The DeepSeek ban for federal agencies goes well beyond a purchasing freeze. Civilian agencies must stop buying the Chinese AI developer’s products and remove them from systems they already run. The Department of Homeland Security filed notice of the order on Monday, October 19, and it was slated for the Federal Register the next day. The directive rests on a 2018 supply chain law, and its reach extends past DeepSeek’s own chatbot, which is why it deserves more attention than a typical app ban.
The immediate effects land on three groups. Federal employees who use AI tools at work must check what they are running. Government contractors and IT teams have to inventory their vendors. AI developers and platforms that route requests to DeepSeek models face compliance questions that did not exist before this order. Private users are not affected by the order itself.
What the DeepSeek ban for federal agencies requires
The order covers products from Hangzhou DeepSeek Artificial Intelligence Co., its affiliates, and third-party products built using DeepSeek implementations, according to Cybersecuritynews. Agencies must stop procuring DeepSeek IT products and services. They must also remove DeepSeek and affiliate products from systems they already operate, which turns a purchasing freeze into a removal order.
Homeland Security Secretary Markwayne Mullin acted under the Federal Acquisition Supply Chain Security Act of 2018, which lets the DHS secretary bar risky technology from civilian agency systems, as BankInfoSecurity reported. The order covers civilian agencies only. Defense and intelligence agencies have separate authorities under the same law, so this action does not settle how those parts of the government handle DeepSeek.
The dates are messy, and they matter for anyone who needs to cite the order. CyberScoop reports that a separate letter ordering the exclusion is dated June 26, while the South China Morning Post reports that Mullin signed the underlying order on July 24. The public timeline looks like this:
| Date (2026) | Event |
|---|---|
| June 26 | Letter ordering the exclusion, per CyberScoop |
| July 24 | Order signed by Mullin, per the South China Morning Post |
| October 19 | Notice filed for public inspection |
| October 20 | Scheduled Federal Register publication, per PYMNTS |
Check these dates against the Federal Register PDF before citing them in procurement documents.
Why DHS calls DeepSeek a security risk
DHS said that agency use of DeepSeek’s models could produce actionable intelligence on U.S. persons and government agencies. That argument drives the order. It treats the models as a possible channel for foreign collection, not as an ordinary vendor choice.
The department also said the models “may contain malware or other security vulnerabilities” and that using them could result in the transfer of sensitive data to China, as the South China Morning Post reported. In the notice, DHS warned of “multiple threat vectors,” a phrase that BankInfoSecurity quoted directly.
The language is broad. The reporting gathered for this story does not spell out the specific vulnerabilities behind those warnings, so readers should treat them as the government’s assessment rather than as independently verified findings. The federal government has also accused DeepSeek’s makers of “systematically” distilling their models, according to CyberScoop.
Earlier action set the stage. The Navy, NASA and other agencies began blocking DeepSeek’s chatbot on their own more than a year and a half before this order. The new directive converts a patchwork of agency-level blocks into one government-wide rule for civilian systems.
How the third-party clause could reach routing services
This is the provision most likely to matter beyond government. The order does not stop at branded apps. It also reaches third-party products built using DeepSeek implementations, so a tool that runs a DeepSeek model underneath can fall under the same rule as DeepSeek itself.
The Register reported that the order is broad and that routing services such as OpenRouter and Vercel AI Gateway could fall into scope if they route requests to DeepSeek models. Routing services let developers send requests to many model providers through one interface. A single DeepSeek route could therefore pull an entire platform into a federal compliance question.
Who bears the cost? Vendors that built federal-facing products on DeepSeek models now have to answer questions about their model supply chain, and some may need to switch providers. Agencies also take on work, since they must identify affected tools inside systems they already run. Companies that rely on other model providers look less exposed, though the reporting does not say how the market will shift.
Key gaps remain. The notice does not publish a full list of affected vendors or products. It is not yet clear how agencies will identify DeepSeek-based products, or what remedies vendors will receive. Those answers will decide how much work contractors and platforms face.
Can you still use DeepSeek in the US?
For most people, yes. The order restricts federal civilian procurement and systems. It does not restrict private individuals or businesses from using DeepSeek, according to Cybersecuritynews. It is a supply chain action, not a consumer ban.
The security concerns still apply. DHS’s warning about sensitive data moving to China was aimed at government systems, but the same logic extends to anyone who pastes confidential work, client records or personal information into a DeepSeek service. Treat that as a risk decision rather than a legal one, and read the provider’s data terms before sending anything sensitive.
Steps for federal contractors and IT teams
Contractors and agency IT staff can start now, even without a full vendor list. These steps follow directly from the order’s scope:
- Inventory every AI tool in use, including tools bought through a third-party vendor, and record which model provider sits behind each one.
- Check whether any product, API gateway or routing service sends requests to DeepSeek models, including as a fallback.
- Ask vendors in writing whether their products use DeepSeek implementations, and keep the answers in the contract file.
- Plan removal for any DeepSeek or affiliate product already in production, since the order covers existing systems.
- Watch the Federal Register text and any agency guidance on identification and remedies.
These steps are general guidance, not legal advice. Contracting officers will set the specifics for each agreement, so ask them before assuming how the order applies to a particular contract.
Where this fits and what to watch next
The order joins a growing set of China-focused AI restrictions. Treasury has proposed curbs on US investment in China’s AI sector, as USA 24 has covered, and this action carries similar logic into federal buying. Pressure on AI companies also comes from states. Texas sued OpenAI and Sam Altman over ChatGPT, which shows that scrutiny is not limited to Washington. Federal security agencies have pushed fast patching of flaws that AI tools helped find, as the NSA and FBI did for two PHP flaws in a separate USA 24 report.
China has responded in measured terms so far. Its foreign ministry said it would safeguard the rights and interests of its companies, and spokesperson Mao Ning said, “China consistently opposes the over-generalization of national security,” according to CNBC. The sources reviewed do not say whether Beijing will retaliate or how DeepSeek itself has responded.
Congress is the other open question. It is not known whether lawmakers will codify the ban in statute or extend it to private use.
The next concrete signals will come from the Federal Register text, which should resolve the signing-date conflict, and from any agency notice that names covered vendors. If the routing-service question gets a clear answer, it will show how far the federal supply chain reaches into the AI tools developers use every day.
