U.S. Government Bans DeepSeek AI in Federal Agencies

Published: October 20, 2026

The U.S. Department of Homeland Security (DHS) has ordered federal civilian agencies to exclude covered DeepSeek AI products and services from procurement and remove affected technology from their IT systems. The order also covers certain third-party products and services developed using DeepSeek implementations, extending the restriction beyond applications carrying the DeepSeek name.

The notice was scheduled for publication in the Federal Register on October 20, 2026, under docket DHS-2026-0628. The action introduces a significant supply chain compliance requirement for affected government agencies and their technology suppliers.

Importantly, this is a federal government procurement and IT-system restriction, not a nationwide prohibition on DeepSeek AI. The notice does not, by itself, ban private individuals or ordinary businesses from using the service.

What Does the U.S. DeepSeek AI Ban Cover?

The DHS order establishes two central requirements for federal civilian agencies:

• Procurement exclusion: Agencies must exclude covered DeepSeek products and services, including those developed by affiliated entities, from procurement.
• Technology removal: Agencies must remove covered DeepSeek and affiliate products, along with qualifying third-party products and services developed using DeepSeek implementations, from their IT systems.

The second requirement is particularly significant because it extends beyond preventing new purchases. Existing technology deployments may also require investigation and removal where they fall within the order’s scope.

The distinction matters for organizations that use AI through external software vendors, hosted platforms, or internally developed applications. A product may not display the DeepSeek name even though its underlying technology incorporates a DeepSeek implementation.

Agencies therefore need to examine how their AI tools actually work rather than relying solely on application names or vendor branding.

Why Third-Party AI Products Matter

Modern enterprise software frequently incorporates AI models through application programming interfaces (APIs), hosted services, and integrated development tools. As a result, an organization may depend on an underlying model without interacting directly with its provider.

This creates a supply chain visibility challenge.

For example, a government agency might purchase an analytics platform from one supplier while that platform relies on an external AI model. Reviewing only the contract with the primary software vendor may not reveal the complete technology stack.

Under the DHS notice, the relevant question is whether a particular third-party product or service falls within the order’s coverage. Agencies and suppliers should review technical documentation, supplier disclosures, architecture diagrams, and relevant contractual information to determine whether affected implementations are present.

The notice does not provide a comprehensive public list of every potentially affected third-party product. Organizations should avoid assuming that every AI-enabled product is covered, just as they should not assume that changing a product’s name removes it from the restriction.

Legal Basis for the DHS DeepSeek Order

The Department of Homeland Security cites the Federal Acquisition Supply Chain Security Act of 2018 as the legal basis for the action, alongside its implementing regulations.

According to the notice, the secretary acted after reviewing a recommendation from the Federal Acquisition Security Council and supporting evidence.

The notice also refers to the applicable federal acquisition regulations for defining affiliated entities. These provisions establish the framework used to identify the covered companies and technologies.

For agencies and contractors, this makes the order a procurement and technology governance issue as well as a cybersecurity concern. Compliance depends on understanding the order’s scope and identifying the relevant products, suppliers, and underlying implementations.

Organizations should consult the signed order and applicable official guidance before making decisions about individual products.

Does the DeepSeek Ban Apply to Everyone in the United States?

No. The scope of this DHS action is narrower than a nationwide ban.

The order addresses covered products and services in federal civilian agency procurement and IT systems. It does not establish a general prohibition on private citizens or commercial businesses using DeepSeek.

However, private companies that supply software, AI services, or IT systems to federal agencies may need to assess whether their products are affected by the procurement and removal requirements.

The practical consequences will depend on the supplier’s role, the technology involved, and the terms applicable to the government customer.

It is also important to distinguish a supply chain restriction from evidence of a cybersecurity incident. The notice does not, by itself, establish that a particular DeepSeek deployment suffered a breach or that government information was stolen.

Cybersecurity Concerns Surrounding AI Models

AI models can support legitimate software development, research, and business operations. They can also be misused by threat actors to assist with malicious activities.

Cyber Security News previously reported on hackers exploiting DeepSeek and Qwen AI models to develop malware, highlighting concerns about the misuse of AI capabilities.

The publication also covered an attack campaign involving AI agents and vulnerable PaperCut servers, illustrating the security challenges associated with AI-assisted exploitation.

These reports provide broader context about AI-related cybersecurity risks. They should not be interpreted as proof that either incident directly caused the DHS restriction or that the government notice establishes a specific breach involving DeepSeek.

For enterprise security teams, the broader lesson is that AI adoption requires visibility into model providers, data flows, access permissions, and third-party dependencies.

What Federal Agencies and IT Suppliers Should Do

Organizations affected by the order should take a structured approach to reviewing their AI supply chains.

1. Inventory AI applications and services

Identify AI chat tools, development assistants, analytics platforms, internal applications, and hosted services used across agency systems. Include products supplied by contractors and external service providers.

2. Investigate underlying model dependencies

Review vendor documentation, system architecture, API configurations, and model deployment settings. Ask suppliers to identify the models and third-party services supporting relevant product features.

3. Assess procurement and contractual exposure

Compare identified products against the signed DHS order and applicable procurement requirements. Contact vendors where documentation is incomplete or the technology’s status is uncertain.

4. Plan necessary removals and replacements

Where technology is covered, plan its removal or replacement in accordance with applicable implementation instructions. Consider system dependencies, data handling, user access, and operational continuity before changing production services.

5. Document compliance activities

Maintain records of supplier assessments, technical findings, remediation decisions, and replacement activities. Clear documentation helps demonstrate that the review was based on evidence rather than assumptions.

These are practical compliance recommendations, not a claim that the notice independently prescribes every step.

What Happens Next?

The order highlights the importance of transparency in the AI software supply chain. Government buyers increasingly need to understand not only which company supplies an application, but also which underlying models and services it relies on.

For technology vendors, maintaining accurate documentation of AI dependencies may become increasingly important when serving public-sector customers. For security teams, AI inventories and supplier assessments can help identify dependencies that are otherwise difficult to see.

The immediate priority for affected federal civilian agencies is to understand the exact scope of the order, identify covered technology, and follow the applicable removal and procurement requirements.

Where to Read the Official DHS Notice

Readers can consult the official Federal Register notice and signed-order information for docket DHS-2026-0628 for the government’s stated requirements and legal basis.

The notice lists CISA’s FASCSA Order Implementation Team as the contact for further information.

Key takeaway: The U.S. government’s DeepSeek AI restriction is a federal procurement and IT-system supply chain measure, not a blanket ban on private use. Its wider significance is the need for agencies and their technology suppliers to identify AI dependencies, verify compliance obligations, and maintain visibility into the software they deploy.