US Orders DeepSeek Off Government Systems — Including Third-Party Tools Built on It

The US Department of Homeland Security (DHS) has ordered civilian federal agencies to remove DeepSeek products and third-party tools built on the Chinese artificial intelligence company's models from government information technology systems and stop purchasing the covered products and services.

The order, Exclusion and Removal Order #2026-01, excludes products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliated entities from civilian federal procurement. It is dated 24 July 2026. The notice was filed for public inspection on Monday, 19 October, and is scheduled for formal publication in the Federal Register on Tuesday, 20 October.

DHS Cites Risks To Sensitive Government Data

DHS said in the order that DeepSeek models present 'multiple threat vectors'. It described DeepSeek as a foreign, privately owned company based in China, with servers in the country, and said China's legal system permits extensive government access to private company infrastructure.

The order said DeepSeek's account creation collects personally identifiable information and may track and digitally fingerprint users. It also warned that prompts entered into DeepSeek's applications could result in sensitive data reaching China if used by US government employees or vendors. That information, alone or combined with publicly available data, could produce actionable intelligence on US persons or government programs, DHS said.

The department added that the models themselves may contain malware or other security vulnerabilities, citing open-source research that found the DeepSeek iOS app contains multiple critical vulnerabilities. These are risks cited by DHS as grounds for the restrictions.

The order follows a recommendation from the Federal Acquisition Security Council, an inter-agency body that reviews supply chain risks affecting government technology. It was issued under the Federal Acquisition Supply Chain Security Act of 2018, which gives the government a legal framework to restrict certain information technology products and services on supply chain security grounds.

Restrictions Extend Beyond DeepSeek's Own Products

The order covers DeepSeek and affiliate products, as well as third-party products and services developed using DeepSeek implementations. That wording extends the removal requirement to covered technology supplied by other companies, rather than limiting it to applications carrying the DeepSeek name.

The procurement exclusion applies to DeepSeek, its affiliates and their products, including agency-approved product lists, service provider equipment lists and e-commerce markets. The removal requirement separately covers those products and third-party offerings built using DeepSeek implementations, so software from an outside vendor may fall within its scope.

The directive applies to civilian executive branch agencies, except their national security systems and secure compartmented information systems. Those fall under separate authorities, with orders for national security systems issued by the Department of War and the Director of National Intelligence. The signed order is available through the federal rulemaking docket, DHS-2026-0628.

Federal Agencies and States Had Already Imposed Limits

The order follows earlier restrictions by federal agencies and state governments. The Department of Commerce and the US Navy had prohibited DeepSeek's use on government devices. New York, Tennessee and Virginia had also introduced restrictions on the technology's use by government personnel.

Until covered products are fully removed, the order encourages agencies to monitor traffic in and out of their systems, strengthen logging and controls on data exfiltration, and flag anomalous activity.

DeepSeek gained international attention in early 2025 with models that attracted interest for their performance and comparatively low development costs.

Public Notice Sets Out DHS's Security Case

Both the exclusion and the removal take effect immediately after the order's issuance, unless an agency obtains an exception.

Agencies can ask DHS for an exception. Requests must be submitted in writing within 60 days of the order's issuance and include a compelling justification, such as the impact on mission-critical functions or national interest considerations, as well as proposed mitigations. DHS will provide written approval or disapproval.

The Cybersecurity and Infrastructure Security Agency may offer technical assistance to agencies without the capability to comply. The Secretary of Homeland Security must review the order within one year and annually thereafter, as the act requires.

The Chinese Embassy in Washington did not immediately comment on the order. The Federal Register notice is scheduled for publication on 20 October, with the signed order and related material available through the docket.