The United States has taken its broadest step yet against the Chinese AI company DeepSeek. The Department of Homeland Security (DHS) has ordered all federal civilian agencies to stop buying DeepSeek products and services and to remove any already in use, citing the risk that sensitive data could end up in the hands of the Chinese government. The notice was posted for public inspection on Monday, 19 October 2026, and was due to be published in the Federal Register on 20 October.
What the order covers
- IT products and services from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates.
- Third-party products and services "developed using" DeepSeek implementations.
- Agencies must keep DeepSeek out of future purchases and remove existing installations.
The order was issued under the Federal Acquisition Supply Chain Security Act of 2018, following a recommendation from the Federal Acquisition Security Council. According to CyberScoop, it was signed by Homeland Security Secretary Markwayne Mullin, and the underlying DHS letter is dated 26 June, which may mean the policy has quietly applied for months.
Agencies can request an exception, but only with at least 60 days' notice and a "compelling justification", such as a mission-critical task that cannot be done any other way. While removal is under way, agencies are encouraged to monitor network traffic, improve logging and guard against data leaks. No firm removal deadline has been reported.
Importantly, the order applies only to federal civilian agencies. It does not stop private companies or individuals in the US from using DeepSeek.
Why the US acted
DHS's reasoning, as summarised in the notice and media reports:
- DeepSeek is a privately owned company based in China, and its models present "multiple threat vectors".
- Chinese law can allow the government to obtain data held by domestic companies.
- Creating an account collects personal information, and every prompt sends data to the model.
- That data, alone or combined with public information, could reveal intelligence about Americans or government programmes.
- The notice warns that use "may result in the transfer of sensitive data" to China and that the models "may contain malware or other security vulnerabilities".
A long road to a ban
| When | What happened |
|---|---|
| January 2025 | The Pentagon’s Defense Information Systems Agency began blocking DeepSeek; the Navy, NASA and the House of Representatives took similar steps |
| February 2025 | A bipartisan bill, the No DeepSeek on Government Devices Act, was introduced but did not advance |
| Early 2025 | Australia, Taiwan, Italy and South Korea restricted DeepSeek |
| March 2025 | The Commerce Department banned DeepSeek on government equipment |
| October 2026 | DHS orders removal across all federal civilian agencies |
Texas was the first US state to ban DeepSeek on government devices. US AI companies and officials have also accused DeepSeek of "distilling" American AI models to train its own.
Questions and criticism
Security experts broadly accept banning DeepSeek's own app and API on government systems, but some parts of the order are drawing questions. Katie Moussouris, CEO of Luta Security, told The Register that the "developed using" wording is vague and practically impossible to verify. She also argued that banning DeepSeek's open models when they are hosted on US servers goes too far, because local hosting removes most of the data-flow risk.
It is also unclear whether AI "gateway" services, which route requests to many different models including DeepSeek's, fall under the order. DHS did not respond to requests for comment from The Register or CyberScoop.
What it means
- For government IT teams: an inventory of every tool and service that might use DeepSeek models, including inside third-party software.
- For AI vendors selling to the US government: pressure to disclose which models power their products.
- For businesses and consumers: no legal change, though many companies follow federal security guidance when setting their own policies.
DeepSeek is the only Chinese AI model named in the order, but other Chinese models face similar scrutiny, and further action cannot be ruled out. For more on AI and security, read our report on the hacker who used AI agents to breach 100+ websites.
Frequently asked questions
Is DeepSeek banned in the US?
Not for the public. The DHS order applies to federal civilian agencies only.
Why is the US government worried about DeepSeek?
Officials say data entered into DeepSeek could be accessed by the Chinese government under Chinese law, and that the software may contain security vulnerabilities.
Can agencies keep using DeepSeek?
Only with an approved exception, requested at least 60 days in advance with a compelling justification.
Sources
- The Register – DeepSeek deep-sixed at all US federal civilian agencies (20 Oct 2026)
- CyberScoop – DHS to ban DeepSeek from federal civilian agencies (19 Oct 2026)
- South China Morning Post – US orders DeepSeek removed from federal systems (20 Oct 2026)
- Korea Times (Yonhap) – US orders removal of China’s DeepSeek products from federal civilian agencies (20 Oct 2026)
