Federal agencies must remove DeepSeek, even inside other products. Here’s what to check

On Tuesday, the Department of Homeland Security published an order that bars federal civilian agencies from buying products from DeepSeek, the Chinese AI company, and tells them to remove what they already have. It goes beyond DeepSeek itself: agencies must also remove other companies’ products and services “developed using DeepSeek implementations.”

The order governs federal agencies, not private businesses. But it raises a question every business using AI should be able to answer: whose AI is inside your tools, and where does your data go?

What the order says

The order, from Homeland Security Secretary Markwayne Mullin, is dated July 24 and was issued under the Federal Acquisition Supply Chain Security Act of 2018. DHS made it public in the Federal Register on Tuesday.

• Who it covers. Civilian agencies, except for their national security systems. Military and intelligence systems fall under the Pentagon and the Director of National Intelligence instead.
• What agencies must do. Stop buying DeepSeek products right away, including through approved product lists and online marketplaces, and remove them from their systems or ask for an exception.
• Exceptions. Requests are due within 60 days and need a “compelling justification.” The Cybersecurity and Infrastructure Security Agency (CISA) approves or denies them in writing.
• In the meantime. Agencies are encouraged to monitor network traffic, step up logging, and watch for data leaving their systems.

Why DHS calls it a risk

DeepSeek’s servers are in China, and the order says “the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure.” Signing up for DeepSeek’s own service collects personal information and “may also track and digitally fingerprint users.” Typing information into its apps “may result in the transfer of sensitive data to the PRC.” And DHS warns that “the models themselves may contain malware or other security vulnerabilities,” pointing to research that found multiple critical vulnerabilities in DeepSeek’s iPhone app.

China pushed back. Foreign Ministry spokesperson Mao Ning said Beijing opposes “overstretching the concept of national security and politicizing technology and trade issues,” TechCrunch reported.

Closer to home

In March 2025, Alabama Gov. Kay Ivey banned DeepSeek from state devices and the state network, along with another AI tool, Manus, citing their “affiliation with the Chinese government and their vast data-collection capabilities.”

For most businesses in Dothan, Enterprise, and across the Wiregrass, neither ban changes anything legally. It does matter if you sell to a civilian federal agency: anything you provide with DeepSeek inside has to come out of the agency’s systems unless the agency gets an exception.

Five things to check

1. List the AI your team uses. Include free apps on personal phones. DHS notes that DeepSeek’s apps are free, and free tools are the easiest to start using without anyone signing off. Our post on breaches tied to shadow AI explains the risk.
2. Ask vendors whose AI is inside. The company that sells you a chatbot, a phone answering service, or a writing tool often builds on another company’s model. Ask which models they use, who runs them, and where your data is processed and stored. Get the answers in writing.
3. Read the privacy policy before anyone pastes in customer information. Look for where data is stored, whether it’s used to train AI, and how to delete it.
4. Check your federal contracts. Many include a supply chain clause, FAR 52.204-30, that requires checking SAM.gov for orders like this one at least every three months and reporting a covered product within three business days of finding it. Your contracting officer can say how this order affects yours.
5. Keep sensitive work on hardware you control. Most of the risks DHS lists come from DeepSeek’s own apps and servers. An open model running on your own machine keeps your prompts on that machine. But DHS’s warning about the models themselves is a reminder that where a model comes from matters too, especially to government customers.

Where we can help

Our on-prem AI service runs private AI on hardware in your building, so your documents and prompts stay put. We test open models on your real work before you buy anything, choose ones that fit your customers’ requirements, and help you set clear rules for what may leave the building. For what the hardware costs, see private AI now fits on one desktop.

Sources

• Department of Homeland Security, via the Federal Register: Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements, October 20, 2026
• TechCrunch: US orders federal agencies to remove China’s DeepSeek AI from their systems, October 20, 2026
• Office of the Governor of Alabama: Protecting Alabama from Chinese Infiltration by Prohibiting the Use of DeepSeek, Manus, and Similar Harmful Technologies on State IT Infrastructure (PDF), March 26, 2025
• Acquisition.gov: FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition