DHS discloses DeepSeek ban covering civilian agencies and third-party products

Federal civilian agencies were given 60 days to remove DeepSeek technology under an order the Department of Homeland Security made public on October 19, 2026. The restrictions reach beyond DeepSeek’s own products to third-party offerings built using its technology. But the disclosure is new; the order took effect in late July.

DHS Secretary Markwayne Mullin signed the order on July 24 under the Federal Acquisition Supply Chain Security Act of 2018, according to MeriTalk. DHS disclosed it through a Federal Register notice scheduled for publication on October 20. The public notice therefore does not mark the start of a new 60-day removal period.

The restriction follows the technology

The order combines two requirements: agencies must remove covered products and services from their IT systems, and they cannot procure the technology in the future. It addresses both technology already installed and subsequent purchases, rather than simply restricting new contracts.

Its coverage includes products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. Third-party offerings built using DeepSeek implementations are also covered. Buying through another supplier does not, by itself, place a product outside the restriction.

The directive applies to federal civilian executive branch agencies. It excludes procurements by the Department of Defense and the intelligence community, as well as national security systems. Those exclusions define this order’s reach; it is not a government-wide removal directive covering every federal system.

DeepSeek presents multiple threat vectors that pose significant risk to the cybersecurity of U.S. government systems

Department of Homeland Security, in the signed order, as quoted by MeriTalk

DHS points to data flows and security weaknesses

DHS’s stated rationale centers partly on where information goes. The department cited DeepSeek’s collection and storage of user data in China, including the transmission of user prompts and AI-generated responses to servers there. It said those practices could expose sensitive information about U.S. users and government programs.

The department also cited security and privacy vulnerabilities identified through forensic analyses. Its concerns extended to model outputs: DHS warned that DeepSeek models could produce inaccurate, biased or harmful content. These are the department’s stated grounds for the restriction, not independently verified findings by Superpower Daily.

Removal was accompanied by advice to watch for information leaving agency systems. DHS urged agencies to monitor network traffic, increase logging and use data loss prevention controls during the process. The Cybersecurity and Infrastructure Security Agency will oversee implementation through its FASCSA Order Implementation Team.