DHS orders DeepSeek stripped from US civilian federal IT systems

The Department of Homeland Security has told every US civilian federal agency to strip DeepSeek products out of its IT systems, including third-party tools built on DeepSeek models, and has barred any future procurement. The directive, reported by The Wall Street Journal, is set to publish in the Federal Register the next day.

DHS said DeepSeek carries "multiple threat vectors" to civilian federal IT, and warned that use "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors." The department also wrote that deployments "could produce actionable intelligence on US persons and/or government agencies," and that the models themselves may contain malware or other security vulnerabilities.

The legal hook is the Federal Acquisition Supply Chain Act, acted on through a review by the Federal Acquisition Security Council. That mechanism bars the civilian government from buying information technology products and services from parent Hangzhou DeepSeek Artificial Intelligence, and extends the removal requirement to any third-party service "developed using DeepSeek's model or its underlying implementations," CyberScoop reported. A signed copy of the order sits at regulations.gov under docket DHS-2026-0628.

DeepSeek, based in Hangzhou and funded by Chinese hedge fund High-Flyer, has been behind 53 stories in our tracker over the last 90 days. What qualifies as a product "developed using DeepSeek's model" is the question every federal vendor now has to answer about its own AI stack.