DHS Mandates Removal of DeepSeek AI and Affiliates From Civilian Federal IT

The U.S. Department of Homeland Security has directed all federal civilian agencies to eliminate DeepSeek artificial intelligence products from their information technology systems. This order, issued by Homeland Security Secretary Markwayne Mullin on July 24, 2026, also prohibits future acquisitions of services or products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated entities. The directive aims to mitigate national security risks associated with the Chinese developer’s technology stack across government infrastructure.

What exactly is covered by this removal order?

The mandate extends beyond standalone applications developed directly by DeepSeek. It explicitly includes third-party products and services that were developed using DeepSeek implementations, according to The Hacker News. This means agencies cannot rely solely on the supplier’s name or application branding to determine compliance. If a vendor uses DeepSeek’s underlying AI models or code within their product, that product falls under the removal requirement, regardless of its external branding or interface.

Why are these specific tools being banned?

DHS stated that DeepSeek models present multiple threat vectors, according to GBHackers. The department warned that using these tools allows the company to track and digitally fingerprint users by collecting personally identifiable information and proprietary business data. Furthermore, Chinese laws permit the government to easily access data stored by private companies, which DHS says could produce actionable intelligence on U.S. persons and government programs. This risk assessment drove the decision to exclude the technology from civilian agency environments.

How does this compare to previous restrictions?

This order follows a pattern of expanding restrictions on Chinese technology within U.S. government systems. The Defense Information Systems Agency banned DeepSeek in January 2025, and the Commerce Department advised staff against its use in March of that year, according to TechRadar. Congress also restricted DeepSeek in intelligence community systems late last year. The current DHS order, published in the Federal Register on October 20, 2026, applies specifically to civilian agencies such as Treasury, State, and Justice, excluding the Department of Defense from this particular directive.

What is the path to compliance?

Agencies must assess the underlying AI technology in their software inventory rather than just reviewing standalone chatbot installations. The order was issued under the Federal Acquisition Supply Chain Security Act of 2018, which requires executive agencies to comply with exclusion and removal orders. While agencies can request exceptions in writing with compelling justification, the default requirement is immediate removal. DHS directs questions about implementation to CISA’s FASCSA Order Implementation Team, ensuring a centralized point of contact for compliance inquiries.

Detection notes

Security teams should audit web proxy logs for requests to known DeepSeek domains or API endpoints. Inspect network traffic for outbound connections to Chinese IP ranges associated with the vendor. Check endpoint logs for the installation of unrecognized AI clients or browser extensions that facilitate model access. Review data loss prevention alerts for large transfers of sensitive documents to external AI services. Isolate affected endpoints to prevent further data exfiltration while verifying software origins. Validate vendor supply chain disclosures to identify hidden dependencies on banned models.

What to do and how to stay safe: DeepSeek

• Inventory all AI tools and third-party applications to identify any use of DeepSeek models or implementations.
• Consult vendor documentation to confirm whether software relies on banned underlying AI technology.
• Monitor network traffic for unauthorized connections to Chinese cloud infrastructure or AI services.
• Once the vendor provides an update, verify that new software versions do not reintroduce banned components.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this ban apply to private companies or the general public?

No, the order covers only what civilian agencies buy and run, not private companies or the public.

Can agencies keep using DeepSeek if it is embedded in a third-party product?

No, the order requires removing third-party products developed using DeepSeek implementations.

Which agency issued this specific removal order?

The Department of Homeland Security issued the order under the Federal Acquisition Supply Chain Security Act.