The United States government has ordered federal civilian agencies to remove artificial intelligence software developed by Chinese startup DeepSeek from their information technology networks and barred future procurement of the company’s tools. The directive, issued by the Department of Homeland Security (DHS) and made public on Monday, October 19, 2026, cites counterintelligence and data security risks associated with Chinese server infrastructure. While the underlying order was originally signed on July 24, 2026, its publication in the Federal Register on October 20 formalizes the restriction across civilian departments and their third-party software supply chains.

The policy applies both to proprietary applications built by DeepSeek and its affiliates and to third-party software and services developed using DeepSeek model implementations, according to Kazinform and The Guardian. Federal agencies are required to audit their existing environments, excise the affected software, and implement heightened network monitoring during the transition to prevent data exfiltration.

Security Rationale and Supply Chain Risks

The DHS directive was executed under the authority of the Federal Acquisition Supply Chain Security Act of 2018 following an evidentiary review and recommendations from the Federal Acquisition Security Council. According to Bloomberg, DHS Secretary Markwayne Mullin signed the underlying removal and procurement order on July 24, 2026, effectively barring DeepSeek from federal government contracts.

In documentation accompanying the Federal Register notice, DHS stated that DeepSeek’s models “present multiple threat vectors.” Federal officials warned that utilizing the tools could expose sensitive government information to Beijing, generate actionable intelligence regarding U.S. personnel and agency operations, or introduce malware and software vulnerabilities into federal networks. A primary technical concern highlighted by the department is that DeepSeek’s servers are located in China, where domestic laws grant the government broad legal authority to compel access to private corporate infrastructure and stored data.

To mitigate immediate risks while systems are audited, the order directs agencies to monitor network traffic flows to and from government websites and enforce safeguards against data leaks, according to Business Standard. Reporting from BankInfoSecurity notes that the directive included a 60-day window from the date of the order’s issuance for agencies to request formal exceptions, subject to review by the Cybersecurity and Infrastructure Security Agency (CISA).

Scope of the Federal Prohibition

Because DeepSeek releases open-weight models that are largely free to download and integrate, its code has been widely adopted by independent developers and enterprise software vendors globally. By targeting third-party products built using DeepSeek implementations, the DHS order requires federal procurement officers and IT administrators to inspect the underlying dependencies of contractor-supplied software, rather than merely blocking direct web access to DeepSeek’s hosted chatbot interfaces.

The legal architecture of the ban reflects the fragmented nature of U.S. federal cybersecurity oversight. According to CNBC and the BBC, the DHS action governs federal civilian agencies—including the Departments of the Treasury, State, and Justice—while Department of Defense agencies are excluded from this specific mandate, as DHS authority does not extend to military or intelligence services. However, TechCrunch reports that the civilian-agency order builds upon earlier legislative restrictions, noting that a law enacted in December 2025 previously targeted DeepSeek usage across intelligence and national-security systems.

Beijing’s Response and Geopolitical Context

The public disclosure of the ban drew immediate condemnation from Beijing, with separate government ministries issuing sharp rebukes on Tuesday, October 20. According to Reuters, China’s Ministry of Commerce stated that the U.S. restriction harmed the legitimate interests of Chinese enterprises and disregarded bilateral understandings reached by the two nations’ leaders, demanding that Washington revoke the measure.

Separately, Chinese Foreign Ministry spokesperson Mao Ning addressed the ban during a routine press briefing in Beijing, as reported by WRAL. “China consistently opposes the overstretching of the concept of national security and the politicizing of science, technology, economic and trade issues,” Mao said, adding that Beijing would “resolutely safeguard the legitimate rights and interests of Chinese companies.”

DeepSeek first disrupted the global AI sector in January 2025 with the release of a low-cost, high-performance model that challenged prevailing assumptions regarding the capital and compute required to match frontier American laboratories. The company subsequently released its V4 model in April 2026, followed by a faster, lightweight update to V4 earlier in October. U.S. officials have previously alleged that Chinese AI startups, including DeepSeek, engaged in large-scale model “distillation”—the automated extraction of capabilities from frontier American AI systems—claims that Beijing has rejected.

The friction over federal AI supply chains comes amid ongoing diplomatic engagement between Washington and Beijing. U.S. President Donald Trump and Chinese President Xi Jinping met at the White House in September 2026, where the two nations agreed to establish a communication channel for national security-related AI incidents. Both leaders are scheduled to meet again in mid-November on the sidelines of the Asia-Pacific Economic Cooperation (APEC) summit in Shenzhen, China, where artificial intelligence governance and export controls—including recent U.S. semiconductor restrictions, a Federal Communications Commission ban on foreign-made humanoid robots, and Beijing’s newly proposed export controls on advanced AI models—are expected to be central agenda items.

What It Means for Enterprise and Government Vendors

While the DHS order is strictly a federal supply-chain security measure and does not restrict private U.S. consumers or commercial enterprises from using DeepSeek, its inclusion of third-party implementations carries significant compliance implications for the domestic software industry.

Which third-party products are covered by the ban?

The order encompasses any third-party software or service developed using a DeepSeek implementation. For federal contractors and SaaS vendors selling to civilian agencies, this requires auditing internal codebases and AI pipelines to ensure that fine-tuned variants or distilled versions of DeepSeek models are not embedded within products deployed on government networks.

How are agencies handling compliance and exceptions?

Agencies are mandated to identify and remove affected tools while monitoring network traffic for anomalous data flows. While reporting indicates a 60-day window from the July 24 issuance date was established for CISA-reviewed exception requests, public documentation has not yet detailed how many civilian agencies sought waivers or the specific technical auditing mechanisms CISA is deploying to verify third-party supply chain compliance.

Sources

Read More