The U.S. Department of Homeland Security has ordered federal civilian agencies to remove artificial intelligence technology developed by China's DeepSeek from their IT systems and stop purchasing covered products and services. The restrictions also extend to certain third-party technologies built using DeepSeek implementations.
The directive, issued by Homeland Security Secretary Markwayne Mullin on July 24, 2026, became public through a Federal Register notice filed on October 19 and scheduled for publication on October 20. It marks a significant federal procurement restriction on the Chinese AI developer amid concerns about sensitive government information and technology supply-chain security.
The order does not impose a nationwide ban on DeepSeek for American consumers or private businesses. Its direct requirements apply to federal civilian executive branch agencies and their information technology systems and procurement activities.
What the DeepSeek Order Covers
According to the official DHS exclusion and removal order, federal civilian agencies must exclude information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated entities from procurement.
The directive also requires agencies to remove existing DeepSeek products, products supplied by its affiliates, and third-party products and services developed using DeepSeek implementations from covered government IT systems.
That third-party provision is particularly important because DeepSeek technology can be incorporated into applications and services offered by other companies. A product does not necessarily need to carry DeepSeek branding to fall within the order's removal requirements.
The procurement restrictions also encompass third-party implementations of DeepSeek used to provide products and services to civilian agencies. However, the precise application of these provisions depends on the definitions and scope established by the order.
Agencies must also remove covered products from approved purchasing lists, service-provider equipment lists, government-accessible online marketplaces, and other procurement channels.
The order was issued under the Federal Acquisition Supply Chain Security Act of 2018 following a recommendation from the Federal Acquisition Security Council. Its stated scope excludes national security systems and sensitive compartmented information systems, which fall under separate federal authorities.
Why the US Government Cites Security Risks
DHS says DeepSeek technology presents several potential security risks involving sensitive information, foreign intelligence collection, and vulnerabilities in AI applications.
In its assessment, the department raises concerns about DeepSeek's servers being located in China and the potential implications of Chinese legal authorities gaining access to information held by private companies.
The order also points to the collection of personally identifiable information and the possibility that prompts submitted by government personnel or contractors could expose sensitive material.
DHS argues that information transferred to China could potentially be combined with publicly available data to generate intelligence about U.S. individuals or government programs.
Separately, the department cites security research identifying vulnerabilities in DeepSeek's iOS application. The government also identifies the possibility of malicious software or other security weaknesses affecting AI implementations.
These concerns form part of the government's stated justification for the restrictions. They should not be confused with proof that every DeepSeek-based system is compromised or that a particular federal agency has experienced a confirmed data breach involving the technology.
As Reuters reported on October 19, the move follows earlier restrictions on DeepSeek within parts of the U.S. government and several states.
What Federal Agencies Must Do Next
The signed directive, designated Exclusion and Removal Order #2026-01, requires covered agencies to implement procurement exclusions immediately after issuance and remove affected technologies from their systems unless an exception is granted.
Although the order carries a July 24 release date, its public disclosure came nearly three months later. The available federal notice does not establish when every affected agency received the directive or whether all removal work has been completed.
The order provides a formal exception process for agencies that believe compliance could interfere with essential government functions or other significant national interests.
Exception requests must be submitted in writing within 60 days of the order's issuance. Agencies must identify the relevant products or services, explain which requirements they seek relief from, provide a compelling justification, and describe alternative measures for reducing the identified risks.
The 60-day provision concerns requests for exceptions. It is not a general grace period allowing every agency to continue using DeepSeek technology without restriction.
The Cybersecurity and Infrastructure Security Agency (CISA) is responsible for reviewing exception requests and providing written approval or denial.
While affected technologies remain in government systems, DHS encourages agencies to take interim cybersecurity precautions. These include enhanced network monitoring, more detailed logging, controls designed to reduce data-exfiltration risks, and detection of unusual system activity.
CISA may also provide technical assistance to agencies lacking sufficient internal resources to implement the requirements. The order is subject to review within one year and annually thereafter, as required by the governing legislation.
What the Restrictions Mean for Users and Technology Vendors
For ordinary American users, the distinction between federal procurement restrictions and a nationwide prohibition is essential.
The DHS directive does not generally prohibit individuals from accessing DeepSeek applications or prevent private companies from using the technology in their own operations.
However, the consequences may be more substantial for technology vendors supplying software, cloud services, or AI-powered products to civilian federal agencies.
Companies whose products incorporate covered DeepSeek implementations may need to examine whether those integrations affect their ability to supply federal customers. The order's third-party provisions mean that compliance questions can extend beyond applications directly distributed by DeepSeek.
Technical distinctions also matter. An AI service that sends prompts to a developer's hosted servers is not necessarily equivalent, from a data-handling perspective, to software running a model within an organization's own infrastructure. Nevertheless, deployment architecture alone does not determine whether a particular implementation falls within the federal directive.
The restrictions arrive as DeepSeek and other Chinese AI developers compete with U.S. technology companies, while governments assess the security and procurement implications of increasingly capable AI systems. The BBC's coverage of the U.S. action against DeepSeek reflects the wider attention surrounding the technology dispute.
For federal agencies and their technology suppliers, the immediate questions concern identifying affected implementations, completing required removals, and determining whether any exceptions apply.
As of October 20, 2026, the publicly available information does not establish how many agencies have finished removing covered technology, how many third-party products are affected, or whether particular exception requests have been approved.
Those implementation details, along with any subsequent DHS guidance or changes to the order, will determine how extensively the restrictions reshape the use of DeepSeek-based technology across civilian federal systems.
0 Comments