The US Department of Homeland Security has ordered all civilian federal agencies to remove DeepSeek from their computer systems and stop buying it, including any outside product or service built on top of DeepSeek. The order was filed publicly on October 19, 2026 and published in the Federal Register on October 20. China’s Ministry of Commerce responded with what NBC News described as "strong dissatisfaction and firm opposition," calling the ban discriminatory and warning Beijing would take "all necessary measures."
What does the order actually require?
Known as Exclusion and Removal Order 2026-01, it does two things. It removes DeepSeek and its affiliates’ products from civilian agency systems, and it bars agencies from buying them, including through approved product lists and online marketplaces. Crucially, it also covers third-party products and services "developed using" DeepSeek. The order cites the Federal Acquisition Supply Chain Security Act of 2018 and follows a recommendation from the Federal Acquisition Security Council. The order itself is dated July 24, 2026, so it was signed months before it was made public.
Why does DHS say DeepSeek is a risk?
DHS says DeepSeek’s models present "multiple threat vectors." It points to Chinese laws that let the government access private company infrastructure, account sign-ups that collect personal information and may fingerprint users, and the fact that using any chatbot means handing it your information. DHS warned use "may result in the transfer of sensitive data to the PRC" and "could produce actionable intelligence on U.S. persons and/or government agencies," and added that the models themselves may contain malware or other vulnerabilities.
Is this the first restriction on DeepSeek?
No, but it is the broadest. The Commerce Department and the US Navy had already banned DeepSeek on government devices, and New York, Tennessee and Virginia took similar steps. Italy, Australia and Taiwan moved early outside the US. What is new is the reach to third-party services built on the model, and the formal procurement ban across every civilian agency.
What about the fact that DeepSeek is open source?
This is the part that makes the order hard to apply. DeepSeek releases open weights, like V4.1 Flash under the MIT licence, and anyone can run them on their own servers with no connection to China. The data-transfer risk mainly applies to DeepSeek’s own hosted service on Chinese servers. A model running entirely on a US government server does not send anything to Beijing. But "developed using DeepSeek" is broad enough that vendors who fine-tuned or built on its open weights may now need to prove they did not, or remove those products from federal sale.
What happens next?
China has not said what its countermeasures would be. The order lands in a wider push against Chinese technology, with the FCC voting on October 29 on barring Chinese labs from testing electronics for the US market. It also sits awkwardly beside the industry trend toward cheaper open models, documented in AT&T moving traffic to open models, since several of the strongest open models now come from Chinese labs. For businesses selling to the US government, the practical step is an audit: know which models sit underneath every AI tool you supply.
