DHS Bars DeepSeek Technology from Federal Civilian Agency Systems and Procurement

The Department of Homeland Security (DHS) has ordered federal civilian agencies to remove DeepSeek technology from their information technology systems and prohibited procurement of DeepSeek products and services. The ban also reaches third-party products and services developed using DeepSeek technology, making the directive relevant beyond purchases made directly from the Chinese AI company. DHS made the order public on October 19, 2026, but the restriction had taken effect at the end of July. The supplied reporting identifies July 24 as the issuance date, without specifying its year; accordingly, the precise date for the order’s 60-day exemption-request window cannot be established from the available information.

The order applies to civilian executive agencies, including the Departments of the Treasury, State, and Justice, while Department of Defense (DoD) agencies are excluded. DHS permits agencies to request exemptions by submitting written justifications within 60 days of issuance. That provision may matter to agencies with operational dependencies or implementation constraints, but the reporting does not identify approved exemptions or describe a separate contractor waiver process. Contractors should therefore confirm requirements with their contracting agencies rather than assume that an exemption request by an agency automatically covers a supplier or product.

DHS cited national security and cybersecurity concerns. According to the reporting, the order says DeepSeek models “present multiple threat vectors,” including possible access by Chinese authorities to sensitive U.S. government data and the risk that sensitive information could be transferred to China. DHS also raised concerns about malware and other security weaknesses, referencing open-source research that identified multiple critical vulnerabilities in DeepSeek’s iOS application. The available account does not detail the underlying technical findings or identify specific systems affected, so suppliers should avoid treating the published concerns as a complete vulnerability inventory.

For federal contractors, the directive creates a practical review obligation across product architecture and supply chains. A company may not use a DeepSeek-branded product directly yet still rely on a third-party service, software component, or subcontractor offering that incorporates DeepSeek models. The source names Snowflake, Vercel, and OpenRouter as companies whose offerings incorporate DeepSeek; their mention does not establish that any particular federal contract or deployment is covered. Contractors supporting civilian agencies should map embedded AI components, model dependencies, hosted services, and subcontractor practices, then assess whether any use falls within the order’s scope. The DoD exclusion makes contract and customer segmentation important: a product used on a DoD effort may be treated differently from the same product deployed for a civilian agency.

The action also sits within a broader series of government restrictions and policy concerns described in the reporting. Earlier measures reportedly included a Defense Information Systems Agency move to block access to DeepSeek models in January 2025, Commerce Department bureau instructions restricting DeepSeek on government devices in March 2025, and a congressional restriction on its use within intelligence community systems in December 2025. Separately, the White House has criticized Chinese AI firms. An internal memo by White House technology lead Michael Kratsios alleged “malicious exploitation” of American AI firms, while Anthropic and OpenAI have claimed that some Chinese AI firms, including DeepSeek, essentially copied their models. Those allegations are reported claims, not findings established by the DHS order.

• Scope: Civilian federal agencies must remove DeepSeek technology from IT systems and may not procure DeepSeek products or services.
• Third-party reach: The restriction also covers third-party offerings developed using DeepSeek technology, making component and model provenance relevant to acquisition reviews.
• Effective timing: DHS made the order public on October 19, 2026; reporting says it took effect at the end of July and identifies July 24 as the issuance date, but not its year.
• Exemptions: Agencies may submit written justifications to DHS within 60 days of issuance; the exact deadline cannot be calculated from the supplied date information.
• Agency boundary: The Departments of the Treasury, State, and Justice are among the civilian agencies covered; DoD agencies are excluded.
• Security rationale: DHS cited possible exposure of sensitive government information, potential transfer of data to China, and cybersecurity risks, including reported vulnerabilities in DeepSeek’s iOS application.
• Supplier review: Federal vendors should inventory AI models, software dependencies, hosted services, and subcontractor components that may use DeepSeek technology.
• Named commercial platforms: The reporting identifies Snowflake, Vercel, and OpenRouter as companies incorporating DeepSeek into offerings; this does not confirm use on any specific federal contract.
• Prior restrictions: The source reports earlier actions involving DISA in January 2025, Commerce Department bureaus in March 2025, and intelligence community systems in December 2025.
• Contract management: Suppliers should distinguish civilian-agency obligations from DoD work and coordinate any potential exception or transition with the relevant contracting agency.