US civilian agencies ordered to strip DeepSeek AI from IT systems
The DHS has mandated that federal departments remove DeepSeek technology and halt all future procurement of related tools.
Key points
- The order covers direct DeepSeek products and third-party services relying on its models.
- Removal is required for all federal civilian agencies, including the Department of State.
- The ban is based on supply chain risks, not a nationwide prohibition for private users.
The Department of Homeland Security has instructed US federal civilian agencies to eliminate DeepSeek artificial intelligence technology from their computer networks. This directive, posted on Monday, requires departments such as the State Department to delete any software created by the Chinese AI lab. It also mandates the removal of third-party services that depend on DeepSeek models. The order halts all future procurement of these tools under supply chain security regulations.
The administration cites concerns that DeepSeek’s account setup process collects personally identifiable information and may digitally fingerprint users. Homeland Security Secretary Markwayne Mullin warned in a July note, made public on Monday, that this data could be transferred to the Chinese government. He also noted that the models themselves might contain malware. The DHS views this as a supply chain threat rather than a general consumer issue, meaning private citizens and businesses are not barred from using the technology.
View the original post on X
What we know
Cyber Security News reports that the notice was filed for public inspection on October 19, 2026, with publication scheduled for October 20. The order explicitly covers products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and any third-party implementations using DeepSeek technology. This scope is broader than a simple block on new purchases, as it forces agencies to purge existing systems.
The Federal Acquisition Supply Chain Security Act of 2018 serves as the legal basis for this action. DHS Secretary Mullin acted after reviewing a recommendation from the Federal Acquisition Security Council. The notice defines affiliates according to federal acquisition regulations. As TechWire Beat reported on 2026-10-19, this move follows earlier restrictions imposed by the Navy and the Department of Commerce.
The third-party provision presents a significant challenge for security teams. Agencies may use DeepSeek through another supplier rather than a branded chat tool. A review limited to known DeepSeek applications could miss covered products. Agencies must determine what powers their existing AI services, using contract records and technical documentation to support that assessment.
Vendors serving civilian agencies face a direct procurement question. They must assess whether their AI features depend on technology that government customers must now exclude. While American AI models still lead, the gap with Chinese development is shrinking, raising national security debates. Some US firms have accused DeepSeek of illicit distillation, using advanced model outputs to train others.
Defender's checklist
- Audit all third-party AI services to identify those relying on DeepSeek models.
- Review procurement contracts to exclude DeepSeek and its affiliates from future bids.
- Examine technical documentation to confirm the underlying infrastructure of current tools.
- Monitor vendor communications for updates on AI component sourcing and compliance.
The background in plain language
Teams usually need to understand that AI tools often use underlying models from other companies. This means a product might not say "DeepSeek" on the box, but still use its technology inside. Checking just the brand name is not enough. Organisations should look at technical specifications and vendor contracts to see what powers the software. This approach helps uncover hidden dependencies that could pose security risks or violate procurement rules.
Background: Personally identifiable information
Personally identifiable information acts as the anchor for security decisions. Without clear identification of this data, teams cannot prioritise risks, comply with regulations, or limit exposure during a breach. Proper classification transforms abstract data into actionable security controls, preventing widespread customer data exposure and reducing the blast radius of incidents.
Read the full guide: Why Personally Identifiable Information Defines Your Security Perimeter
What to do and how to stay safe: DeepSeek
- Inventory all AI-enabled applications in use, noting the vendor and any third-party integrations.
- Contact software suppliers to ask whether their products use DeepSeek models or infrastructure.
- Review data handling policies to ensure no sensitive information is sent to unapproved AI services.
- Once the vendor provides an update, verify that removal processes do not disrupt critical operations.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this ban apply to private individuals or companies?
No, this order creates a government supply chain restriction for federal civilian agencies only.
What legal authority is the DHS using for this ban?
The department cites the Federal Acquisition Supply Chain Security Act of 2018 and its rules.
Why is the government concerned about DeepSeek specifically?
Officials fear the collection of personal data and potential malware in the models.
