The U.S. Department of Homeland Security (DHS) has ordered all federal civilian agencies to remove products from the Chinese artificial intelligence company DeepSeek from their information technology systems and banned future procurement of the firm’s software. In a public notice surfaced on Monday, Oct. 19, 2026, and scheduled for formal publication in the Federal Register on Tuesday, Oct. 20, the department cited national security risks and potential data exposure to the People’s Republic of China (PRC), according to Yahoo News and Politico.

The directive extends beyond software distributed directly by DeepSeek and its affiliated entities. Under the order, federal civilian agencies are also barred from acquiring or operating third-party services developed using DeepSeek AI implementations, according to the South China Morning Post. DHS officials stated that the AI models present multiple threat vectors and warned that utilization by government personnel or federal contractors could expose sensitive agency operations to foreign intelligence collection.

Security Threat Vectors and Data Jurisdiction

The DHS directive centers on the intersection of AI data-handling architectures and foreign legal jurisdiction. According to The Hill, DHS warned that user prompts and model responses generated by federal employees or vendors could transfer sensitive government information directly to the PRC. Even when individual queries appear benign, the agency assessed that aggregating such interactions with publicly available information could yield actionable intelligence regarding U.S. personnel or federal programs.

Beyond conversational data capture, the notice scrutinized DeepSeek’s telemetry and account-generation practices. DHS noted that the platform collects personally identifiable information (PII) and employs mechanisms capable of tracking or digitally fingerprinting users. Furthermore, the department cautioned that the underlying AI models themselves could contain embedded malware or exploitable software vulnerabilities, according to BankInfoSecurity.

These technical warnings are compounded by physical infrastructure location and statutory obligations in Beijing. Because DeepSeek maintains server infrastructure within China, DHS assessed that the company is subject to Chinese national security laws, which grant Beijing broad legal authority to compel domestic technology firms to surrender data or provide access to internal systems. However, current reporting indicates that DHS framed these issues as prospective threat vectors and risk assessments rather than citing evidence of a confirmed data breach or active malware deployment within federal networks.

Supply Chain Authority and Third-Party Complexity

The exclusion and removal directive was issued under the authority of the Federal Acquisition Supply Chain Security Act of 2018, following an investigation and formal recommendation by the Federal Acquisition Security Council, according to CyberScoop and The Korea Times.

While the notice became public in October 2026, the internal directive originated months earlier, though published accounts differ on the exact chronology. According to CyberScoop, a letter from DHS Secretary Markwayne Mullin ordering the exclusion was dated June 26, 2026, whereas International Business Times UK reported the action as Exclusion and Removal Order #2026-01 dated July 24, 2026.

For government chief information officers and federal contractors, the most complex aspect of the mandate is its prohibition on third-party products built using DeepSeek implementations. Because DeepSeek distributes open-weight models that developers can download, modify, and host on independent cloud infrastructure, enterprise software vendors frequently integrate these models into broader applications. According to analysis cited by Security Magazine, identifying every downstream software tool that incorporates adapted open-weight code presents significant supply-chain auditing challenges for compliance teams.

During the removal process, DHS has instructed civilian agencies to monitor network traffic, enhance system logging, and watch for anomalous activity. The order does allow for narrow waivers: agencies seeking an exception must submit a written request at least 60 days in advance demonstrating a compelling justification, such as a mission-critical operational requirement or national security necessity.

Implications for U.S.-China Tech Relations and Enterprise Users

The DHS order underscores how generative AI models and open-weight software ecosystems have become central friction points in U.S.-China technology relations. By treating foreign AI model architectures and training origins as supply-chain security hazards, Washington is applying the same exclusionary procurement frameworks previously used against Chinese telecommunications hardware and cybersecurity vendors to the artificial intelligence layer.

For private businesses and everyday consumers, the immediate legal impact is limited. The directive applies strictly to federal civilian agency IT systems and government procurement contracts; it does not constitute a nationwide ban on private U.S. citizens or commercial enterprises downloading or utilizing DeepSeek models. However, technology vendors that supply software to the U.S. government will need to audit their AI pipelines to ensure no DeepSeek models or derivatives are embedded in products sold to federal civilian clients.

Frequently Asked Questions

Which federal agencies had deployed DeepSeek prior to the ban?

Public reporting and the DHS notice do not provide an inventory of specific federal systems or agencies that had installed DeepSeek products, nor do they disclose how many government users or contractors were affected by the removal order.

Was DeepSeek caught exfiltrating U.S. government data or deploying malware?

Available coverage indicates that DHS cited data transfer to the PRC, user fingerprinting, and potential malware as prospective security risks and threat vectors. Reports do not establish that a specific compromise, data exfiltration event, or malware infection actually occurred on federal systems.

How will agencies identify third-party software using DeepSeek models?

The public notice does not detail the specific technical auditing mechanisms agencies must use to verify third-party compliance. Because DeepSeek’s models can be adapted and hosted by independent providers, verifying software supply chains remains an operational challenge for federal procurement officers and vendors.

Sources

Read More