A U.S. Department of Homeland Security (DHS) order requires federal civilian agencies to remove covered DeepSeek products and exclude them from procurement, extending the restriction to third-party products and services developed using the company’s implementations.
The order applies to federal civilian executive branch agencies, excluding their national security systems and secure compartmented information systems. It was issued under the Federal Acquisition Supply Chain Security Act of 2018. The order’s cover lists July 24 as its original release date. The notice was filed for public inspection on Oct. 19 and published in the Federal Register on Oct. 20.
Agencies could request written exceptions within 60 days of issuance, with the Cybersecurity and Infrastructure Security Agency reviewing requests. That period would have ended before the notice was filed for public inspection on Oct. 19. The public documents give no estimate of costs to agencies or suppliers.
DHS says services hosted by DeepSeek collect personally identifiable information and may track users. It warns that use by U.S. government employees or vendors may result in sensitive data being transferred to the People’s Republic of China (PRC), and cites potential malware or security vulnerabilities. DHS does not say that federal data were breached or that Chinese authorities accessed agency information.
DeepSeek’s privacy policy says the company collects, processes and stores personal data in China. The company announced its R1 model on Jan. 20, 2025, describing the model and code as open source under the MIT license. DeepSeek said R1 performed on par with OpenAI-o1. Its official news page lists V4 as released April 24, 2026, and V4.1-Flash as introduced Sept. 10.
At an Oct. 20 briefing, Chinese Foreign Ministry spokesperson Mao Ning said China opposes “overstretching the concept of national security” and politicizing technology and trade issues.
