DHS orders federal agencies to purge DeepSeek AI from IT systems
Homeland Security mandates removal of DeepSeek technology and third-party services relying on its models from civilian agency infrastructure.
Key points
- Federal civilian agencies must remove DeepSeek products and affiliated services from their systems.
- The ban covers third-party tools that utilize DeepSeek AI implementations, not just branded apps.
- DHS cites data collection risks and potential malware as the basis for the supply chain restriction.
The Department of Homeland Security ordered federal civilian agencies to remove DeepSeek technology from their IT systems, according to a notice filed for public inspection on October 19, 2026. The directive requires agencies to stop purchasing products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. It also mandates the removal of any third-party services that rely on DeepSeek AI models from existing agency infrastructure.
What specific technology is banned?
The order covers products from DeepSeek and its affiliates, as defined in federal acquisition regulations. Crucially, it extends to third-party products and services developed using DeepSeek implementations. This means agencies cannot simply block a chatbot with the DeepSeek name; they must identify and remove any tool that powers its features with DeepSeek technology, regardless of the vendor’s branding.
Why did DHS issue this order?
Homeland Security Secretary Markwayne Mullin stated that DeepSeek’s account generation process collects personally identifiable information and may track users digitally. The administration fears this sensitive data could be transferred to the Chinese government. Mullin also warned that the AI models themselves can include malware. DHS cited the Federal Acquisition Supply Chain Security Act of 2018 as the legal basis for treating AI as a supply chain risk.
Who does this order affect?
The directive applies to federal civilian agencies, such as the Department of State. It creates a government supply chain restriction rather than a nationwide ban on private use. Businesses and individuals are not prohibited from using DeepSeek by this order. However, vendors serving civilian agencies must now assess whether their own AI features depend on technology that government customers must exclude.
How should agencies identify affected tools?
Agencies need to establish what powers their existing AI services because the notice does not provide a public list of every affected third-party vendor. A review limited to branded chat tools could miss covered products. Contract records and technical documentation can help support the review to determine if a tool uses DeepSeek implementations, ensuring compliance with the removal requirement.
Questions to ask your suppliers
Security teams should ask vendors whether their AI features rely on DeepSeek models or implementations. Check if the supplier has disclosed any dependencies on Chinese AI labs in their technical documentation. Determine who inside the organization needs to be told about potential supply chain shifts. Teams usually require confirmation that third-party services do not ingest data into prohibited models. Verify that contract terms allow for rapid removal of non-compliant components.
What to do and how to stay safe: DeepSeek
- Review inventory of AI tools to identify any that use DeepSeek implementations, not just those branded as DeepSeek.
- Consult technical documentation and contract records to determine if third-party services depend on banned models.
- Monitor vendor communications for updates on compliance with the new supply chain restrictions.
- Prepare to remove identified tools from agency systems once the vendor provides an update or alternative.
Step-by-step guide: Browser Security Settings for Small Business Teams
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this ban apply to private companies and individuals?
No, the order creates a government supply chain restriction and does not prohibit businesses or individuals from using DeepSeek.
What is the legal basis for this action?
DHS cites the Federal Acquisition Supply Chain Security Act of 2018 and its implementing rules as the legal basis.
Are there other restrictions on DeepSeek?
Yes, the Navy and Department of Commerce previously instructed personnel not to use DeepSeek’s models due to national security concerns.
