DHS Signed a DeepSeek Ban in July, and Now Every Civilian Agency Must Rip Out Tools Built on It Too

Every federal civilian agency in the United States now has to purge DeepSeek from its computers and stop buying it. The order goes further than the Chinese lab's own chatbot: it also covers third-party products and services built on DeepSeek models, which matters because a cheap open-weight model can sit underneath software sold under another company's name.

The odd part is the timing. The signed order, "Exclusion and Removal Order #2026-01," carries an original release date of July 24, 2026. It only became public this week, in a Federal Register notice filed Monday and published Tuesday. For roughly three months, the most popular low-cost Chinese AI model was formally barred from civilian government IT before the public saw the order.

The legal tool behind it

Homeland Security Secretary Markwayne Mullin signed the order under the Federal Acquisition Supply Chain Security Act of 2018, after reviewing a recommendation and supporting evidence from the Federal Acquisition Security Council. Russell Vought, director of the Office of Management and Budget, is copied.

Agencies must drop DeepSeek from procurements immediately, including approved product lists, service provider equipment lists and e-commerce markets. They must also remove DeepSeek products, and anything built on DeepSeek implementations, right away. The only way out is an exception, requested in writing within 60 days of the order's issuance, with a compelling reason such as an impact on mission-critical work or national security. CISA decides whether to grant it.

What DHS says the threat is

The order lays out its case in a short list. DeepSeek's servers sit in China, and Chinese law gives government cyber and intelligence services broad power to reach into private company infrastructure. Creating an account on DeepSeek's hosted models collects personal data and may track and digitally fingerprint users.

Then there are the prompts. If government employees or vendors type into the service, sensitive data may flow to the PRC, and the order warns that this information, alone or combined with public data, "could produce actionable intelligence on U.S. persons and/or government programs." DHS adds that the models may carry malware or other vulnerabilities, and points to open-source research that found multiple critical flaws in DeepSeek's iOS app.

Until removal is complete, agencies are encouraged to monitor traffic in and out of their networks, tighten logging and data exfiltration controls, and flag anomalous activity, CyberScoop reported. Some of the privacy and data collection concerns Mullin lists could just as easily apply to other AI models, Chinese or American.

What it does not cover

The order applies to federal civilian executive branch agencies only. It explicitly excludes national security systems, which fall outside DHS's authority, so the Pentagon and the intelligence community are not bound by it. Neither DeepSeek nor the Chinese embassy in Washington commented.

From patchwork to policy

Until now, the government handled DeepSeek piecemeal. A Pentagon IT agency blocked its chatbot in January 2025, and the Commerce Department and the Navy banned it on work devices, while New York, Tennessee and Virginia took similar steps, according to TNW. In June, the White House held off on adding DeepSeek and more than 100 other Chinese firms to a trade blacklist even after officials cleared them for it.

The pressure on DeepSeek has been building on another front too. In February, OpenAI told lawmakers DeepSeek used distillation to build its R1 chatbot, and last month a joint NSA, CISA and FBI advisory accused six Chinese AI firms, DeepSeek and Alibaba among them, of industrial-scale distillation of American frontier models. Anthropic, in a September report, said it logged more than 12 million exchanges tied to DeepSeek's distillation activity over two weeks in July.

That backdrop matters because DeepSeek's open-weight models, sold cheaply, are putting real competitive pressure on Silicon Valley, Quartz reported. R1 rattled global markets in early 2025, and the House Select Committee on China called the company's links to Beijing "significant" a few months later.

DeepSeek is still the only Chinese lab named in the order. Moonshot AI, maker of Kimi, and Alibaba, maker of Qwen, have drawn similar suspicion from national security officials, but for now their models remain off the list.

Some offers on this page may be paid placements or contain affiliate links.