DHS orders federal civilian agencies to drop DeepSeek products

Past-week coverage · Original source published 2026-10-20.

The U.S. Department of Homeland Security has ordered federal civilian agencies under its authority to stop using DeepSeek products and remove them from government systems, according to a notice of order published in the Federal Register.

The order reaches beyond the Chinese AI company itself. It also covers products from DeepSeek's affiliates and third-party products and services built using DeepSeek technology. Agencies are told to immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces, and to remove them from agency IT systems or seek an exception.

Exception requests are due within 60 days of the order's issuance, with a justification and proposed risk mitigations. CISA will review them and issue written approvals or denials, and will provide technical assistance to agencies that can't comply because of internal capability limits.

DHS framed the action around concerns that the Chinese government could access DeepSeek infrastructure, collect personal information, track users and potentially move sensitive government data to China. The order also cites a February 2025 NowSecure report on the DeepSeek iOS app, which the firm said found unencrypted data transmissions, weak encryption, insecure local storage, user fingerprinting risks and data sharing with ByteDance.

The order applies to federal civilian agencies within DHS's authority. It is not a general ban on private or consumer use.

For defenders in regulated or sensitive environments, the practical question is inventory: knowing which approved tools and vendor products embed third-party AI models, and having a process to review or remove them when a regulator acts.