US Bans DeepSeek From Federal Agency Systems: What the DHS Order Actually Covers

Washington just drew one of the sharpest lines yet between the US government and Chinese artificial intelligence. The Department of Homeland Security has ordered federal civilian agencies to stop using products from Chinese AI lab DeepSeek and to remove any existing implementations. According to reporting published on October 20, 2026, the order also reaches into third-party software, and that is where things get complicated.

What the order actually says

The DHS order, posted for public inspection in the Federal Register, covers “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations.” The first half is simple enough: agencies must pull DeepSeek’s own apps and its API out of their IT systems, and they cannot buy DeepSeek products going forward.

The second half is where the order gets ambitious, and vague. It extends the ban to third-party products and services built with DeepSeek technology, but the order does not define what “developed using” means. According to gHacks’ coverage, that phrase could refer to products that call DeepSeek models through an API, or to any software whose developers happened to use DeepSeek while writing or testing code. Those are two very different scopes, and the order reportedly leaves the distinction unresolved.

The order applies to federal civilian agencies, reportedly including departments such as Treasury, State, and Justice. It does not include the Department of Defense, which had already blocked DeepSeek on its own networks.

Why DHS pulled the trigger now

This ban did not come out of nowhere. US officials have been circling DeepSeek since its DeepSeek-R1 model arrived in early 2025. In February 2025, Representatives Darin LaHood and Josh Gottheimer introduced the No DeepSeek on Government Devices Act, which never made it out of committee.

The military world moved first. The Defense Information Systems Agency started blocking DeepSeek on Pentagon networks in January 2025, and the US Navy, NASA, and the House of Representatives took similar steps, as did some state governments. Then in December 2025, a security report on DeepSeek’s Android and iOS apps cited plaintext information leaks, links to servers run by Chinese tech firms, and a lack of SSL pinning.

DHS reportedly cited concerns over potential transfers of sensitive US government data to China, alongside security vulnerabilities in DeepSeek’s models. NIST evaluations found DeepSeek more vulnerable to prompt injection than US models and easier to jailbreak, according to gHacks. A DHS spokesperson did not respond to requests for comment at the time of publication.

The part experts say is nearly unenforceable

Banning DeepSeek’s own app and API is doable, but policing the third-party clause is a different beast entirely. Katie Moussouris, founder and CEO of Luta Security, said that banning DeepSeek’s own app and API is workable, but the third-party clause is not. Her reasoning is practical: an AI software bill of materials does not record which tools developers used while building a product, so every vendor would have to attest that nothing it relies on ever touched DeepSeek, with no practical way to verify the claim.

AI gateways add another wrinkle. Services like OpenRouter and Vercel AI Gateway make DeepSeek’s models available through their APIs, and both route requests to whichever provider the service considers the best fit by default. That means an agency could end up using DeepSeek models without ever choosing them.

DHS has not clarified how agencies should interpret the third-party clause, nor whether US-hosted versions of DeepSeek models fall under the same requirement.

This is about much more than one company

DeepSeek launched a preview of its V4 model in April 2026, expanding its open-source AI lineup, and the lab remains one of the few Chinese companies genuinely competing at the frontier of AI research. Washington’s move fits a broader pattern: first the semiconductor export controls, then the chip-level restrictions, and now the software and services layer. Model weights are being treated more like critical infrastructure than like ordinary software.

For the rest of the AI industry, the order is a preview of what compliance may soon look like. If a model can be banned from government systems because of where its servers sit and how it handles data, every major lab will face questions about its data pipeline, its training infrastructure, and its corporate structure. The era when an AI API was just an API is over.

What happens next

The immediate next step is removal: federal civilian agencies have been told to strip DeepSeek technology out of their systems. For organizations that work with federal agencies, or that simply want to steer clear of the banned technology, security coverage of the order suggests three practical steps: check the provider settings in AI gateways such as OpenRouter or the Vercel AI Gateway and restrict routing to approved providers, list internal tools and third-party services that call DeepSeek models directly or through a gateway, and ask vendors whether their products use DeepSeek implementations, keeping in mind that the order does not define the term.

Expect pushback on the third-party clause, either through formal clarification from DHS or through procurement officers deciding what is actually enforceable. And expect DeepSeek to keep shipping models in the meantime. A ban on government use does not stop the lab, or the developers worldwide who use its open-source models.

Frequently Asked Questions

What exactly does the DHS order ban?

According to reporting, the order requires federal civilian agencies to stop using and remove all DeepSeek and DeepSeek-affiliate products, plus third-party products and services “developed using DeepSeek implementations.” The exact meaning of that third-party phrase has not been defined, and DHS has not clarified how agencies should interpret it.

Does the ban apply to private companies or ordinary users?

No. The order applies to federal civilian agency IT systems, and it reportedly excludes the Department of Defense. Private companies and individual users are not covered, though organizations that contract with federal agencies may face follow-on questions about their own technology stacks.

Why did the US government single out DeepSeek?

DHS reportedly cited concerns about potential transfers of sensitive government data to China and security vulnerabilities in DeepSeek’s models. Earlier findings added to the case: a December 2025 report flagged plaintext leaks and missing SSL pinning in its mobile apps, and NIST evaluations reportedly found the model more vulnerable to prompt injection and easier to jailbreak than US models.