PolicyLaw, regulation & governance
DHS orders federal civilian agencies to remove DeepSeek AI, including third-party products built with it
A Homeland Security order under a 2018 supply-chain security law bars new federal civilian purchases of DeepSeek products and requires agencies to remove existing ones. It also covers third-party tools built with DeepSeek technology. Private companies and national security systems are exempt.
From the TechCrunch AI article of October 20, 2026 and cited sources: The order covers more than DeepSeek's own apps and models, such as R1 and V3. [2] [3] [4]
SOURCES[2] Security Magazine: DHS bars DeepSeek products securitymagazine.com[3] Yahoo: DHS Ordered Every Federal Agency to Purge DeepSeek yahoo.com[4] The Hacker News: US Orders DeepSeek Removed thehackernews.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- The order covers more than DeepSeek's own apps and models, such as R1 and V3. [2] [3] [4]
- Original source
- TechCrunch AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 20, 2026 article published
- Covered
- Oct 21 edition
- Evidence
- 12 sources across 12 sites
- 1US orders federal agencies to remove China’s DeepSeek AI…techcrunch.com
- 2Security Magazine: DHS bars DeepSeek productssecuritymagazine.com
- 3Yahoo: DHS Ordered Every Federal Agency to Purge DeepSeekyahoo.com
- 4The Hacker News: US Orders DeepSeek Removedthehackernews.com
- 5NIST CAISI bulletincontent.govdelivery.com
- 6Petronella Tech: DeepSeek and the FY2026 NDAApetronellatech.com
Reach: not measured yet
The order covers more than DeepSeek's own apps and models, such as R1 and V3. It also covers any other company's product or service developed using DeepSeek implementations. It applies only to federal civilian agencies. National security systems and private companies are outside its scope. [2] [3] [4]
New purchases are banned immediately, including through approved-product lists and e-commerce marketplaces. Agencies must remove existing deployments. They have 60 days to ask CISA in writing for an exception, which requires a compelling justification. Under FAR clause 52.204-30, contractors must report covered products within three business days. [3] [4]
DHS bases the order on risks in DeepSeek's data handling and hosted service. It cites personal data collected at account creation, user tracking and fingerprinting, prompts sent to servers in China, and flaws in the iOS app. It names no specific weaknesses in the models themselves. An earlier NIST CAISI study, a US government evaluation, found DeepSeek's most secure model answered 94% of jailbreak prompts, against 8% for US models. [3] [4] [5] [9]
DHS signed the order on July 24, 2026, and published it in the Federal Register on October 20. That followed defense-bill limits on Pentagon contractors using DeepSeek. It also followed a September advisory from the NSA, CISA and FBI accusing DeepSeek and five other Chinese labs of distilling US models. China's Foreign Ministry said the US was overstretching the concept of national security. [1] [4] [6] [7] [8]
the order covers federal civilian purchasing only and cites data-handling risks.
Read the full assessment
Implication: federal vendors will likely need records tracing base model weights through their products, and a model's origin now affects whether it can be sold to agencies.
Executive brief
The order removing DeepSeek from US federal civilian agencies also reaches products made by other companies. Agencies must take out DeepSeek's own tools and any third-party product or service "developed using DeepSeek implementations" (Yahoo). Homeland Security Secretary Markwayne Mullin signed the order on July 24, 2026. It was published in the Federal Register on October 20, 87 days later (The Hacker News). The legal basis is the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). The order applies only to federal civilian agencies, not to private companies (The Hacker News). China's Foreign Ministry said the US was "overstretching the concept of national security" (TechCrunch).
What changed and event timeline
NIST's AI evaluation center flags DeepSeek
CAISI, the Center for AI Standards and Innovation at NIST, reported that DeepSeek models trail US models on performance, cost, security and adoption. It also found security and censorship problems that could put developers at risk ().
The defense bill restricts DeepSeek
Section 1532 of the FY2026 National Defense Authorization Act bars Defense Department contractors from using DeepSeek AI. It also bans the app on intelligence-community national security systems ().
DHS signs the exclusion order
Secretary Mullin signed Exclusion and Removal Order #2026-01 after a recommendation from the Federal Acquisition Security Council ().
Security agencies accuse six Chinese labs of distillation
An advisory from the NSA, CISA and FBI named DeepSeek, Moonshot, Alibaba, MiniMax, StepFun and Z.AI. It accuses them of copying US models at industrial scale by training on their outputs (;).
The order is announced and published
It was announced on October 19 and published at 91 FR 66346 on October 20. National security systems are exempt ().
Beijing objects
Foreign Ministry spokesperson Mao Ning said China opposes politicizing technology and trade issues and will protect Chinese companies' rights ().
Capabilities and access
- No new model is involved. The Hacker News reports that this includes the R1 and V3 models (The Hacker News).
- What it bans: new purchases, effective immediately, including through approved-product lists and e-commerce marketplaces. What it requires: removal of existing deployments (Yahoo).
