DHS Orders Federal Civilian Agencies to Remove DeepSeek, Including Third-Party Tools Built on Its Models

The U.S. Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to strip them from government IT systems, TechCrunch reported on 20 October. The notice, which covers DeepSeek's own tools and third-party products built on its technology, is the broadest U.S. federal action yet against the Chinese AI developer, and Beijing has already condemned it.

What the DHS order requires

According to BleepingComputer's reading of the notice, agencies must exclude DeepSeek from procurement immediately, including approved-product lists and purchasing marketplaces, and must remove it from agency IT systems immediately or request an exception. Exception requests are due within 60 days of the order's issuance and must carry a justification and proposed risk mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) reviews each request and issues a written approval or denial. Agencies that lack the internal capability to comply can ask CISA for technical help.

The scope reaches past the company's chatbot. The order names DeepSeek's affiliates and covers third-party products and services built on DeepSeek technology, which pulls in software vendors that embed its models. BleepingComputer states that the order "is not a general ban on private or consumer use", so it binds federal civilian agencies rather than individuals or private companies.

Reports differ on how much detail the order gives about timing. TechCrunch said the notice did not specify compliance deadlines, enforcement mechanisms or penalties, while BleepingComputer describes the exclusion and removal duties as immediate, with the 60-day window applying only to exceptions. The notice appeared on the Federal Register's public inspection list and was published in the Federal Register on 20 October, according to BleepingComputer.

The legal basis and DHS's stated reasons

PYMNTS reported that DHS invoked the Federal Supply Chain Security Act of 2018, a law that lets the department manage supply-chain risk by recommending that risky products or services be excluded or removed from federal procurement and IT systems. Other outlets did not describe the statute in the same terms, so the legal citation rests on PYMNTS alone.

DHS said DeepSeek's models "present multiple threat vectors", according to PYMNTS. It identified three: Chinese laws that allow the government to access private company infrastructure; an account-creation process that collects personally identifiable information; and a prompt-and-response process that requires users to hand information to the model. DHS warned that moving such data to China, alone or combined with public data, "could produce actionable intelligence on U.S. persons and/or government programs." It added that the models "may contain malware or other security vulnerabilities."

The malware language is cautious. BleepingComputer notes that the notice leans on a February 2025 NowSecure report on DeepSeek's iOS app, which found unencrypted data transmissions, weak encryption algorithms, insecure local storage, user-fingerprinting risks and data sharing with ByteDance. Those findings concern the mobile app, not the underlying models, and BleepingComputer describes the malware concern as "potential". Nothing in the reporting shows that every covered DeepSeek deployment contains malicious code.

How Beijing responded

China's Foreign Ministry spokesperson Mao Ning said Beijing opposes "overstretching the concept of national security and politicizing technology and trade issues", and that China would "resolutely safeguard the legitimate rights and interests of Chinese enterprises", according to TechCrunch. The statement came at an official briefing. TechCrunch did not report a response from DeepSeek itself, and none appears in the other two sources reviewed.

Where the order sits in a longer campaign

The order extends a trail of earlier restrictions. TechCrunch reported that a law passed in December 2025 already limited DeepSeek's use in intelligence agencies' national security systems; the DHS notice carries that logic to civilian agencies and to both new purchases and existing systems. PYMNTS recalled that the U.S. Department of Commerce banned DeepSeek's model on government-furnished equipment in March 2025, that Texas was the first U.S. state to bar it on government-issued devices, and that Australia, Taiwan and Italy were among the first countries to act abroad.

The security argument has also acquired a competitive edge. TechCrunch noted that a September report, which it linked to a CISA advisory, accused DeepSeek and five other Chinese AI companies, including Alibaba and Moonshot AI, of using large-scale distillation, a technique that trains one model on another model's outputs, to extract information from American AI systems. OpenAI told U.S. lawmakers earlier this year that it had observed suspected DeepSeek attempts to distill its models, and Anthropic said it had identified unauthorized attempts by DeepSeek and other Chinese labs to collect outputs from Claude. Those are company claims; the reporting reviewed does not include an independent finding.

Why it matters for the AI supply chain

The practical weight falls on the third-party clause. Federal civilian agencies buy AI through resellers, integrators and software platforms, and some of those products may embed open-weight DeepSeek models without saying so prominently. Agencies now have to audit what they run, identify any product built on DeepSeek technology, and either remove it or justify an exception to CISA. That is a compliance task far larger than deleting one chatbot app, and it falls on departments that may have limited visibility into the model provenance of their vendors' software.

The order also tests how far U.S. supply-chain law can reach into the model layer of AI. Hardware bans on named vendors are well established; an order aimed at software whose weights can be downloaded and rebuilt into other products is harder to police, and the exception process will show how strictly CISA reads it.

For Beijing, the order arrives amid its own tightening. TechCrunch cited a Bloomberg report from the previous week that China is considering export restrictions on 23 AI-related technologies, including chip designs and certain advanced AI models, citing security and misuse risks. Together, the two moves point toward a world in which AI models are managed less like open research and more like strategic goods.

What we don't know yet

Several points remain open. The reporting does not say how many agencies currently use DeepSeek products or built-on-DeepSeek tools, nor how DHS will verify compliance. It does not show what exception requests will be granted, and it does not include any DeepSeek comment. Sources also differ on whether the notice sets firm removal deadlines. The first CISA decisions on exception requests will show how broadly the order is applied in practice.