US Government Bans DeepSeek AI, Orders Federal Agencies to Remove Tools

Key Takeaways

• The U.S. Department of Homeland Security (DHS) has issued a directive prohibiting federal civilian agencies from acquiring or utilizing products from DeepSeek AI.
• The ban extends beyond direct DeepSeek products to include any third-party tools or services that incorporate DeepSeek’s underlying technology.
• This action is a supply chain security measure, not a response to a confirmed data breach, and does not impose a nationwide ban on private use.
• Agencies must conduct thorough inventories to identify and remove all instances of DeepSeek technology, including embedded implementations, from their IT systems.

The U.S. Department of Homeland Security (DHS) has mandated that all federal civilian agencies cease the procurement of products and services from Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and any third-party offerings leveraging DeepSeek implementations. Agencies are further ordered to remove all such existing technologies from their information systems.

This directive, officially filed for public inspection on October 19, 2026, with a scheduled publication date of October 20, represents a significant government-wide restriction on the AI supply chain. It is crucial to note that this order specifically targets federal civilian agencies and does not constitute a national prohibition on DeepSeek’s use by private businesses or individuals.

U.S. Government Imposes DeepSeek AI Ban on Federal Agencies

The DHS notice outlines two primary requirements for federal civilian agencies. First, they must immediately exclude all IT products and services from DeepSeek and its affiliates from future procurement processes. Second, and more broadly, agencies are compelled to remove all existing DeepSeek and affiliate products, including those embedded within third-party solutions, from their current technology infrastructure. This second clause significantly expands the scope beyond merely blocking new purchases.

Addressing Third-Party Implementations

The inclusion of third-party implementations is particularly critical for cybersecurity teams. Agencies might be unknowingly utilizing DeepSeek technology through a different vendor’s product or service, rather than a directly branded DeepSeek application. Consequently, a superficial review focused solely on known DeepSeek-branded tools could overlook numerous products subject to the removal mandate. Agencies are therefore obligated to meticulously investigate the underlying AI models powering their existing services.

The DHS has not provided a comprehensive public list of affected third-party vendors or products. This places the onus on both suppliers and agency procurement teams to ascertain whether specific tools incorporate DeepSeek implementations. Assumptions based on product names alone are insufficient; thorough examination of contract documentation and technical specifications will be essential for compliance.

For vendors currently serving federal civilian agencies, this order necessitates a careful evaluation of their own AI features to determine if they rely on technology that government clients are now compelled to exclude or remove.

DHS grounds this action in the Federal Acquisition Supply Chain Security Act of 2018 and its associated implementing regulations. The department states that the Secretary’s decision followed a review of recommendations from the Federal Acquisition Security Council and supporting evidence. Affiliates are identified according to the definition provided in federal acquisition regulations at 48 CFR 2.101.

This directive underscores a shift in how the government views AI: primarily as a supply chain security concern. Agencies must now not only evaluate the accuracy of AI outputs or the appropriateness of uploading sensitive data but also understand the specific companies and underlying technologies that power the software integrated into government systems.

It is important to differentiate this exclusion and removal order from a public report detailing a federal data breach. The published notice does not describe any specific intrusion, identify stolen government records, or assert that all DeepSeek deployments have resulted in information leaks. Such conclusions should not be drawn solely from this restriction.

While separate reporting has highlighted instances of malicious actors misusing AI models—including previous reports on hackers exploiting DeepSeek and Qwen models to develop malware and bypass safeguards, and more recent accounts of attackers using Codex and DeepSeek AI agents in campaigns against PaperCut servers—these provide context on AI abuse but do not constitute the direct evidence cited for this specific DHS decision.

What You Should Do

• Conduct a Comprehensive Inventory: Immediately begin an exhaustive audit of all AI tools, applications, and services across your agency’s IT infrastructure. This must include installed software, hosted services, internal development projects, and third-party vendor agreements.
• Identify Underlying Dependencies: For every AI-powered tool, investigate its backend model settings and directly query vendors to document the specific AI models used in their products. Do not assume a different product name means it is not covered.
• Plan for Replacement and Continuity: If a critical workflow relies on a covered DeepSeek service, develop a robust replacement plan. This plan should address access controls, data migration, and ensure service continuity during the transition.
• Document Everything: Maintain meticulous records of your findings, communications with suppliers, and all products removed or replaced. This documentation is crucial for demonstrating compliance and distinguishing a completed review from mere assumptions.
• Consult Official Guidance: Refer to the signed order in docket DHS-2026-0628 on Regulations.gov and contact CISA’s FASCSA Order Implementation Team for detailed implementation terms and clarification.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.