The US orders civilian agencies to remove DeepSeek, including tools built on its models

The United States has formally shut DeepSeek out of its civilian government. A notice from the Department of Homeland Security, posted on the Federal Register website on Monday, 19 October 2026, and formally published on Tuesday, orders every federal civilian agency to stop buying products from the Chinese AI company and to remove the ones it already runs. The ban is not limited to DeepSeek's own chatbot and API. It also reaches third party products and services that were built using DeepSeek implementations.

The order itself is not new. It is titled Exclusion and Removal Order #2026-01, carries an original release date of 24 July 2026 and is signed by Homeland Security Secretary Markwayne Mullin, with a copy to Russell Vought, the director of the Office of Management and Budget. What is new is that the public, the industry and DeepSeek itself can now read it. Reuters reported on the notice on Monday, followed by Bloomberg, CyberScoop, the BBC and CNBC. This article is based on the four page order as printed in the Federal Register and on those reports.

What the order actually says

The legal basis is the Federal Acquisition Supply Chain Security Act of 2018. That law created the Federal Acquisition Security Council, a body that can recommend excluding or removing risky technology from federal procurement and federal IT systems. For civilian agencies, the Secretary of Homeland Security can then turn such a recommendation into a binding order. According to the notice, Mullin did exactly that after reviewing the council's recommendation and the evidence behind it.

The order has two parts. The first is exclusion: civilian agencies may no longer buy information technology products and services from Hangzhou DeepSeek Artificial Intelligence or its affiliated companies. The text spells out that this applies immediately and also covers agency approved product lists, service provider equipment lists, e-commerce marketplaces and other channels that agencies use to buy hardware, software and services. In practice, that closes the side doors as well as the front door.

The second part is removal. Agencies have to take DeepSeek products, products from DeepSeek affiliates, and third party products and services developed using DeepSeek implementations off their information technology systems, or ask for an exception. That third party clause is the part with the biggest reach. DeepSeek's open weight models are popular with developers because they are cheap and capable, and the BBC notes that companies such as Snowflake, Vercel and OpenRouter offer DeepSeek models to their customers. A federal agency that uses any service with DeepSeek inside it now has a problem to solve.

Why DHS says DeepSeek is a risk

The order describes DeepSeek's models as presenting "multiple threat vectors" and lists them in a short background section. The first is location. DeepSeek's servers are in the People's Republic of China, and the order argues that Chinese law gives the government extensive authority to access private company infrastructure for cyber and intelligence purposes.

The second is personal data. For models hosted by DeepSeek itself, the order says the account sign up process collects personally identifiable information and may also track and digitally fingerprint users. It cites DeepSeek's own privacy policy for this.

The third point is one that applies to every chatbot, not only to Chinese ones. DeepSeek's most widely used applications work through a prompt and response process, which means users send their information to the model. If government employees or contractors do that, the order says, it "may result in the transfer of sensitive data to the PRC". DHS adds that such data, alone or combined with public information, "could produce actionable intelligence on U.S. persons and/or government programs."

The fourth point is software security. The order says the models themselves may contain malware or other vulnerabilities and points to open source security research that found multiple critical vulnerabilities in DeepSeek's iOS app. That footnote refers to a February 2025 analysis by the mobile security firm NowSecure. Its researchers reported that the app sent some registration and device data over the internet without encryption, had switched off Apple's App Transport Security protection, used the outdated 3DES cipher with a hardcoded key, and stored sensitive data insecurely on the device.

It is worth reading this list carefully. Two of the four points, data residency in China and the legal reach of the Chinese state, are specific to DeepSeek's origin. The other two, data collection by a hosted service and the fact that prompts carry sensitive content to whoever runs the model, would apply in some form to any AI vendor. CyberScoop made the same observation. The order is a supply chain decision about one company, but its reasoning describes risks that every agency deploying any chatbot has to manage.

Who is covered, and who is not

The order applies to federal civilian executive branch agencies. CNBC and the BBC name the Treasury, State and Justice departments as examples. It does not apply to national security systems or to secure compartmented information systems. Under the 2018 law, those belong to the Secretary of Defense and the Director of National Intelligence, who can issue their own orders. The Department of Defense is therefore outside the scope of this particular document.

