DeepSeek banned from US federal civilian agencies: what the DHS order changes

The US Department of Homeland Security has ordered every federal civilian agency to stop buying DeepSeek products and to strip them out of its IT systems, together with any third-party product developed using DeepSeek. Secretary Markwayne Mullin signed the order on 24 July 2026. DHS filed a notice of it for public inspection on 19 October, and it appeared in the Federal Register on 20 October.

The order adds civilian agencies to restrictions Congress wrote in December 2025. The defence authorisation act signed that month barred DeepSeek AI from Pentagon systems and defence contract work, and required the DeepSeek app to be removed from intelligence agencies’ national security systems. Each measure has its own scope and exceptions. The DHS order excludes national security systems, the defence act reaches only those run by the Pentagon or by or for intelligence elements, and none of the three applies to Congress or the federal courts. There is no general ban for companies or the public, though government suppliers face restrictions through their contracts. The order’s reach into other vendors’ software is what makes it matter beyond Washington.

The answer in brief

• What was banned: DeepSeek products, products from DeepSeek affiliates, and third-party products and services “developed using DeepSeek implementations”, across US federal civilian agencies.
• Two rules in one order: agencies may not buy these products, and they had to remove any they already ran immediately after the order was issued, unless they sought an exception.
• When: Homeland Security Secretary Markwayne Mullin signed Exclusion and Removal Order 2026-01 on 24 July 2026. It was filed for public inspection on 19 October and published on 20 October.
• The closed door: agencies had 60 days from issue to ask for an exception. Counted from 24 July, that window shut on 22 September 2026, four weeks before the order was published.
• The rest of government: the December 2025 defence authorisation act already required DeepSeek AI to be removed from Pentagon systems, barred it from defence contract work, and required standards for removing the DeepSeek app from intelligence agencies’ national security systems. Under Section 6604, national security systems in civilian departments are covered where they are operated by or on behalf of an intelligence element, including by contractors, and none of the three measures applies to Congress or the courts.
• Who is outside it: as of 21 October 2026, no federal law or order bans ordinary private or consumer use of DeepSeek. Government contract work is different: defence contractors are barred by statute, and suppliers to civilian agencies are bound through FASCSA contract clauses.
• The weak point: the order explains “developed using” in a single footnote, and says nothing about DeepSeek models a company hosts on its own US servers.

What has the US government banned?

The order bans DeepSeek from federal civilian buying and federal civilian systems. Its formal name is Exclusion and Removal Order 2026-01. The signed text names the company as Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd., and the Federal Register notice uses a shorter form of the same name.

It does two things. First, agencies must exclude DeepSeek, its affiliates and their products from purchasing, including approved product lists, service provider equipment lists and the e-commerce marketplaces agencies buy through. Second, they must remove products from DeepSeek and its affiliates, plus “third-party products and services developed using DeepSeek implementations”, from their IT systems. Both took effect immediately after the order was issued, though agencies could ask for exceptions.

The second clause is the wide one. DeepSeek publishes its recent models, including R1 and V4, as open weights under the MIT licence, so they sit inside other companies’ chatbots, coding tools and AI gateways. A footnote says the order covers third-party implementations of DeepSeek used to provide products and services to civilian agencies. A vendor selling to one now has to know whether DeepSeek is anywhere in its stack.

The order excludes agencies’ national security systems and sensitive compartmented information systems. Under FASCSA, orders for those systems fall to the Secretary of Defense and the Director of National Intelligence, not to DHS. The defence act’s DeepSeek provisions cover Pentagon systems and national security systems run by or for intelligence elements (see below), including those inside civilian departments, such as the State Department’s Bureau of Intelligence and Research and the intelligence offices of the Treasury, DHS and Energy. Other national security systems in civilian departments fall outside both provisions, so any rules covering them have to be checked separately.

Agencies could ask for an exception, for example that the order not apply to them or to certain actions, or for a delay. Requests had to arrive in writing within 60 days of issue, with a “compelling justification” such as a mission-critical need and any alternative safeguards. Counted from 24 July, that deadline fell on 22 September 2026. Anyone reading the notice on 20 October was looking at an order whose exception window had already closed.

