Why DHS now treats DeepSeek as a federal supply-chain risk

The Department of Homeland Security ordered the removal of DeepSeek products and any third-party services using the Chinese AI model from U.S. civilian agency IT systems, and banned their acquisition, in a notice issued Monday, October 19, 2026.

The directive, filed under docket DHS-2026-0628, names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. It bars agencies from acquiring new DeepSeek products or services and requires the removal of anything already deployed — including third-party tools built on top of DeepSeek's models.

DHS said DeepSeek models pose "multiple threat vectors" and warned that use "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors."

The scope is the detail that matters. A ban on DeepSeek's own app would be a narrow procurement decision. A ban that follows the model into third-party tools is a supply-chain rule: agencies must now audit not only DeepSeek but anything built on its models, including low-cost tools that employees and vendors may have adopted without treating them as Chinese AI at all.

That reframes the issue. The order treats a Chinese large language model less as a competitor product than as a federal supply-chain risk — the same category as banned telecom hardware or antivirus software.

The directive applies to civilian agencies. DHS can issue direction to civilian agencies but not to the military or intelligence services, so the notice does not by itself bind the Department of Defense or the intelligence community.

Several questions remain open. How civilian agencies will identify and remove third-party tools built on DeepSeek models is not specified in the notice. Whether the Defense Department or intelligence agencies will issue parallel restrictions is unknown. The notice's enforcement mechanism and any compliance deadline are not established by the available record. Nor is it clear how DeepSeek or Chinese authorities will respond.

What is established: as of Monday, DeepSeek and the services built on it are out of bounds for U.S. civilian agency systems, and the reach of the order extends past the company's own products to the tools layered on top of them.