DHS quietly barred DeepSeek from civilian federal IT in July. The order surfaced this week.

The Department of Homeland Security barred Chinese AI startup DeepSeek from federal civilian agency information technology systems under an order signed by Secretary Markwayne Mullin on July 24, 2026. The prohibition only became public this week, when DHS filed the notice for publication in the Federal Register (document 2026‑21447) on October 19, ahead of formal publication on October 20.

The restriction is sweeping. It removes DeepSeek from civilian agency networks, bars the company and its affiliates from federal contracts, and extends to any third‑party tool built on DeepSeek's models — a clause that reaches far beyond the company's own chatbot. Reuters reported the measure on Monday, the same day DHS published the notice.

The order landed with almost no warning, and while it was already in force, the public disclosure lands squarely in the middle of DeepSeek's latest product push.

Which agencies it covers, and which it does not

The order is specific to civilian agencies. The BBC reported that the Departments of Treasury, State and Justice fall inside the ban, and Engadget added that agencies such as the Environmental Protection Agency and the Federal Communications Commission would have to exclude DeepSeek products while also removing existing ones. Agencies within the Department of Defense are excluded.

The legal basis is the Federal Acquisition Supply Chain Security Act of 2018, applied on a recommendation from the Federal Acquisition Security Council, according to CyberScoop. The notice names Hangzhou DeepSeek Artificial Intelligence Co. Ltd. and any affiliated entities, and CyberScoop reported that it bundles a June 26 letter from Mullin ordering the exclusion — evidence, the outlet wrote, that "the ban has been in place for months."

Why DHS flagged DeepSeek

DHS said DeepSeek's models present "multiple threat vectors," and warned that use of its products "may result in the transfer of sensitive data" of U.S. government employees or vendors to the Chinese government, Politico reported. Three specific concerns recur across the coverage:

• Data residency. DeepSeek keeps user data on servers in China, where national security laws give the government wide latitude to request data from domestic companies. The Hill cited the order's note that the Chinese government has "extensive authority" to access private infrastructure.
• Personal collection and fingerprinting. DHS warned that the models can collect personally identifiable information and may "track or digitally fingerprint" users.
• Software risk. The notice says DeepSeek's models could "contain malware or other security vulnerabilities" — the same language Engadget reported.

The sharpest line in the order concerns the prompt-and-response process in DeepSeek's most widely used applications. The transfer of that information to the PRC, "either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs," according to The Hill.

The background is a wider campaign. The BBC noted that White House tech lead Michael Kratsios wrote in an internal memo earlier this year that "malicious exploitation" of American AI firms had been occurring, mainly by rival firms in China, and that Anthropic and OpenAI have both claimed Chinese firms including DeepSeek essentially copied their models. President Donald Trump has consistently framed China as the key U.S. rival in AI development. DeepSeek's own rise is the source of that friction: the R1 model sent shockwaves through Washington and Silicon Valley last year by drawing comparisons to top American models while being developed with reduced-capacity chips at a fraction of the cost, The Hill reported.

The exemption process

Agencies are not shut out entirely. Requests for an exception must be filed 60 days in advance with a "compelling justification," such as an inability to perform a mission-critical function or other national security considerations, CyberScoop reported. Mullin also encouraged agencies still removing DeepSeek from their systems to strengthen monitoring during the transition — better logging, tighter data-exfiltration controls, and flagging anomalous network activity.

Agencies had already moved on their own

The DHS order codifies practice that many agencies had already adopted. The Pentagon's IT agency blocked DeepSeek's chatbot from federal devices in January 2025; the Commerce Department and the Navy barred it on work devices last year; and New York, Tennessee and Virginia took comparable steps at the state level, The Next Web reported. That outlet also noted that the White House held off in June on blacklisting DeepSeek and more than 100 other Chinese firms for a trade blacklist, even after a panel of experts cleared them — and that OpenAI told lawmakers in February that DeepSeek used distillation to build its R1 chatbot.

DeepSeek kept shipping while the order sat unpublished

The timing is awkward for the regulator. DeepSeek released V4.1‑Flash‑1017 on October 17, describing it as "smarter, faster, more efficient" in its own release notes — a model the company says delivers a Pareto improvement in performance and cost with a fourfold faster API. The DHS notice surfaced roughly 48 hours later.

The company has not stood still. The BBC reported that DeepSeek's free chatbot app is among the most downloaded apps in the Apple App Store rankings, that demand has at times overwhelmed the company's servers, and that US tech companies including Snowflake, Vercel and OpenRouter all incorporate DeepSeek in offerings to their own customers. Startups have flocked to open-source models of this kind, and for developers the cost of using DeepSeek is a fraction of closed models such as Gemini, Claude or Codex. The financial asymmetry remains stark: DeepSeek said its debut model cost about $6 million to train, against roughly $100 million for OpenAI's GPT‑4, a disclosure that sent tech stocks tumbling when it broke last year.

What comes next

The public-inspection period ran ahead of formal publication, and written public comments were accepted through October 19. The practical tasks for agencies are now concrete: publish removal timelines, adjudicate exemption requests, and decide what replaces DeepSeek in workflows that were tuned around cheap, fast Chinese open-weight models. The harder problem is standing up vetted alternatives at comparable price and latency.

The order also raises the question of what comes after DeepSeek. CyberScoop noted that other Chinese open-weight models — Moonshot AI's Kimi and Alibaba's Qwen — are already drawing the attention of national security officials, and that DHS had discussed models of this kind in the underlying process. An order naming one vendor today is a template for the next one tomorrow. Agencies that built tooling around the cheapest available models will have to justify that choice in a way they never had to before.

For more on how these bans are reshaping the model market, see our AI coverage.

References

• Reuters: https://www.reuters.com/technology/us-banning-chinese-ai-deepseek-government-agency-it-systems-2026-10-19/
• BBC: https://www.bbc.com/news/articles/cjkgeq0k1wevo
• CyberScoop: https://cyberscoop.com/dhs-bans-deepseek-federal-agencies/
• Engadget: https://www.engadget.com/2290535/homeland-security-bans-deepseek-use-in-federal-civilian-agencies/
• The Next Web: https://thenextweb.com/news/us-bars-deepseek-federal-agencies
• Politico: https://www.politico.com/news/2026/10/19/deepseek-government-agencies-it-systems-01126126
• The Hill: https://thehill.com/policy/technology/6159116-dhs-bans-chinese-deepseek-ai/amp/
• U.S. Department of Homeland Security, Federal Register Notice 2026‑21447: https://www.federalregister.gov/d/2026-21447
• DeepSeek, "DeepSeek‑V4.1‑Flash‑1017: Wish‑Driven Programming Made Real": https://api-docs.deepseek.com/news/news261017/