DeepSeek Banned From Federal Civilian Agencies

The U.S. Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove the Chinese company’s AI technology from their computer systems. The DeepSeek ban, first issued on July 24, 2026, was made public on Oct. 19 and published in the Federal Register on Oct. 20, and it also covers third-party products built using DeepSeek’s models.

Image: A technician working on a server rack at a computing center, used for illustration. Photo: Derrick Coetzee, via Wikimedia Commons (CC0).

What the DHS order requires

The notice, published at 91 FR 66346, describes an order from the Secretary of Homeland Security issued under the Federal Acquisition Supply Chain Security Act of 2018. According to the Federal Register text, the order does two things:

Exclusion: It bars information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., including affiliated entities, from federal civilian agency procurements.
Removal: It requires agencies to remove all DeepSeek and DeepSeek-affiliate products, as well as “third-party products and services developed using DeepSeek implementations,” from civilian agency IT systems.

The signed order is posted in docket DHS-2026-0628, and the Cybersecurity and Infrastructure Security Agency (CISA) is handling implementation, according to the notice.

Who is covered, and who is not

The order applies to federal civilian executive branch agencies, CNBC reported, including the Treasury, State and Justice departments. It excludes the Department of Defense. A summary of the order by OneSignalDesk notes that it also does not reach national security systems, secure compartmented information systems, or systems under the Office of the Director of National Intelligence.

Agencies can ask DHS for an exception, such as a delay in compliance, by submitting a written justification within 60 days of the order’s issuance, CNBC reported. Because the order dates to July 24, that window has already passed. The 60-day period was for exception requests, not a grace period for removal, which the order requires right away unless an exception is granted.

Why DHS says DeepSeek is a risk

The order says DeepSeek’s AI models “present multiple threat vectors,” according to CNBC. DHS pointed to the possibility that Chinese authorities could gain access to sensitive data, and warned that using the models could result in U.S. government data being transferred to China, potentially offering intelligence on American citizens and government programs.

The department also said the models may contain malware or other security weaknesses, citing open-source research that found multiple critical vulnerabilities in DeepSeek’s iOS app.

China pushed back. Asked about the move by Reuters, China’s foreign ministry said it would safeguard the rights and interests of Chinese companies. Spokesperson Mao Ning said “China consistently opposes the over-generalization of national security as well as the politicization of science, technology and trade issues,” CNBC reported.

Earlier restrictions on DeepSeek

The order builds on a series of narrower limits since DeepSeek’s models drew global attention in early 2025, according to CNBC:

In January 2025, the Defense Information Systems Agency moved to block access to DeepSeek models, Bloomberg reported at the time.
In March 2025, Commerce Department bureaus told staff DeepSeek was banned on government devices, according to Reuters.
In December 2025, Congress restricted the use of DeepSeek in intelligence community systems.

What it means for tech vendors

The biggest practical effect may fall on software companies that sell to the government. Because the removal requirement covers third-party products built with DeepSeek implementations, an AI feature inside another vendor’s product could be swept in. OneSignalDesk noted that the order does not define “DeepSeek implementations” and does not say whether a DeepSeek model a company hosts on its own servers is treated differently from DeepSeek’s own service. Vendors with federal civilian customers may need to check which AI models and suppliers their products rely on.

The timing is notable. DeepSeek this week released DeepInfer, an open-source framework for running its DeepSeek-V4.1-Flash model, according to The Morning Build. DHS said it will review the order within one year and annually after that.

The Boston Report has followed the security side of AI, including a hacker who used AI agents to breach more than 100 company websites and the race to expand U.S. AI chip production.

Sources

Like this story? Get the newsletter

The day's Boston news, weather and local business in one short email, with links to the full stories.

Latest

All latest news →

DHS Orders Federal Agencies to Remove DeepSeek AI From Their Systems