TechnologyNews

US orders federal civilian agencies to remove DeepSeek products

The Homeland Security directive also bars new purchases and covers some third-party services, though its reach into software built using DeepSeek remains unclear.

NewsJaws DeskEditorial desk

Published 20 Oct 2026, 03:36 BST2 min read

A ceremony marking the opening of the Department of Homeland Security’s new headquarters at the St. Elizabeth’s campus. — A ceremony marking the opening of the Department of Homeland Security’s new headquarters at the St. Elizabeth’s campus in Washington, D.C., on April 10, 2019. File photograph. DHSgov, Department of Homeland Security new Headquarters ceremony (40621194613) (resized and converted to WebP). Public domain.Image source Image licence: Public domain

Save for later

DeepSeek products must be removed from US federal civilian agency IT systems under an order issued by the Department of Homeland Security on Monday, 19 October. Agencies are also barred from buying covered products and services. The directive extends to some third-party technology developed using the Chinese AI company's implementations, creating a wider compliance question for agencies and their suppliers.

Which DeepSeek products the order covers

Yonhap News Agency reported that the restriction covers products and services from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates, as well as third-party products and services developed using DeepSeek implementations. The Register reported that agencies were directed to stop using DeepSeek technology and remove existing implementations. The order applies to federal civilian agency systems and procurement; it is not a general prohibition on private businesses or individuals in the United States using DeepSeek, according to Yonhap.

Yonhap reported that DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018 after reviewing a recommendation from the Federal Acquisition Security Council and related evidence. DHS cited the possible transfer of sensitive data about US government employees and vendors to the Chinese government, and the possibility that DeepSeek models contain malware or other security vulnerabilities, according to Engadget and the South China Morning Post. Those are risks cited in the notice, rather than reported findings that a transfer or compromise occurred.

Why the third-party provision is difficult to apply

The Register reported that the order does not define what it means for a third-party product to have been ‘developed using’ DeepSeek implementations. That leaves uncertain whether the wording covers only services providing access to a DeepSeek model or also software whose developers used DeepSeek while writing or testing code. The Register also identified AI gateways, which can make DeepSeek models available through a service's API, as a possible complication for agencies trying to identify covered use.

Security specialist Katie Moussouris criticized the breadth of the third-party wording and the difficulty of verifying how software was developed, The Register reported. Her assessment points to a practical issue for agencies reviewing vendors: a product's current features may not show whether DeepSeek was used during its development. The order's wording leaves that boundary unresolved, while the removal and purchasing restrictions apply to products agencies identify as covered.