DHS orders federal agencies to rip out DeepSeek, including apps built on it

The skim

• The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek technology from their IT systems and to stop buying DeepSeek products and services.
• The ban also covers third-party products "developed using DeepSeek implementations," so AI features built on DeepSeek models inside other vendors' software are in scope too.
• The order was signed July 24 and published in the Federal Register on October 20. Agencies can ask for exceptions within 60 days of issuance; the Pentagon and intelligence agencies aren't covered.

What happened

DHS published a notice in the Federal Register on Tuesday announcing an order that does two things. First, it excludes IT products and services developed by Hangzhou-based DeepSeek and its affiliates from federal civilian agency procurement. Second, it requires agencies to remove "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations" from their systems.

The order was issued under the Federal Acquisition Supply Chain Security Act of 2018, following a recommendation from the Federal Acquisition Security Council. CNBC reports the order was originally issued on July 24 and applies to civilian agencies such as the Treasury, State and Justice departments, but not the Department of Defense. The notice also leaves out intelligence agencies' systems and national security systems.

Why DHS says it acted

The order says DeepSeek's models "present multiple threat vectors," according to CNBC, citing the risk that sensitive US government data could be transferred to China and potential cybersecurity vulnerabilities, including open-source research that found critical flaws in DeepSeek's iOS app. Until removal is complete, agencies are encouraged to add enhanced logging and controls on data exfiltration.

Agencies that need more time, or want an exemption, have to request one in writing within 60 days of the order's issuance. DHS says it will review the order within a year and annually after that.

Why it matters

The part that will keep government contractors busy is the third-party clause. DeepSeek's models are open-weight, which means anyone can download and run them, and plenty of software quietly uses them behind the scenes. The order covers products "developed using DeepSeek implementations" but doesn't spell out exactly what counts, such as whether a self-hosted copy of a DeepSeek model is treated differently from DeepSeek's own app or API.

If you sell software to federal civilian agencies, the practical step is an inventory: list every model and API your product calls, including fallbacks and model routers, and ask your suppliers in writing whether anything they provide runs on DeepSeek. For everyone else, it's another sign that where an AI model comes from now matters as much as how well it performs.

Sources: Federal Register, CNBC, Wall Street Journal.