- Federal Removal: The US Department of Homeland Security has ordered to remove DeepSeek AI from federal agency systems, including third-party products using its technology.
- Agency Work: Removing covered technology can require agency inventories, contractor coordination and replacements for critical services.
- Data Risks: The department cites possible sensitive-data transfers; DeepSeek’s privacy policy places personal-data storage for its own services in China.
The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek based products from their IT systems, including third-party products and services developed using DeepSeek models. The order also bars civilian agencies from buying IT products and services developed by DeepSeek or its affiliates.
Why Other Suppliers’ Software Is Covered
DeepSeek is a Chinese AI developer whose models generate text and code. Alongside its chatbot, it distributes model weights for download and API access. Developers can run downloaded model files in their own applications or connect their software to an online service through the chinese comapany’s API.
Microsoft already made DeepSeek’s R1 model available through GitHub Models and Azure AI Foundry in January 2025, giving developers a way to test it and integrate it through an API.
The DHS removal requirement expressly includes third-party products and services developed using DeepSeek implementations. An agency’s obligation can therefore reach a supplier’s product that is using DeepSeek in the background, even when the product is not predominantly based on the chinese AI models.
The Cybersecurity and Infrastructure Security Agency, or CISA, recommends checking system inventories and identifying supporting service contractors and subcontractors when preparing to carry out supply-chain removal orders. Its preparation guidance also calls for alternatives to critical components and services so agencies can maintain operations during removal.
The Authority Behind the Removal
DHS acted under the Federal Acquisition Supply Chain Security Act of 2018, following a recommendation from the Federal Acquisition Security Council, an interagency body that reviews technology supply-chain risks. The law provides for excluding technology from procurement and removing it from government systems. CISA’s guidance identifies the Homeland Security secretary as the issuer for federal civilian agencies and states that compliance with these orders is mandatory.
The civilian-wide requirement has a different reach from earlier restrictions like the Navy’s January 2025 ban on DeepSeek use by its personnel. The DHS order addresses both civilian-agency purchases and technology already in their IT systems.
Agencies can seek exceptions for compelling mission-critical or national-security needs. CISA’s general exception procedure calls for a written justification to the issuing official and an explanation of alternative security measures.
Hosted Services and Downloaded Models Have Different Data Arrangements
Homeland Security Secretary Markwayne Mullin cited the risk of sensitive information being transferred through DeepSeek technology.
DeepSeek’s privacy policy, updated March 27, 2026, describes collecting users’ prompts, uploads and chat history, alongside device and network information, through its covered services. It places the collection, processing and storage of personal data in China. The policy leaves the personal-data processing rules for developers’ downstream applications outside its scope.
It remains unclear how many civilian-agency systems currently use DeepSeek technology or how much has already been removed.
