The United States has ordered every federal civilian agency to rip DeepSeek’s AI technology out of its IT systems. And the order, it turns out, is almost three months old.
A Reuters report on October 19 revealed that the Department of Homeland Security had directed civilian executive-branch agencies to remove “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations” from their systems, and barred any future purchases. The directive covers Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates.
The ban applies to federal civilian agencies, think the EPA, the Treasury Department, and the IRS. National security systems and sensitive compartmented information systems sit under separate authorities, so they are not part of this order. Private businesses and ordinary consumers are not subject to it either.
The order was signed in July, but revealed only in October
The directive was signed on July 24, 2026, under the authority of the Federal Acquisition Supply Chain Security Act of 2018, following a review of a recommendation and supporting evidence from the Federal Acquisition Security Council. That is nearly three months of silence before anyone outside government knew it existed.
The notice was filed with the Federal Register on October 19 and published on October 20, docket DHS-2026-0628 on Regulations.gov, as reported by The Register. The order sets no removal deadline, so agencies have been expected to comply for months without a public clock ticking.
A reported 60-day window for agencies to request exceptions would have closed around September 22, weeks before the public ever saw the notice.
What DHS says is wrong with DeepSeek
The order does not mince words about the risk. It warns that use by government employees or vendors “may result in the transfer of sensitive data to the PRC,” and that the models could “produce actionable intelligence on US persons and/or government agencies.” Most strikingly, it adds that “the models themselves may contain malware or other security vulnerabilities.”
The Wall Street Journal first detailed the directive, and The Hindu BusinessLine noted the FCC is planning a separate move on Chinese technology, per Asia Daily reporting.
This is not the first time DeepSeek has faced US government scrutiny. Lawmakers introduced the No DeepSeek on Government Devices Act in February 2025, some agencies had already restricted the tools, and the Commerce Department confirmed restrictions within its own systems, according to The Neuron. What changed is that this order makes the ban government-wide and mandatory.
“Developed using DeepSeek” is vaguer than it sounds
Here is where compliance gets messy. The order bans not just DeepSeek products, but “third-party products and services developed using DeepSeek implementations,” and nobody has spelled out what that means in practice.
Does it mean an app that currently calls DeepSeek’s API for completions? Or any software that was built at any point with DeepSeek’s help, including code the model wrote for a developer? The distinction decides whether thousands of vendor-supplied tools are fine or need auditing.
AI gateways like OpenRouter and Vercel AI Gateway route a single API call to whichever provider their system picks as the best fit, which can include DeepSeek. An agency or contractor could be sending prompts to DeepSeek models without ever choosing to, and the routing happens behind the scenes, so identifying every exposure is genuinely hard, as The Register points out.
If vendors have to certify that no DeepSeek technology touched their products at any point, expect procurement questionnaires to grow a new line item. For a company that recently raised funding at a $12 billion valuation, losing the US federal market and its contractors is a meaningful ceiling on growth.
DeepSeek keeps shipping while Washington tightens the screws
While Washington was quietly finalizing the removal order, DeepSeek kept shipping. The company released its V4.1 Flash model on October 17, with strong coding benchmarks that put it alongside Claude Sonnet. Technical progress and geopolitical trust are running in opposite directions, and that gap is the story of Chinese AI in 2026.
The broader pattern is hard to miss. US policy keeps treating frontier AI as critical infrastructure with a national origin label. TikTok went through this with data, Huawei with hardware. DeepSeek is getting the AI-model version: no ban on private use, but a hard wall around government systems and the companies that sell to them.
What this means for you
- Consumers and most developers are not banned. This is not a TikTok-style nationwide fight. Private businesses and individuals can still use DeepSeek’s models, APIs, and apps.
- Federal vendors should audit now. If you sell software or services to civilian agencies, check whether your stack calls DeepSeek, wraps its models, or routes through a gateway that might. The order names third-party products explicitly.
- Check your AI supply chain, not just your API keys. The fuzzy “developed using” language means an audit limited to active DeepSeek API calls may miss the compliance risk. Ask vendors for written disclosure of model provenance.
- Gateways are the blind spot. If your infrastructure uses OpenRouter, Vercel AI Gateway, or similar multi-provider routing, pin your model choices or log provider attributions so you can prove where requests actually went.
- Watch for the copycats. The FASC review process that produced this order is a template. Other Chinese AI providers could face the same treatment, so model-provenance tracking is worth building once, not scrambling for each order.
