Blog
US orders federal civilian agencies to remove DeepSeek AI products
On 20 October 2026 the US Department of Homeland Security published an order, signed on 24 July, that bars federal civilian agencies from buying DeepSeek products and tells them to remove DeepSeek software, including third-party products built using DeepSeek, from their IT systems. Defense and intelligence systems are covered separately.
The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying products from Chinese AI company DeepSeek and to remove its software from their computer systems. The order was signed by Homeland Security Secretary Markwayne Mullin on 24 July 2026, but it only became public this week. It was filed for public inspection in the Federal Register, the US government's official journal, on 19 October and formally published on 20 October 2026.
What the order requires
The document is titled Exclusion and Removal Order #2026-01. It tells federal civilian agencies to do two things:
- Exclude: stop buying products and services from DeepSeek and its affiliated companies, effective "immediately after issuance", including through approved product lists and e-commerce marketplaces.
- Remove: take DeepSeek products off agency IT systems. This also covers third-party products and services "developed using DeepSeek implementations", meaning tools from other vendors that are built on DeepSeek's models.
That second point is the widest part of the order. A government supplier does not need to sell DeepSeek directly to be affected. If its product runs on a DeepSeek model, agencies are told to remove it.
Who it covers
The order applies to federal civilian executive branch agencies. CNBC lists the Treasury, State and Justice departments as examples. It does not cover national security systems or secure compartmented information systems, which handle the most sensitive classified material. Under the law, the Defense Department (which the order calls the Department of War) and the Director of National Intelligence issue their own orders for those systems.
It is not a ban on the public using DeepSeek, and it does not apply to private companies except as government suppliers.
The reasons DHS gives
The order says DeepSeek's models "present multiple threat vectors". According to the text:
- DeepSeek's servers are in China, and Chinese law gives the government wide powers to access company infrastructure for cyber and intelligence work.
- Using DeepSeek-hosted models means sending information to the model, which could move sensitive US government data to China. Combined with public data, DHS says, this "could produce actionable intelligence" on US people or programmes.
- DeepSeek's account sign-up collects personal information, and the company may track and fingerprint users.
- The models "may contain malware or other security vulnerabilities". DHS cites outside research that found several critical flaws in DeepSeek's iOS app.
DeepSeek did not immediately respond to CNBC's request for comment.
The legal basis and the timeline
DHS acted under the Federal Acquisition Supply Chain Security Act of 2018. That law created the Federal Acquisition Security Council, which recommends removing risky technology from government systems. The Secretary issued the order after reviewing the council's recommendation.
Agencies could ask for an exception, such as a delay, by applying in writing within 60 days of the order being issued. Counted from 24 July, that window closed in September, before the order was made public. Until DeepSeek tools are fully removed, agencies are encouraged to monitor network traffic, add logging and watch for data leaving their systems. DHS's Cybersecurity and Infrastructure Security Agency (CISA) handles exception requests and can help agencies that lack the skills to comply. The order must be reviewed within one year and every year after that.
Why it matters
Parts of the US government have restricted DeepSeek before. CNBC notes that the Defense Information Systems Agency moved to block it in January 2025, Commerce Department bureaus banned it on government devices in March 2025, and Congress restricted it in intelligence community systems in December 2025. This order is broader because it covers civilian agencies as a group and reaches into the supply chain.
For software vendors that sell to the US government, the practical effect is an audit question: which AI models sit inside their products? Open-weight models such as DeepSeek's can be built into other tools without the original developer's name appearing anywhere, so finding them may take real work.