Until removal was complete, agencies were encouraged to watch traffic in and out of their networks, step up logging, add controls against data leaving their systems and flag anything unusual. The Cybersecurity and Infrastructure Security Agency (CISA) reviews exception requests and can help agencies that lack the skills to comply. The Secretary must review the order within a year and every year after. The order was copied to Russell Vought, director of the Office of Management and Budget. DHS has not said why it waited almost three months to publish it.

Which law did DHS use?

DHS used the Federal Acquisition Supply Chain Security Act of 2018, known as FASCSA (41 U.S.C. 1321 to 1328). Congress passed it so the government could shut a risky supplier out of federal systems without writing a new law each time.

Under FASCSA, the Federal Acquisition Security Council reviews the evidence and recommends action. For civilian agencies, the Secretary of Homeland Security then issues the binding order. The notice says Secretary Mullin acted after reviewing the council’s recommendation and the evidence behind it. CISA’s FASCSA Order Implementation Team handles questions.

Orders under the law are rare. The first, from the Director of National Intelligence in 2025, removed products of the software company Acronis from intelligence community systems, according to law firm Mayer Brown. The DeepSeek order, numbered 2026-01, turns the same tool on an AI model and applies it across every civilian agency.

One route the government has not taken is the Commerce Department’s Entity List, the export blacklist. In June 2026, Reuters reported that an interagency committee had approved DeepSeek and more than 100 other Chinese firms for the list, but Commerce had not published the additions while trade talks with Beijing went on. The FASCSA order is narrower. It controls what the US government buys and runs, and does not itself impose Entity List export-licensing restrictions.

How does this fit with the Pentagon and intelligence bans?

The DHS order adds civilian-agency restrictions to two DeepSeek provisions Congress enacted in December 2025. Both are in the National Defense Authorization Act for Fiscal Year 2026 (P.L. 119-60), signed on 18 December 2025.

Section 1532 required the Secretary of Defense, within 30 days of enactment, to require the exclusion and removal of AI developed by DeepSeek, High Flyer (the hedge fund behind it) and associated entities from the department’s systems and devices. From the same deadline it stops contractors using that AI in the performance of a defence contract. The Secretary of Defense can grant case-by-case waivers for research, testing and training, counter-terrorism and counterintelligence work, and mission-critical functions. The same section told the Pentagon to consider extending the ban to AI from any company domiciled in China, Russia, North Korea or Iran. Section 6604 is narrower. It told the Director of National Intelligence to issue standards, within 60 days, for removing the DeepSeek application and any successor application or service from national security systems run by or for the intelligence agencies, including by contractors. Those standards must allow exceptions for national security purposes and research.

The standalone No DeepSeek on Government Devices Act stalled in committee. The defence act covered the Pentagon and the intelligence agencies instead, and the DHS order now covers the civilian agencies.

Sources: FY2026 defence act (P.L. 119-60), Sections 1532 and 6604; DHS docket DHS-2026-0628.

Why does the US say DeepSeek is a risk?

The order says DeepSeek’s models “present multiple threat vectors”, and almost all of them concern where data goes. DeepSeek’s servers are in China, and the order says Chinese law gives the state’s cyber and intelligence services wide authority to reach into private company infrastructure.

It lists the routes in. Signing up for DeepSeek’s own service collects personal information, and the order says it may track and digitally fingerprint users. Every prompt hands information to the model, so a civil servant or contractor could pass sensitive material to China without meaning to. Combined with public data, DHS argues, that could give Beijing usable intelligence on US citizens and government programmes. The order adds that the models may contain malware or other flaws, and cites a February 2025 NowSecure audit that found multiple critical vulnerabilities in DeepSeek’s iPhone app.

