DHS Bans DeepSeek AI Tech in Civilian IT Under 2018 Law, Citing China Data Risks

The Department of Homeland Security ordered all federal civilian agencies to remove DeepSeek artificial intelligence technology from their IT systems and prohibited future procurement of its products and services, according to the Wall Street Journal. The directive was published in the Federal Register on Monday, extending previous restrictions that had already targeted intelligence and defense departments.

What does the ban cover?

The order applies to DeepSeek’s own products as well as third-party tools built on its AI models, Bloomberg reported. It bars federal civilian agencies from purchasing these services and requires the removal of existing installations from government networks. Agencies may request exceptions to the rule, though the default mandate is immediate removal and a halt to all new contracts involving this technology.

Why is DHS acting now?

The department cited national security concerns, specifically the risk that sensitive user data could be shared with the Chinese government under Chinese law, according to Bloomberg. The order also noted that the models pose multiple threat vectors and may conceal malware or security flaws, Reuters reported. These concerns align with broader scrutiny of Chinese AI firms regarding data handling and model distillation techniques.

Who signed this order?

Homeland Security Secretary Markwayne Mullin signed the directive, which is dated 24 July, Bloomberg reported. The order leverages a 2018 supply chain security law that allows the government to exclude risky suppliers from federal buying. This action follows earlier moves by the Pentagon, Commerce Department, and Navy to block DeepSeek tools on work devices and in national security systems.

What is the current status?

Some agencies had already limited DeepSeek’s tools prior to this directive. A Pentagon IT agency blocked its chatbot in January 2025, and other departments had issued similar bans. The White House had previously held off on blacklisting DeepSeek and over 100 other Chinese firms in June, despite a panel recommending their inclusion on a US trade blacklist, according to the source material.

Questions to ask your suppliers

Security teams should ask vendors whether their solutions rely on DeepSeek models or components built on its technology. Procurement officers need to verify if any current contracts involve services that could be affected by this federal directive. Legal counsel should review existing agreements for clauses related to supply chain changes or forced removals. Incident response teams must prepare to identify and isolate any affected systems quickly. Ensure that all stakeholders understand the operational impact of removing these tools from production environments without disrupting critical business functions.

What to do and how to stay safe: DeepSeek

• Audit current IT systems to identify any software or services utilizing DeepSeek AI models or components.
• Review vendor contracts to determine if they include third-party tools built on prohibited technology.
• Monitor official government channels for updates on exceptions or additional guidance on compliance.
• Prepare internal communication plans to address operational changes required by the removal mandate.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does the ban apply to private companies?

The order specifically targets federal civilian agencies, though it may influence private sector vendors supplying the government.

Can agencies keep using DeepSeek tools?

Agencies must remove them, though the order allows for requests for exceptions to the mandate.

What law authorizes this action?

The directive was issued under a 2018 supply chain security law that permits the exclusion of risky suppliers.