The U.S. Department of Homeland Security (DHS) has instructed federal civilian agencies to remove DeepSeek artificial intelligence products from their information technology systems and to stop acquiring relevant products and services.
This directive applies not only to DeepSeek’s applications but also to its affiliated companies and third-party products developed using DeepSeek technology, broadening its impact across government software supply chains.
US Government Bans DeepSeek AI
This notice will be published in the Federal Register on October 20, 2026, and identifies Hangzhou DeepSeek Artificial Intelligence Co., Ltd. as the targeted company.
It establishes distinct procurement exclusion and technology removal requirements for both future acquisitions and products already in use in civilian agency environments.
DHS issued this order under the Federal Acquisition Supply Chain Security Act of 2018, citing its statutory authority under 41 U.S.C. 1321–1328 and implementing regulations at 41 CFR 201-1.
The department stated that it followed a review of a recommendation from the Federal Acquisition Security Council, along with supporting evidence.
The procurement restrictions apply to information technology products and services developed by DeepSeek and its affiliated entities, with affiliation determined according to federal acquisition regulations at 48 CFR 2.101. Additionally, the removal requirement specifically includes third-party products and services developed using DeepSeek implementations.
This distinction makes the technology’s origin a critical compliance issue: agencies must assess the underlying AI technology in a product, not rely solely on the supplier’s name or the application’s branding. A third-party interface does not exempt a covered DeepSeek implementation from the removal requirement.
Reports indicate that DHS has warned that DeepSeek models pose “multiple threat vectors,” suggesting that government employees or vendors using them could transfer sensitive information to the People’s Republic of China. These statements reflect the department’s risk assessment rather than confirming that every covered deployment has experienced data theft.
For security teams, the removal directive’s broad language means that simply reviewing standalone chatbot installations will not sufficiently comply with the order. The stated scope also encompasses third-party products and services developed using DeepSeek implementations.
The directive creates two parallel responsibilities: preventing covered technology from entering civilian agency procurement pipelines and removing covered products from existing IT environments. As a result, procurement and cybersecurity teams share responsibility for identifying affected suppliers, products, and underlying implementations in line with the order’s specifications.
DHS published the notice under docket DHS-2026-0628 and identified the Cybersecurity and Infrastructure Security Agency’s FASCSA Order Implementation Team as the point of contact for implementation inquiries. The notice attaches the signed order and makes it available through the corresponding Regulations.gov docket.
This action targets federal civilian procurement and information systems; the published notice does not impose a general prohibition on private individuals using DeepSeek. Its immediate significance lies in explicitly including downstream, third-party implementations in government technology removal requirements.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