The evidence the order cites is all public, though the order does not reproduce the council’s recommendation or the full evidence behind it. The footnotes cite a company profile from the research firm Exovera, a TechTarget explainer, an archived copy of DeepSeek’s privacy policy from March 2025, a Stanford Cyber Policy Center paper, a 2020 DHS business advisory on Chinese data risks, the House Select Committee on China’s April 2025 report and the NowSecure audit. The newest of them dates from August 2025, so the order says nothing about the V4 models DeepSeek has released since. It describes no case of US government data reaching DeepSeek.

Other parts of the government have built a wider case. In September 2025 the Center for AI Standards and Innovation (CAISI) at NIST tested three DeepSeek models (R1, R1-0528 and V3.1) against four US models. It found DeepSeek far more open to agent hijacking and jailbreaking, and found the models repeated four times as many inaccurate and misleading Chinese Communist Party narratives as the US models did.

Then came the distillation charge, the claim that DeepSeek trained its models on the output of American ones. OpenAI made it to the House Select Committee in February 2026. In April the State Department told its embassies to warn foreign governments about it. In September the NSA, FBI and CISA jointly accused DeepSeek and five other Chinese labs of distillation “at an industrial scale”. Beijing calls the accusations groundless. The order’s stated reasons are about data and security. The distillation accusations explain the mood in Washington.

How did the US get here?

It took 21 months to go from the first agency blocks to a ban covering every civilian agency. Agencies and states moved within days of DeepSeek-R1’s launch in January 2025; Congress acted through the defence authorisation act at the end of that year; DHS signed the civilian order in July 2026 and published it in October.

Does the ban apply to businesses or the public?

Not as a general ban. The order directs US federal civilian agencies, and no federal measure stops ordinary private or consumer use: a US company can still call DeepSeek’s API, and a member of the public can still download the app. Government suppliers are the exception, because the restrictions reach them through their contracts.

Those restrictions come from two directions. Defence contractors have been barred since January 2026 from using DeepSeek AI in the performance of a Pentagon contract, under Section 1532 of the defence act, subject to waivers. Firms selling to civilian agencies, directly or through a reseller, are bound through the FASCSA clauses in federal contracts. Under FAR 52.204-29, a bidder represents, after a reasonable inquiry, that it will not supply or use products covered by a FASCSA order in force when the solicitation was issued. Under FAR 52.204-30, contractors must check SAM.gov for new orders at least every three months and report covered products within three business days, and the clause flows down to subcontractors. An order issued after the solicitation date applies only if it is added through a solicitation amendment or contract modification, though the monitoring and reporting duties still apply. These duties reach suppliers outside the US as well.

Outside the US, Italy’s data protection authority blocked the DeepSeek app for the public in January 2025. Australia, Taiwan, the Czech Republic and Belgium ban it on government systems, and South Korea, Canada and the Netherlands restrict it in parts of government.

What do critics say about the order?

Few people argue that federal staff should be typing work into DeepSeek’s own app. The criticism is about the third-party clause, which the order explains in one footnote and nowhere else.

Katie Moussouris, founder of Luta Security, told The Register that “banning DeepSeek’s own app and API is workable”. Her worry is the phrase “developed using”. Read literally, she said, it could cover any model derived from DeepSeek and any software whose developers used DeepSeek to write or test code. An AI bill of materials does not record which tools a developer used, so every vendor would have to attest that nothing it relies on ever touched DeepSeek, and nobody could check.

She also questioned whether US-hosted copies belong in the ban. The order’s main fears concern data reaching DeepSeek’s servers in China. Agencies running DeepSeek’s open weights on their own servers, or through a US cloud, avoid most of that. For the model itself, the order says only that it may contain malware or flaws, which is true of any software. CAISI’s results on jailbreaking and agent hijacking are a stronger argument, though every model has those weaknesses to some degree.

