Washington is removing DeepSeek from civilian federal IT—how far does the order reach?
DHS has disclosed a July order blocking new federal civilian procurement and requiring removal of DeepSeek products—including third-party services built on its implementations. It is not a nationwide consumer ban or proof that a breach occurred.
The short version
- What happened
- DHS released the six-page order for public inspection on 19 October, but the Secretary signed it and made it effective on 10 July 2026.
- Who it affects
- Federal staff may lose access to tools or workflows that use DeepSeek directly or through a supplier, while procurement and security teams must trace less visible dependencies.
- What remains unproven
- The source is the responsible government's public order, not an independent technical audit.
Keep in mind
The source is the responsible government's public order, not an independent technical audit.
Classified and supporting evidence reviewed by the government is not reproduced in the public notice.
No affected-system, contract, user, removal, exception, incident or cost denominator is reported.
The order does not demonstrate that a federal breach occurred or that every DeepSeek-based product contains malware.
China's reported objection states a government position but supplies no public technical evidence that resolves the U.S. security claims.
Source analysis · 2 linked sources. Primary analysed source date: 19 October 2026.
Read the full report · 6 min The evidence, methods, implications and limitations
A broad federal IT restriction, disclosed three months later
The U.S. Department of Homeland Security has publicly disclosed an order excluding DeepSeek products from federal civilian procurement and removing them from civilian agency information technology. The Federal Register placed the notice on public inspection on 19 October and published it on 20 October as 91 FR 66346. The timing needs care: the Homeland Security Secretary signed the underlying order on 10 July 2026 and made it effective immediately. This is therefore a consequential public disclosure of an existing order, not a ban first imposed on the publication date.
The scope goes beyond DeepSeek's own app or model. It covers products and services developed by Hangzhou DeepSeek Artificial Intelligence and affiliates, plus third-party products and services developed using DeepSeek implementations. Agencies are told both to block new procurement and remove covered technology from their IT. The statutory definition targets federal civilian executive agencies; the order explicitly excludes the Defense Department. It does not prohibit every U.S. company or consumer from using DeepSeek, and it is not a general import ban.[1]
DHS cites data access and supply-chain risk
DHS says the Federal Acquisition Security Council reviewed classified and unclassified material and concluded that using DeepSeek created an unacceptable supply-chain risk. The public order says DeepSeek stores data in China and collects information including keystroke patterns, internet activity and device details. It also argues that Chinese law can require organisations and citizens to assist intelligence work. Those are the government's stated grounds for the restriction; the public notice does not reproduce the classified evidence or quantify how many agency systems, contracts or users were affected.
The notice also raises the possibility of malware, security vulnerabilities and actionable intelligence about U.S. people or agencies. It does not identify a confirmed compromise, malicious code found in a deployed federal product, data exfiltration incident or affected-person count. That distinction matters. A procurement authority can act preventively when it judges a supply chain unacceptable; the order is evidence of that risk decision, not proof that every DeepSeek-based service is malicious or that a breach already happened.[1]
The distinction that matters
What the order requires—and what it does not establish
The action combines procurement exclusion and system removal, while leaving limited exceptions and major evidence gaps.
New purchases
Exclude covered products and services
Civilian procurement restriction
Existing systems
Find and remove DeepSeek dependencies
Agency remediation work
Exceptions
Request mission or security approval
Case-by-case decision
Beijing rejects the measure, without resolving the technical dispute
China's Commerce Ministry said on 20 October that it opposed the U.S. action and urged Washington to revoke it. Reuters reported that the ministry described the restriction as an abuse of national-security concepts and said it disregarded a consensus reached in bilateral economic and trade consultations, including dialogue on AI. That response raises the order into a live diplomatic dispute over technology controls and government procurement.
The statement, as reported, does not address the public order's claims about data storage, collection practices or Chinese intelligence law with technical evidence. Nor does it provide an affected-system count, audit findings or an alternative account of how DeepSeek-based services handle U.S. government information. The response is therefore material evidence of China's position, not a technical rebuttal that resolves the underlying risk assessment.[2]
What agencies, suppliers and the public need next
Federal technology teams now need an inventory that reaches embedded services, not only software carrying a DeepSeek label. Suppliers may have to explain whether a product uses DeepSeek implementations and offer an alternative. The order lets agencies request exceptions for mission, business or national-security reasons, with the Secretary making the decision, and it preserves an administrative appeal route. The public text gives no common removal deadline, implementation count, exception list or method for determining when an indirect dependency falls inside the restriction.
For federal workers, the immediate consequence is narrower tool choice and possible workflow changes; for vendors, it is a compliance and disclosure burden. For the public, the intended benefit is reduced exposure of government information, but no outcome data yet show whether the order reduced incidents or created service disruption. Official publication confirms the legal notice; confidence in implementation still depends on transparent guidance, counts of removals and exceptions, and independent technical evidence. The defensible conclusion is that Washington has imposed a wide civilian-agency supply-chain restriction—not that it has demonstrated a live DeepSeek breach.[1]