US Homeland Security bans DeepSeek from federal civilian agencies

The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying DeepSeek's AI products and to remove them from government IT systems. The move widens earlier restrictions on the Chinese AI lab across the US government.

What the order says

The order, Exclusion and Removal Order 2026-01, was issued under the Federal Acquisition Supply Chain Security Act of 2018 on the recommendation of the Federal Acquisition Security Council. It is dated 24 July 2026, but only became public when it was filed on 19 October and published in the Federal Register on 20 October.

It applies to products and services from Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates. Civilian agencies, including the Treasury, State and Justice departments, must:

• exclude DeepSeek from future purchases, including approved product lists and e-commerce marketplaces
• remove DeepSeek products already on their systems
• remove third-party products and services built using DeepSeek implementations

National security systems are not covered, because those fall under separate defence and intelligence rules. Agencies could ask DHS for an exception within 60 days, but only with a compelling mission-critical reason and a plan to reduce the risk.

Why DHS acted

DHS says DeepSeek's models present "multiple threat vectors". Its concerns are:

• DeepSeek is based in China, where the law gives the government broad access to company data.
• Creating an account collects personal information that could be used to track and fingerprint users.
• Prompts from government staff or contractors could send sensitive data to China. Combined with public data, that "could produce actionable intelligence on US persons and/or government programs".
• The models could contain malware or other vulnerabilities. DHS also pointed to research finding critical flaws in DeepSeek's iOS app.

China's foreign ministry said it "consistently opposes the over-generalization of national security" and would protect the rights of its companies.

Part of a wider pattern

The order builds on earlier bans by the Defense Information Systems Agency, the US Navy and the Commerce Department, and limits in Congress on DeepSeek in intelligence systems. New York, Tennessee and Virginia have also restricted its use by state staff.

What it means for LLM hosting

The order is aimed at government systems, not private companies. However, many businesses sell to US agencies, and the clause covering "third-party products built using DeepSeek implementations" is broad.

Security experts have noted the open question. Running DeepSeek's open-weight models on your own infrastructure has a very different risk profile from sending prompts to DeepSeek's own app or API in China. The order doesn't clearly separate the two. If you supply US federal customers and use DeepSeek models anywhere in your stack, check with your contracting officer before relying on them.

For everyone else, DeepSeek's open-weight models remain widely available from US and European hosts that run them on their own GPUs, with no data sent to China. Browse the DeepSeek model family, or compare LLM hosting plans that offer DeepSeek models.

Sources: The Guardian, BBC News, Reuters, The Washington Times, TechRadar, IBTimes UK, Security Magazine.