The wording leaves room for her reading, though it does not settle the question. It scopes the data-collection risk to “DeepSeek-hosted instances” of the models, yet the removal duty covers every third-party product developed using DeepSeek, wherever it runs. The drafting is loose in other places too: the footnote defining an affiliate refers to “DeepSeek AG”, which is not the company’s name. The order’s own exception process is open only to agencies, and a vendor whose agency customers did not pass the order on may not have seen it until it was filed for public inspection on 19 October, after that window had closed. Under FAR 52.204-30, a contractor can ask its contracting officer to seek a waiver when a new order is added to its contract, though the officer need not pursue one.

AI gateways add another place to look. The Register points out that services such as OpenRouter and Vercel AI Gateway offer DeepSeek models through their APIs, and suggests agencies could be using them without meaning to. The automatic part needs care. By default OpenRouter chooses among providers for the model a customer has picked, so a request for another model does not quietly become a DeepSeek request. The risk lies in configuration, such as a DeepSeek model in a fallback list or an automatic model router that can pick one.

The Register also noted who gains. Chinese open-weight models compete hard on price, and it argued that agencies unable to use them may be stuck paying the prices US model makers set. The order covers only DeepSeek, so other open-weight models remain open to agencies.

How has China responded?

Beijing has demanded a reversal and threatened countermeasures. Asked about the order on 20 October, Foreign Ministry spokesperson Mao Ning said China opposes stretching the idea of national security and will protect the rights of Chinese companies, the line she used when the Commerce Department banned DeepSeek in March 2025.

China’s Ministry of Commerce went further, according to the Associated Press. It accused Washington of ignoring the consensus reached between Presidents Xi and Trump and of using national security as cover to contain China, and said it would “take all necessary measures” to defend its interests. DeepSeek did not respond to the Associated Press’s request for comment, and we found no public response from the company by 21 October.

The timing is awkward for both sides. China and the US agreed in September to set up a bilateral channel for what the White House fact sheet calls super intelligence (SI) incidents, and Trump and Xi are expected to meet on the sidelines of the APEC leaders’ summit in Shenzhen on 18 and 19 November, according to the AP, with AI likely on the agenda. George Chen of The Asia Group told AP the episode shows how deep the strategic distrust runs, even while the two leaders keep their personal relationship warm. In mid-October Beijing also proposed its own export controls on advanced AI models.

What should teams using AI do now?

This order changes nothing in law for a business that does not sell to US civilian agencies. The order still shows where buyers’ questions are heading, and the questions it raises are worth answering before a client asks them.

1. Find out where DeepSeek sits. Check direct use of the app and API, model gateways, including their fallback and automatic routing settings, and the AI features inside the SaaS tools you already pay for. Ask vendors which models they use and where those models run.
2. Separate DeepSeek’s service from DeepSeek’s weights. Prompts sent to DeepSeek’s own app or API are stored in China, according to its privacy policy. A suitably configured self-hosted deployment of the open weights keeps prompts away from DeepSeek. The Czech and Victorian bans make conditional exceptions on that basis: the Czech warning excludes locally deployed open models that cannot communicate with DeepSeek’s servers, and Victoria’s direction requires the whole codebase to be open for inspection, local deployment on a government system and appropriate mitigations. Neither exempts a trusted cloud as such. Self-hosting does not fix the jailbreak and hijacking weaknesses CAISI measured. If you need an open-weight model from a US maker, our Muse Glimmer test covers one released under Apache 2.0. Our test of Meta’s Muse Spark Open covers what running an open-weight model yourself involves.
3. Keep personal data out of China-hosted tools unless you have done the work. Treat DeepSeek’s hosted service like any other overseas processor under your data protection rules, and assess it before use.
4. Prepare an answer if you sell into US government. Pentagon contract work has been off limits for DeepSeek since early 2026. If any customer is a US federal civilian agency, or a contractor serving one, expect to be asked to attest that your product does not use DeepSeek. Given how loosely the order defines “developed using”, write down what you checked and when.
5. Watch the next moves. The questions to follow are whether DHS issues guidance on what “developed using” means, whether other Chinese labs named in the distillation statement get similar orders, and whether AI features in the Trump and Xi meeting in November.

If you cannot tell which models sit inside the AI tools your team pays for, talk to AIWIZ and we will help you map them.