The US government has issued a formal DeepSeek ban for its civilian agencies. They must remove the Chinese AI model from their IT systems and stop buying it, and the order also covers any third-party tool built on top of it. The order was made public on 19 October 2026. It turns a patchwork of agency-by-agency blocks into one rule across the federal government.
Key takeaways
- The Department of Homeland Security (DHS) ordered federal civilian agencies to remove DeepSeek products and stop acquiring them.
- The order covers more than the DeepSeek app. Third-party products and services built on DeepSeek’s models are included too.
- DHS says the models present “multiple threat vectors”, including the risk of sensitive data reaching China.
- The order does not apply to private companies, consumers or state governments.
What exactly does the DeepSeek ban do?
The order is officially called FASCSA Exclusion and Removal Order #2026-01. It went up on the Federal Register’s public inspection site on 19 October 2026, with formal publication set for 20 October. According to The Next Web, citing Bloomberg, the order is dated 24 July 2026 and was signed by Homeland Security Secretary Markwayne Mullin.
It does two things. Agencies must exclude DeepSeek and its affiliates from civilian procurement, which means no new purchases or contracts. They must also remove DeepSeek products that are already running, or apply for an exception.
The order has no public compliance deadline. Tech Insider expects follow-up guidance from the General Services Administration and agency IT chiefs to set the timetable.
Why does the US see DeepSeek as a security risk?
DHS lists its concerns plainly. In the order, as reported by Reuters, the department warns that using DeepSeek “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors.”
The threat vectors it cites, per PYMNTS, are:
- Chinese law: rules that let the Chinese state access private companies’ infrastructure.
- Sign-up data: creating an account collects personally identifiable information.
- Prompts: a chatbot only works when you feed it information, and that information goes to the provider.
- Code flaws: DHS says the models “may contain malware or other security vulnerabilities” and points to outside research that found multiple critical vulnerabilities in DeepSeek’s iOS app.
DHS’s conclusion is that all of this together “could produce actionable intelligence on U.S. persons and/or government” programmes. Here is an analogy: picture a free, very capable translator who sits in on every meeting, and whose employer can be legally required to hand over their notes. Being good at the job doesn’t fix that problem.
Why the third-party clause matters most
DeepSeek releases its models with open weights. Open weights means anyone can download the trained model and run it on their own servers or build products on it. DeepSeek’s V4 models, released on 24 April 2026, came out this way, and the company shipped a V4-Flash update on 17 October 2026.
So the risk isn’t limited to the DeepSeek chatbot. A contractor could sell an agency a tidy “AI assistant” under its own brand while DeepSeek runs underneath. The order closes that gap by covering “third-party products and services developed using DeepSeek implementations.”
In my view, this is the part with real teeth. Vendors that sell to the federal government now have to show which model sits inside their product. Many of them have never been asked that question.
How did we get here? A short timeline
The new order is the latest in a series of restrictions that began soon after DeepSeek’s R1 chatbot took off in January 2025. On 27 January 2025, Nvidia shares fell about 17% as investors wondered whether cheap Chinese models would reduce demand for expensive chips.
| When | Who | What |
|---|---|---|
| January 2025 | Pentagon IT agency, US Navy | Blocked DeepSeek on work systems |
| Early 2025 | Texas, then New York, Virginia, Tennessee | Barred it on state government devices |
| February 2025 | Congress | Bipartisan “No DeepSeek on Government Devices Act” introduced |
| March 2025 | Commerce Department | Banned it on government-furnished equipment |
| June 2026 | White House | Held off on trade-blacklisting DeepSeek and 100+ Chinese firms |
| 19 October 2026 | DHS | Government-wide civilian removal and procurement ban |
Other countries acted early too. Australia, Taiwan and Italy all restricted DeepSeek in 2025.
Does this affect you if you use DeepSeek?
Not directly. The order covers federal civilian agency systems and contracts. It doesn’t touch consumers, private businesses, state governments or DeepSeek’s commercial API.
It still sends a signal. Plenty of companies have picked low-cost models to keep their AI bills down, a trend we looked at in how AI is changing small businesses. If you sell software to the US government, or hope to, DeepSeek is now a liability in your product. Even if you don’t, your security team may start asking the same question DHS asked.
What happens next
- Implementation guidance: agencies will need practical instructions and deadlines for finding and removing DeepSeek, including inside vendor tools.
- Exception requests: agencies that believe they need DeepSeek, for example for security research, can apply for an exception.
- More China tech curbs: Reuters reports the Federal Communications Commission plans to vote on 29 October 2026 on barring Chinese labs from testing electronics for the US market.
- A reply from Beijing: the Chinese embassy in Washington did not immediately comment, and DeepSeek had not responded publicly when the order was reported.
FAQ
Is DeepSeek banned for everyone in the US?
No. The DHS order applies only to federal civilian agencies’ IT systems and purchasing. Individuals, companies and state governments can still use DeepSeek, though some states ban it on their own government devices.
What law is the ban based on?
The Federal Acquisition Supply Chain Security Act of 2018. It lets DHS order risky products or services excluded from federal procurement or removed from government IT systems.
Does the ban cover apps built on DeepSeek’s open models?
Yes. The order explicitly includes third-party products and services developed using DeepSeek, so a rebranded tool running DeepSeek underneath is also banned.
If your organisation uses AI tools from outside vendors, ask each one which base model it runs on. After this order, that question is going to come up a lot more often.
3 comments