DeepSeek AI Banned from US Civilian Agencies Over Data Privacy and Supply Chain Risks

The short version

• The Department of Homeland Security has issued a directive banning DeepSeek AI technology across federal civilian agencies.
• Agencies must stop purchasing these products and remove existing instances, including those hidden in third-party software.
• The order applies to executive branch agencies like State and Treasury but excludes the Department of Defense and private users.

The details

The Department of Homeland Security published a notice on October 19, 2026, ordering federal civilian agencies to eliminate DeepSeek technology from their IT environments, according to Cyber Security News. The directive requires agencies to remove products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. It also mandates the removal of third-party services that rely on DeepSeek models, creating a broad supply chain restriction. Agencies have 60 days to complete the purge, though they may request exemptions from CISA with compelling justification, per CSO Online.

Homeland Security Secretary Markwayne Mullin stated that DeepSeek’s account generation process collects personally identifiable information and may digitally fingerprint users, according to Gizmodo. The administration fears this sensitive data could be transferred to the Chinese government. Mullin also warned that the AI models themselves could contain malware. The DHS cited data sovereignty issues and lax Chinese laws as additional concerns in the Federal Register document, as reported by CSO Online.

View the original post on X

The order does not prohibit private consumers or businesses from using DeepSeek. It specifically targets federal civilian agencies, including the Departments of State, Treasury, and Justice. The Department of Defense and national security systems are excluded from this specific directive. The legal basis for the action is the Federal Acquisition Supply Chain Security Act of 2018, along with implementing rules. The secretary acted after reviewing a recommendation from the Federal Acquisition Security Council.

The context

DeepSeek gained attention early last year with its R1 model, which offered high capabilities at a lower cost than American counterparts, according to Gizmodo. The U.S. government previously deemed DeepSeek a profound threat to national security, leading the Navy and Department of Commerce to restrict its use. Analyst Erik Avakian noted that hosted AI services can expose intellectual property and confidential business information to environments with limited visibility, per CSO Online.

Chinese AI development is narrowing the gap with American labs, with DeepSeek’s R1 and Moonshot’s Kimi K3 cited as examples of this progress. DeepSeek has also faced accusations of illicit distillation, where it allegedly used outputs from advanced American models to train its own, according to Gizmodo. This competition has heightened debates over the national security implications of the AI race and potential advantages for Beijing.

What to watch

• Agencies must identify all third-party tools that may embed DeepSeek implementations, as branded chat tools are not the only risk.
• Vendors serving federal clients need to assess whether their AI features depend on excluded technology to maintain procurement eligibility.
• Security teams should monitor for updates on the exemption process and any further guidance from CISA regarding compliance.
• The lack of a public list of affected third-party vendors means organizations must rely on contract records and technical documentation for reviews.

What it means for organisations

Organisations should treat AI integrations as critical supply chain components rather than simple software utilities. Teams usually need to map all external data flows to understand where sensitive information exits the environment. Procurement departments must verify vendor dependencies to ensure compliance with emerging restrictions. Leadership should be informed of potential operational disruptions during the removal process. Communication plans are essential to manage user expectations and prevent shadow IT adoption of restricted tools.

Background: Supply chain attacks

A supply chain attack targets the software or hardware you use before it reaches you. By compromising a trusted vendor, attackers insert malicious code that installs automatically on your systems when you update or deploy the product. This bypasses perimeter defenses because the malicious payload arrives with a valid digital signature.

Read the full guide: Supply Chain Attacks: How Trust Becomes Your Biggest Security Risk

What to do and how to stay safe: DeepSeek

• Audit all AI services and third-party applications to identify any underlying dependencies on banned models or vendors.
• Review data handling policies to ensure personally identifiable information is not being sent to unapproved external hosts.
• Consult legal and procurement teams to understand how new supply chain restrictions affect current contracts and future purchases.
• Monitor official government channels for updates on compliance deadlines and exemption procedures relevant to your sector.

Step-by-step guide: Secure Home Routers for Small Business Networks

General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this ban apply to private companies and individuals?

No, the order specifically targets federal civilian agencies and does not prohibit private consumers or businesses from using DeepSeek.

How long do agencies have to remove the technology?

Federal civilian agencies must purge DeepSeek technology from their IT systems within 60 days of the order.

Can agencies request an exemption to the ban?

Yes, agencies with compelling justification can make a written request for exemption to the Cybersecurity and Infrastructure Security Agency.