US bans DeepSeek from federal civilian agencies

What the order requires

DHS posted the notice of order for public inspection on Monday (Federal Register). It does two things. Federal civilian agencies may no longer buy IT products or services from Hangzhou DeepSeek Artificial Intelligence Co. or its affiliates. They must also remove DeepSeek products already in use, including third-party products and services developed using DeepSeek implementations.

The legal basis is the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). The order follows a recommendation from the Federal Acquisition Security Council and a review of the supporting evidence. A CISA team coordinates implementation.

Since when, and why

According to CyberScoop, the order attached to the notice was signed by Homeland Security Secretary Markwayne Mullin on June 26. The ban has therefore been in place for months and has only now been made public (CyberScoop).

Mullin wrote that DeepSeek's models present "multiple threat vectors" to federal systems. Data is stored on servers in China, where national security laws give the government broad access to domestic companies' data. Models hosted by DeepSeek collect personal information from users. The prompt-and-response process may also send sensitive data to China, which combined with public data could produce actionable intelligence on US persons and government programs.

Exceptions and transition

Agencies can request exceptions, but at least 60 days in advance and with a "compelling justification", such as being unable to perform a mission-critical function otherwise. Until removal is complete, DHS encourages agencies to monitor traffic in and out, tighten logging and data exfiltration controls, and flag anomalous activity.

Until now, agencies decided on their own whether to block such models. DeepSeek is the only Chinese AI model named in the order. CyberScoop notes, however, that other Chinese open-weight models, such as Moonshot AI's Kimi and Alibaba's Qwen, have also worried national security officials or faced distillation accusations.

Why it matters

The order goes beyond DeepSeek's app and API. It names third-party products developed using DeepSeek implementations and says nothing about where the model is hosted. Vendors selling AI products to US federal customers should check which model runs under the hood, including self-hosted ones. The signed order is available on regulations.gov under docket DHS-2026-0628.