The US Department of Homeland Security has ordered all federal civilian agencies to remove artificial intelligence technology from Chinese company DeepSeek Ltd. from their information systems. The order, published on the Federal Register website, cites multiple threat vectors that could give the Chinese Communist Party extensive authority over American government infrastructure. The decision matters for business because it turns earlier device-level limits into a full procurement and supply-chain ban.
Removal order and earlier restrictions
The directive covers all civilian agency information technology systems and requires removal of any products affiliated with DeepSeek, including third-party services developed using its technology. Future purchases of DeepSeek products and services are prohibited in those agencies. The department justified the move under the 2018 Federal Acquisition Supply Chain Security Act after a review by the Federal Acquisition Security Council. That legal framing places DeepSeek in the category of supply-chain risks rather than a routine IT policy update.
The department warned that the technology could be used to track or digitally fingerprint users and could lead to transfer of sensitive data to the People's Republic of China if used by government bodies or vendors. The concern therefore extends beyond chatbots or models running inside agencies to software supplied through contractors. Vendors serving civilian agencies will need to document that DeepSeek components are absent from their stack. The wording signals that indirect integration counts as prohibited use.
The crackdown follows a longer sequence of limits. In 2025 the free DeepSeek app was downloaded by millions of Americans, while officials considered a full ban in the United States. The Commerce Department later banned DeepSeek from government devices, the US Navy directed members not to use the model over security concerns, and New York State banned it from government devices and networks over data privacy and censorship risks. One cybersecurity expert described the privacy policy as not worth the paper it is written on. A recent government survey did not place DeepSeek in the top 10 models by public opinion.
What the ban means for AI buyers
For companies that sell to or work with US civilian agencies, the order narrows the set of acceptable AI components and raises compliance costs. Procurement teams will need to check bills of materials, APIs, embeddings, coding assistants and agent frameworks for DeepSeek-derived code or hosted services. Large contractors with centralized security review can absorb this screening more easily, while smaller subcontractors may face delays while they replace components and obtain attestations. Contracts that name approved models and origins will become more common.
The limits do not automatically apply to private-sector use, and the order by itself does not prove a specific incident of data transfer from an agency system. Companies should therefore separate regulatory risk from technical performance when choosing models. Key questions for a vendor include where inference runs, what logging and retention apply, whether any third-party model calls leave the approved environment, and how the vendor tracks open-source dependencies. For DeepSeek-based tools, buyers need written confirmation of removal or replacement, not general assurances about data handling.
The marker to watch is enforcement inside procurement: contract clauses, vendor attestations and audit findings that reference the Federal Acquisition Security Council review. If major agency suppliers publish DeepSeek-free declarations and replacement timelines, the ban will harden into standard purchasing practice. The release of V4.1 Flash-1017, described as faster with stronger reasoning and coding, will then test whether technical competition continues outside government while federal demand shifts to other providers.
