Markwayne Mullin in his official US Senate portrait, taken before he became Homeland Security Secretary. Image: United States Senate / Wikimedia Commons, Public domain, cropped
The US government has ordered every federal civilian agency to strip DeepSeek out of its computers and stop buying it, along with any third-party product built on the Chinese lab's AI. The Department of Homeland Security filed notice of the order with the Federal Register on Monday, under a 2018 supply chain law that lets it bar risky technology from government systems.
The order, numbered 2026-01 and signed by Homeland Security Secretary Markwayne Mullin, is dated July 24, 2026. It was kept out of public view until this week. Its notice is due to appear in the Federal Register on Tuesday, October 20, under docket DHS-2026-0628.
What the DeepSeek ban covers
The order tells all civilian agencies to do two things. First, exclude Hangzhou DeepSeek Artificial Intelligence, its affiliates and their products from purchasing "effective immediately", including agency-approved product lists, e-commerce marketplaces and similar buying channels. Second, remove products from DeepSeek and its affiliates, "and third-party products and services developed using DeepSeek implementations", from agency IT systems immediately.
That second clause is the wide one. DeepSeek's models are released as open weights, so they turn up inside other companies' tools as well as in DeepSeek's own app and website. The order does not list which products it means, and it does not say how agencies should treat a DeepSeek model running on a US company's servers. It also comes days after DeepSeek updated its cheap Flash model, which it says now beats Claude Opus 5 at some coding tasks.
It does not reach the military or spy agencies. The order applies to federal civilian executive branch agencies "except for their national security systems and secure compartmented information systems", which fall under the Pentagon and the Director of National Intelligence.
"Multiple threat vectors": why DHS says DeepSeek is a risk
The order's summary of risks says DeepSeek's servers are in China and that Chinese law "permits extensive authority to government cyber and intelligence functions to access private company infrastructure". It says DeepSeek's sign-up process collects personal information and may "track and digitally fingerprint users", and that its apps work by having people type in information, which could mean sensitive data from US government staff or contractors ends up in China.
Combined with public data, that information "could produce actionable intelligence on U.S. persons and/or government programs", the order says. It adds that the models "may contain malware or other security vulnerabilities", and cites a February 2025 NowSecure audit that found multiple critical flaws in DeepSeek's iPhone app.
The order's evidence is drawn from public material: DeepSeek's own privacy policy, a 2020 DHS business advisory on Chinese data risks and an April 2025 House Select Committee on China report. It doesn't describe any case of government data reaching DeepSeek.
Exceptions and the 60-day window
Agencies that can't comply can ask for an exception, such as having the order not apply to them, to certain actions, or a delay. Requests must be made in writing within 60 days of the order's issue, with a "compelling justification", for example the impact on mission-critical work, and any alternative safeguards. The Cybersecurity and Infrastructure Security Agency (CISA) reviews them and approves or refuses in writing.
Until DeepSeek products are gone, agencies are told to monitor traffic in and out of their networks, step up logging, add controls against data leaving their systems and flag anything unusual. CISA can help agencies that lack the skills to comply, and the Secretary must review the order within a year and every year after.
DeepSeek bans around the world
Several parts of the US government already blocked DeepSeek on their own devices, including the Commerce Department and the Navy, as did states including New York, Tennessee and Virginia, Reuters reported. Abroad, Italy's data protection authority blocked the DeepSeek app in early 2025, and Taiwan, South Korea and Australia barred it from government devices. Monday's order goes further, covering every civilian agency and everything they buy.
DeepSeek hasn't commented. The Chinese embassy in Washington didn't immediately comment, according to Reuters. The order lands as Beijing tightens its own grip on the sector: China now wants to control exports of its largest AI models, and DeepSeek is training its next model on Chinese chips.
Why it matters
This is the US government's broadest move yet against a Chinese AI lab, and by reaching third-party tools built on DeepSeek it puts the burden on every vendor selling AI to federal agencies to know which models sit inside their products. Chinese open models are among the most downloaded in the world, and few publish safety results at launch, so expect more buyers to start asking the same question.
Sources: Department of Homeland Security, "Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements" and Exclusion and Removal Order #2026-01 (Federal Register public inspection, document 2026-21447); Reuters (earlier bans and embassy response).
Latest Policy & Safety news
