DHS orders all federal civilian agencies to remove DeepSeek AI products

The U.S. Department of Homeland Security has issued an order excluding DeepSeek products and services from federal civilian agency procurement and requiring their removal from any government IT systems where they're already installed. The order was posted to the Federal Register's public inspection site on October 19 and scheduled for official publication on October 20, as first reported by Engadget.

What the order actually covers

The restriction is broad by design. DHS's notice excludes “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations” from federal civilian agencies — not just the company's own chatbot or API, but any downstream product built on its models. Agencies such as the Environmental Protection Agency or the Federal Communications Commission must now strip any DeepSeek-based tooling from their systems, and DeepSeek is barred from participating in future federal government contracts entirely.

In its filing, DHS cited several specific threat vectors: the risk that sensitive data from U.S. government employees and vendors could be transferred to the Chinese government, since DeepSeek's infrastructure sits in the People's Republic of China, where national law grants authorities broad access to private company systems. The agency also flagged DeepSeek's account-creation process, which collects personal information and may track and digitally fingerprint users — data DHS said could be combined with other public information to produce “actionable intelligence on US persons and/or government agencies.” DHS further warned that DeepSeek's models themselves “may contain malware or other security vulnerabilities.”

Part of a pattern, not a first strike

This is a government-wide formalization of restrictions that individual agencies had already adopted piecemeal. The Navy, NASA, and the Department of Commerce have previously banned DeepSeek on government devices, and multiple states — including New York, Tennessee, and Virginia — imposed similar restrictions earlier. A bill to ban DeepSeek from government devices entirely was also proposed by lawmakers last year. DHS's order consolidates that patchwork into a single, government-wide mandate covering both use and procurement.

Timing and scope questions

The order lands just days after DeepSeek released its newest model, V4.1-Flash-1017, which the company billed as “smarter, faster, more efficient” than its predecessor. DeepSeek's low-cost models have increasingly competed with offerings from OpenAI and Google, which has kept the company under sustained scrutiny since its January 2025 model release briefly wiped over $1 trillion from U.S. tech stocks, with Nvidia alone losing roughly 17% of its market value in a single day.

The breadth of the new order has already raised practical questions. Because it covers “third-party products and services developed using DeepSeek implementations,” the restriction could reach well beyond DeepSeek's own apps to any enterprise tool that routes requests through DeepSeek's open-weight models — including via AI gateway services that let developers swap between model providers. Agencies and vendors now face the task of auditing their software supply chains to identify any DeepSeek dependency, direct or indirect, a process that is likely to be far messier than banning a single named application.