That does not mean the military has been using DeepSeek freely. As CNBC summarises, the Defense Information Systems Agency moved to block DeepSeek in January 2025, Commerce Department bureaus told staff in March 2025 that DeepSeek was banned on government devices, and Congress restricted DeepSeek in intelligence community systems in December 2025. Reuters adds that the Navy and several states, including New York, Tennessee and Virginia, have taken similar steps. What the DHS order adds is a single, government wide rule for civilian agencies with a clear legal basis, replacing a patchwork of local decisions.

Exceptions and interim measures

Agencies are not left without options. They can ask the DHS issuing official for an exception, for example that the order should not apply to them, should apply only partly, or should give them more time. Requests must be made in writing within 60 days of the order's issuance and need a "compelling justification", such as the impact on a mission critical function or national security considerations. They must also describe any alternative mitigations. CISA, the Cybersecurity and Infrastructure Security Agency, reviews the requests and gives a written approval or rejection.

Counted from the original release date of 24 July, that 60 day window would have closed around 22 September, before the order became public. That is our own calculation from the dates in the document; the notice does not say how many agencies asked for exceptions or whether any were granted.

For the time between the order and full removal, the document encourages agencies to monitor traffic flowing in and out of their networks, to add enhanced logging and controls against data exfiltration on the affected systems, and to detect and flag anomalous activity. CISA can provide technical help to agencies that lack the in house skills to comply. DHS also has to review the order within one year and every year after that, as the 2018 law requires.

China pushes back

Beijing reacted on Tuesday. Asked about the ban, foreign ministry spokesperson Mao Ning said that "China consistently opposes the overstretching of the concept of national security and the politicizing of science, technology, economic and trade issues", according to Fox News and The Straits Times, and that China would resolutely safeguard the legitimate rights and interests of Chinese companies. DeepSeek had not responded to requests for comment from CNBC and the BBC at the time of their reports. The Straits Times notes that the topic could come up again at talks between US and Chinese leaders in November.

The timing is notable. Last week DeepSeek shipped a new open weight model, which we covered in our article on DeepSeek V4.1 Flash 1017, and the BBC writes that users praised it as competitive with the best American systems on tasks like coding. US labs have also accused Chinese companies, including DeepSeek, of copying their models through distillation, a fight we described in our piece on Anthropic's distillation defenses. And earlier this month we looked at China's own draft export controls on AI. The DeepSeek order sits in that wider contest over who controls the most important AI technology.

What this means in practice

For most people outside government, nothing changes today. DeepSeek's app and API remain available to the public, and the order does not apply to private companies. It does, however, send a clear signal to vendors that sell to the US government. If a product routes requests to a DeepSeek model, embeds DeepSeek weights or is built on top of a DeepSeek implementation, it is now a liability in any civilian federal deal.

There is also an open question that the four pages do not fully answer. DeepSeek publishes many of its models as open weights that anyone can download and run on their own hardware, with no data sent to China. The order's phrase "third party products and services developed using DeepSeek implementations" is broad, and the text as published does not draw an explicit line between DeepSeek's hosted service and its open weights running on infrastructure an agency controls. Several of the risks DHS lists, such as servers in China and account data, mainly concern the hosted service, while the warning about possible malware or vulnerabilities inside the models would also apply to locally run weights. Agencies and their suppliers will likely read the clause cautiously and remove both.

For security teams, the most useful part of the order may be the interim checklist: know where your AI traffic goes, log it, watch for data leaving the network and flag what looks unusual. That advice is not specific to DeepSeek. It is a reasonable baseline for any organisation that has let AI tools into its systems faster than it has learned to monitor them.

The bottom line

The US government has turned months of scattered restrictions into one binding rule: no DeepSeek, no DeepSeek affiliates and no products built on DeepSeek in civilian federal IT. The order was signed in July and kept out of public view until this week, so many agencies have presumably already acted on it. The reasons DHS gives are a mix of China specific concerns and risks that apply to any hosted AI model, and the broad wording on third party products will make government suppliers check their own stacks carefully. For DeepSeek, which keeps releasing strong and cheap models, the ban is not a technical setback. It is a sign that in the US public sector, where an AI model comes from now matters as much as how good it is.