DHS orders DeepSeek removed from US federal civilian agency systems

The US Department of Homeland Security (DHS) has ordered civilian federal agencies to stop using products from the Chinese company DeepSeek and to remove existing deployments. According to The Register, DHS issued the order on Monday, October 19, 2026.

What the order requires

According to The Register, DHS told agencies to stop using DeepSeek products and remove existing deployments. Quoting the document, the ban covers "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations."

Computerworld.pl notes that the restrictions force government institutions and their technology partners to run a rigorous audit of the components they use.

DHS's rationale

Citing official memoranda, Computerworld.pl points to the potential for unauthorized transfer of sensitive government data outside the country, and to vulnerabilities such as flaws found in mobile implementations of the models. According to the outlet, the decision stems from concerns about the integrity of the software supply chain.

As early as 2025, US Representatives Darin LaHood and Josh Gottheimer claimed that DeepSeek's models purportedly collect data on US citizens and pass it to the Chinese government.

The Register recalls that concerns about the security of DeepSeek's iOS app surfaced shortly after the launch of DeepSeek-R1, and that a December 2025 report pointed to issues including plaintext data leaks and connections to servers run by Chinese tech firms. The outlet stresses, however, that these are mainly mobile security problems common to many apps, and that they do not address the risks of capturing the prompts and responses themselves.

An unclear scope

The biggest doubts concern the language on third-party products. Katie Moussouris of Luta Security says a ban on DeepSeek's own app and API is workable, but the clause on third parties is the problem.

The order doesn't say what 'developed using' means. - Katie Moussouris, Luta Security (quoted by The Register)

Moussouris says there is no practical way to verify vendors' attestations, and that AI software bills of materials do not record which development tools were used. In her view, applying the ban to US-hosted versions goes too far, since they avoid most of the cited risks.

Moussouris also notes that, according to NIST, DeepSeek is more vulnerable to prompt injection than US models and easier to jailbreak. She adds, however, that prompt injection affects every model, and that jailbreak guardrails often get in the way of defenders.

The Register also lists unanswered questions: whether the ban covers AI gateways such as OpenRouter or Vercel AI Gateway, which may route traffic to DeepSeek by default, and how agencies are supposed to identify affected products. DHS did not immediately respond to a request for comment.

Context and significance

DeepSeek was previously blocked by the Pentagon since January 2025, as well as by the US Navy, NASA and the House of Representatives. The No DeepSeek on Government Devices Act, introduced in February 2025, never made it out of committee. The current order covers all federal civilian agencies.

For Polish companies there are no direct legal consequences, because the ban applies to US agencies. Indirectly, though, it could affect software vendors that sell solutions to the US administration and use DeepSeek in their products.