The U.S. Department of Homeland Security (DHS) has ordered all federal civilian executive branch agencies to remove DeepSeek AI products and any third-party services built on DeepSeek from their information technology systems, and to exclude them from future procurements. The order, published in the Federal Register on October 20, 2026 as FR Doc. 2026-21447, was signed earlier in the year and has been in effect for months, according to Bloomberg.
The notice identifies products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates, as well as third-party products and services built on DeepSeek implementations, as covered by the exclusion. DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321–1328) and its implementing regulations at 41 CFR 201-1, according to the Federal Register notice.
Why DHS acted
DHS said DeepSeek models present what it characterized as multiple threat vectors. It warned that use by government employees or vendors could result in the transfer of sensitive data to the People’s Republic of China, potentially producing actionable intelligence on U.S. persons or government programs, according to BNN Bloomberg.
DHS also said the models may collect personally identifiable information, track or digitally fingerprint users, and may themselves contain malware or other security vulnerabilities, The Hill reported. The available sources do not document any confirmed incident in which DeepSeek was used to breach or exfiltrate data from U.S. federal systems, leaving open whether the concerns rest on classified intelligence or broader threat modeling.
Who is affected
The ban covers all federal civilian executive branch IT systems, including departments such as Treasury, State and Justice, but explicitly does not extend to the Department of Defense. Some agencies, including the Department of Commerce and the Navy, had already barred DeepSeek from government devices before the order became public, according to BNN Bloomberg.
The scope has drawn criticism for its breadth. The Register noted that the order’s language is broad, potentially sweeping in services that merely embed DeepSeek models. BleepingComputer reported that the order requires removal of DeepSeek products from government systems and bars procurement going forward.
What agencies must do
- Remove all DeepSeek and DeepSeek-affiliate products, and any third-party services built on DeepSeek implementations, from civilian agency IT systems.
- Exclude those products and services from future procurements.
- Monitor inbound and outbound network traffic for DeepSeek-related risks, as CyberScoop reported, with enhanced logging and tighter controls on data exfiltration, and flag anomalous activity during the transition.
- Submit written requests for exceptions or compliance delays within a 60-day window from the order’s issuance; the Cybersecurity and Infrastructure Security Agency (CISA) will approve or deny them in writing, according to GovInfoSecurity.
A July DHS memo had already instructed agencies to monitor traffic to and from government websites for DeepSeek-related risks, Yahoo News reported, before the broader order was made public.
Diplomatic fallout
China’s Foreign Ministry on October 20 condemned the ban, saying it disregards a consensus on artificial intelligence cooperation between Xi Jinping and Donald Trump, Reuters reported. DHS has framed the order as a supply-chain and data-security measure rather than a response to a known compromise.
Several details remain unclear as of October 20. Reports differ on the order’s internal signing date, citing both June 26 and July 24. No technical advisory or public statement from DeepSeek about the ban has been identified, no CVE or CVSS entry tied to the security concerns DHS cites has been published, and it is not yet known how aggressively CISA will grant or deny exception requests from agencies with mission-critical dependencies on tools built on DeepSeek models.