- Exceptions: agencies have 60 days to ask CISA's FASCSA Order Implementation Team for one in writing, with "compelling justification" (Yahoo).
Read the full section
- No new model is involved. The order covers products from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates. The Hacker News reports that this includes the R1 and V3 models (The Hacker News).
- What it bans: new purchases, effective immediately, including through approved-product lists and e-commerce marketplaces. What it requires: removal of existing deployments (Yahoo).
- Exceptions: agencies have 60 days to ask CISA's FASCSA Order Implementation Team for one in writing, with "compelling justification" (Yahoo).
- Contractors: under FAR clause 52.204-30, they must check SAM.gov for FASCSA orders and report covered products within three business days (The Hacker News).
Technical analysis for researchers and developers
- "DeepSeek implementations" is not defined (The Hacker News). The reviewed coverage does not say how self-hosted open weights, fine-tunes or distilled models are treated (Yahoo).
- The stated threats are about data and the hosted service, not model internals.
- personal data collected at account creation;
Read the full section
- "DeepSeek implementations" is not defined (The Hacker News). The reviewed coverage does not say how self-hosted open weights, fine-tunes or distilled models are treated (Yahoo).
- The stated threats are about data and the hosted service, not model internals. DHS cites:
- personal data collected at account creation;
- user tracking and fingerprinting;
- prompt data sent to servers in China;
- flaws in the iOS app (Yahoo).
- The order names no specific weaknesses in the models themselves (The Hacker News).
- Inference: applying the rule to derivatives means vendors will need model-provenance records that trace base weights through their products.
- CAISI's evaluation used 19 benchmarks. The largest gaps were in software engineering and cybersecurity tasks (TechRepublic).
Claims and evidence
This is a US government evaluation, not an independent academic replication.
Read the full section
- Data could reach Chinese authorities: this is DHS's legal reasoning, which TechCrunch reports (TechCrunch). The order cites no technical evidence that such access occurred.
- Jailbreak and safety findings: coverage of the CAISI study reports two results:
- DeepSeek's most secure model was 12 times more likely than US frontier models to follow malicious agent instructions.
- It answered 94% of jailbreak prompts, against 8% for US models (TechRepublic).
This is a US government evaluation, not an independent academic replication.
- Distillation: these are government accusations. The advisory disputes DeepSeek's reported $5.6M training cost, and none of the six firms responded (TNW).
Context and prior work
- In February 2025, Congress, NASA, the Navy, the Pentagon and Texas banned DeepSeek on their devices (The Hacker News; Inside Government Contracts).
- DeepSeek's R1 release in January 2025 set off a sharp sell-off in Nvidia shares (TechCrunch).
- OpenAI and Anthropic have each separately accused DeepSeek of distillation attempts (TechCrunch).
Read the full section
- In February 2025, Congress, NASA, the Navy, the Pentagon and Texas banned DeepSeek on their devices (The Hacker News; Inside Government Contracts).
- DeepSeek's R1 release in January 2025 set off a sharp sell-off in Nvidia shares (TechCrunch).
- OpenAI and Anthropic have each separately accused DeepSeek of distillation attempts (TechCrunch).
- Bloomberg reports that China is considering export limits on 23 AI-related technologies, as summarized by TechCrunch (TechCrunch).
Limitations, safety and contested findings
- Unclear wording: without a definition of "implementations," compliance gets harder across software supply chains, as Exabeam's Gabrielle Hempel notes (Security Magazine).
- Disputed account: China rejects the security rationale (TechCrunch). A Chinese embassy spokesman called the distillation claims an attack on China's AI development (TNW).
- Date discrepancy: sources give the advisory's date as September 8 or 9, 2026.
Read the full section
- Unclear wording: without a definition of "implementations," compliance gets harder across software supply chains, as Exabeam's Gabrielle Hempel notes (Security Magazine).
- Disputed account: China rejects the security rationale (TechCrunch). A Chinese embassy spokesman called the distillation claims an attack on China's AI development (TNW).
- Date discrepancy: sources give the advisory's date as September 8 or 9, 2026.
Business and practitioner implications
- Federal vendors: check products for DeepSeek base models, including bundled fine-tunes, and be ready to report them within the three-day window.
- Commercial users: they are not covered. Coverage suggests this benefits US model providers (Tech Insider).
- Agencies: the 60-day exception window is the main way to keep using DeepSeek-based tools.
Read the full section
- Federal vendors: check products for DeepSeek base models, including bundled fine-tunes, and be ready to report them within the three-day window.
- Commercial users: they are not covered. Still, being cleared for federal use now partly depends on where a model came from. Coverage suggests this benefits US model providers (Tech Insider).
- Agencies: the 60-day exception window is the main way to keep using DeepSeek-based tools.
The source trail.
Sources (12)
US orders federal agencies to remove China’s DeepSeek AI from their systems
Article text retrieved; extracted text may omit tables or interactive elements.
techcrunch.com