Companies selling AI software to US civilian agencies must now check whether their products run on DeepSeek models, since services built on them are also covered.
The US Department of Homeland Security has ordered federal civilian agencies to take DeepSeek products out of their information technology systems and to stop buying them, and the ban extends to third-party services built on the Chinese company’s models. The notice was filed in the Federal Register on October 19 and is scheduled for publication on October 20. Reuters, in a report carried by Business Standard, and the South China Morning Post, which is owned by Alibaba, both quoted DHS as saying use of the products "may result in the transfer of sensitive data to the PRC if used by US government employees or vendors."
The order is older than its publication. IBTimes UK identified it as Exclusion and Removal Order #2026-01, dated July 24, 2026, and reported that exclusion and removal took effect on issuance unless an agency obtained an exception. CyberScoop described a letter from Homeland Security Secretary Markwayne Mullin ordering DeepSeek’s exclusion on June 26 and said the ban had been in place for months. The published notice gives no effective date; the signed order sits in docket DHS-2026-0628.
DeepSeek is the only Chinese model named, according to CyberScoop. None of the reports carried a comment from the company, and Reuters said the Chinese Embassy in Washington did not immediately comment.
DHS used a 2018 procurement security law to reach DeepSeek-based services
The notice cites the Federal Acquisition Supply Chain Security Act of 2018 and its implementing rules, and says the Secretary acted after reviewing a recommendation from the Federal Acquisition Security Council. Affiliates are defined by reference to federal acquisition rules. The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates, and reaches third-party products and services developed using DeepSeek implementations.
The law split this power three ways, according to law firm Mayer Brown: the Secretary of Homeland Security issues orders for civilian agencies, the Secretary of Defense for defense systems, and the Director of National Intelligence for intelligence systems. The first order under the law, posted in September 2025, barred the intelligence community from using products of the Swiss company Acronis. IBTimes UK reported that national security systems fall outside the DeepSeek order and under separate authorities.
Mullin’s letter, as described by CyberScoop, argues that DeepSeek stores data on servers in China, where national security laws allow the government to request data from domestic companies, and that its hosted models collect personally identifiable information. Reuters quoted DHS as saying such data could "produce actionable intelligence on US persons and/or government agencies" and that the models "may contain malware or other security vulnerabilities." A July DHS memo, also released on October 19, told agencies to monitor traffic to and from government websites for DeepSeek-related risks.
The third-party clause shifts the work onto software vendors
Earlier restrictions were narrower. The Commerce Department and the Navy had banned DeepSeek on government devices, and New York, Tennessee and Virginia had taken similar steps, Reuters reported. CyberScoop said agencies had previously blocked such models at their own discretion.
The new order reaches any product built using DeepSeek. Gabrielle Hempel, a security operations strategist at Exabeam, told Security magazine that the wording is broad and raises questions about software provenance and supply chain compliance. She added that a locally deployed model with proper controls carries a different risk from a service hosted abroad.
Contractors also carry obligations. Under federal contract clause FAR 52.204-30, Mayer Brown wrote, contractors must monitor for orders under the law, make a reasonable inquiry into covered products and notify contracting officers when they find any; the Acronis order required reports within three business days. Agencies seeking an exception must show a compelling justification, such as a mission-critical function, and propose mitigations, IBTimes UK reported. Until removal is complete, agencies are encouraged to strengthen logging and controls against data exfiltration.
Beijing has yet to answer the order directly
China’s public reaction so far is generic. Guancha, in a report carried by Sina, quoted an earlier foreign ministry statement that China’s AI progress comes from technological self-reliance and open cooperation, and that all parties should work together on AI that is open, inclusive, broadly beneficial and for good (开放包容普惠向善). The ministry’s October 19 briefing did not address DeepSeek. When the Commerce Department banned DeepSeek on its devices in March 2025, spokesperson Mao Ning said China opposes stretching the concept of national security and politicizing trade and technology issues, The Paper reported.
The order lands as DeepSeek seeks outside capital; its reported financing target has doubled while terms remain open. US officials have made sharper claims before, including one who said in July that DeepSeek was aiding China’s military and intelligence operations.
DHS must review the order within a year and annually after that, according to IBTimes UK. Under the law, Mayer Brown noted, appeals against an order go to the US Court of Appeals for the D.C. Circuit within 60 days of notice of it. A filing by DeepSeek there, or a matching order from the Pentagon or the intelligence community, would widen the dispute beyond civilian agencies.