- US civilian federal agencies must immediately remove DeepSeek from government systems
- Federal departments can no longer purchase DeepSeek products or affiliated services
- Military and intelligence organizations remain excluded
The US government has directed civilian federal departments to immediately eliminate DeepSeek artificial intelligence software and related services from their technology systems.
The Department of Homeland Security (DHS) issued the directive over concerns the Chinese company's technology could expose sensitive information to foreign intelligence operations.
The restriction also covers applications incorporating DeepSeek models, although privately owned computers and personal installations fall outside the federal government's directive.
DeepSeek faces removal over security concerns
The directive requires affected agencies to discontinue purchases involving DeepSeek technology, including offerings supplied by affiliates and external developers incorporating its models.
Government departments must also withdraw affected applications from approved purchasing catalogs, supplier inventories and online procurement platforms used for federal acquisitions.
Homeland Security Secretary Markwayne Mullin authorized the measure following a recommendation from the Federal Acquisition Security Council, which evaluates potential technology supply chain threats.
The decision relies on the Federal Acquisition Supply Chain Security Act of 2018, legislation allowing authorities to restrict technologies considered dangerous.
Officials cited Chinese legislation permitting state intelligence organizations to demand corporate information, raising concerns about government access to data processed through DeepSeek.
The department also identified privacy concerns involving account registration information, user monitoring and device fingerprinting associated with the company's hosted services.
Because conversational AI systems process submitted prompts, officials warned that government employees could inadvertently disclose confidential material through ordinary interactions with DeepSeek.
Information obtained through such exchanges could potentially support intelligence assessments involving American citizens, federal operations, or other sensitive government activities.
Security evaluations conducted by NowSecure also identified serious vulnerabilities affecting DeepSeek's iOS application, adding technical concerns to the government's assessment.
However, the directive concerns federal technology procurement and deployment rather than establishing a nationwide prohibition on individuals downloading or operating DeepSeek.
Agencies must comply, while exceptions remain possible
Military organizations and intelligence agencies are excluded because their procurement arrangements operate under separate authorities.
Departments seeking permission to retain affected technology must submit written exemption applications through the Cybersecurity and Infrastructure Security Agency (CISA).
Such applications must reach the relevant Homeland Security official within 60 days and explain why an exception is necessary for government operations.
Applicants must identify the relevant products, provide substantial operational or national security grounds, and propose safeguards addressing the identified security concerns.
While completing the removal of DeepSeek, agencies are expected to strengthen network surveillance, record suspicious information transfers, and investigate unusual activity involving affected systems.
CISA will assist departments with technical implementation, while the Homeland Security Secretary must reconsider the directive annually.
The notice appears in the Federal Register under docket DHS-2026-0628, establishing the administrative record supporting the government's exclusion and removal requirements.
Although officials describe several potential security exposures, the supplied notice does not establish that every DeepSeek deployment has transmitted confidential American information.
Its application to third-party implementations also raises practical questions about identifying affected software, particularly where developers operate DeepSeek models independently.
