations seeking alternatives to more expensive frontier models from OpenAI, Anthropic, and Google. According to the Convly AI models database, DeepSeek R1 offers 128K context at $0.50 input and $2.15 output per million tokens, significantly undercutting many Western competitors.
Federal agencies had discretion to block models like DeepSeek prior to this order, and the Department of Commerce confirmed to FedScoop last year that some had already done so. The DHS directive transforms individual agency decisions into a government-wide mandate with enforcement mechanisms.
Implications for Federal AI Adoption
The ban reflects growing U.S. government concern about supply chain security in artificial intelligence, particularly for models developed in countries identified as strategic competitors. While the order focuses on DeepSeek specifically, the rationale—data storage location, cross-border data transmission, and potential foreign government access—establishes a framework that could extend to other Chinese AI providers.
For federal agencies evaluating AI tools, the order reinforces the importance of understanding not just model performance and cost but also data handling practices, server locations, and the legal obligations of AI providers under their home country laws. Agencies relying on AI API services must now verify that no DeepSeek implementations exist anywhere in their supply chain.
The three-month gap between the order’s signing and public disclosure raises questions about whether agencies received adequate time to identify and remove covered technology, particularly given the inclusion of third-party products that may not obviously incorporate DeepSeek models.
Broader Context of AI Geopolitics
The DHS action follows a pattern of increasing restrictions on Chinese technology in U.S. government systems, from telecommunications equipment to cloud services. Applying similar supply chain security logic to AI models marks a new front in technology competition between the United States and China.
Unlike hardware, where provenance is relatively clear, AI models can be integrated into software products in ways that obscure their origin. A commercial application might use DeepSeek for a specific feature without prominently advertising that dependency. The order’s inclusion of third-party implementations acknowledges this complexity but also places a substantial due diligence burden on federal buyers.
For AI developers, the order signals that model provenance and data handling architecture will increasingly influence government procurement decisions. Providers serving federal customers must be prepared to document not only their own practices but also any third-party models or services in their technology stack.
Frequently asked questions
Which agencies must comply with the DHS DeepSeek ban? Federal civilian executive branch agencies must remove DeepSeek products. The order excludes the Department of Defense, intelligence community agencies, and national security systems, which operate under separate authorities.
Does the ban cover only direct DeepSeek API use? No. The order covers products and services developed by DeepSeek and its affiliates, as well as third-party offerings built using DeepSeek implementations. Agencies must audit their entire technology stack for DeepSeek components.
Can agencies request exceptions to use DeepSeek models? Yes, but exceptions require 60 days advance notice and compelling justification such as inability to fulfil mission-critical functions or national security considerations. The high threshold suggests exceptions will be rare.
What security measures should agencies take during removal? DHS recommends monitoring network traffic, increasing logging, implementing data loss prevention controls, and taking other steps to address the risk of data exfiltration during the transition period.
How does this affect private sector DeepSeek use? The order applies only to federal civilian agencies. Private companies remain free to use DeepSeek models, though the government’s security assessment may influence private sector risk calculations.
The bottom line
The DHS order represents a decisive federal stance on Chinese AI in government systems, extending supply chain security principles from hardware and telecommunications to machine learning models. The 60-day removal timeline, combined with the prohibition on future procurement and the inclusion of third-party implementations, indicates DHS views the risk as both urgent and pervasive. As federal agencies complete their removal obligations and CISA tracks compliance, the order establishes a precedent that data residency, cross-border transmission, and provider jurisdiction will weigh as heavily as model performance in government AI decisions. For the broader AI industry, the action underscores that geopolitical considerations increasingly shape not just chip exports and cloud infrastructure but the models themselves.
Sources: cyberscoop.com, www.meritalk.com, www.wsj.com. Reported October 20, 2026.