DHS Orders DeepSeek Removed From Federal Systems [2026]

The US Department of Homeland Security has ordered every civilian federal agency to strip DeepSeek products out of its information technology systems and has barred those same agencies from buying anything built on the Chinese company’s AI models going forward. The directive, Exclusion and Removal Order #2026-01, was signed by Homeland Security Secretary Markwayne Mullin on July 24, 2026, but stayed out of public view until it was filed on October 19, 2026, a gap of almost three months that has already drawn scrutiny in Washington.

For Irish and European readers watching the AI sector, the order matters for reasons that go beyond Washington politics. DeepSeek built its reputation on cheap, open, high-performing models that undercut US labs on price, and its tools have found their way into enterprise pipelines well outside China, including inside firms that also sell software to European public bodies. A ban that reaches third-party products “built using DeepSeek’s AI models” raises the question of how many vendors, in the US and elsewhere, now have to audit their own supply chains for a dependency they didn’t know mattered this much.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech Ireland once in the Google app and our stories appear in your news suggestions.

Add Now

What the DHS order actually says

The order’s full name, Exclusion and Removal Order #2026-01, tells you its two separate functions. The exclusion half bars Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates from federal contracts outright: covered civilian agencies can no longer purchase DeepSeek products or services, a restriction that took effect from the July 24 signing date. The removal half goes further, requiring agencies to physically take DeepSeek products out of systems where they are already installed, according to CNBC’s reporting on the filing. Crucially, the order doesn’t stop at DeepSeek’s own branded tools. It also covers third-party products and services built using DeepSeek’s underlying models, which means a vendor that quietly fine-tuned a DeepSeek open-weight model into its own product is caught by the same restriction as DeepSeek itself.

DHS grounded the order in a blunt assessment: DeepSeek’s models present what the department called “multiple threat vectors,” according to the agency’s own language cited by the The Hill. The specific worry isn’t abstract. DHS said that the prompt-and-response process built into DeepSeek’s most widely used applications “may result in the transfer of sensitive data to the PRC [People’s Republic of China] if used by U.S. government or vendors.” That’s a direct statement about data flow, not a general complaint about model quality or China’s AI ambitions, and it echoes the same server-location argument that shaped earlier state-level and agency-level DeepSeek restrictions going back to early 2025.

The order is deliberately scoped to civilian executive-branch agencies. Reported examples of affected departments include the Department of the Treasury, the Department of State, and the Department of Justice, agencies that between them handle financial regulation, diplomatic cables, and law enforcement data respectively. The Department of Defense sits outside the order’s reach entirely, since DHS’s authority under the Federal Acquisition Supply Chain Security Act covers civilian procurement, not military systems, which answer to a separate and generally stricter set of rules already in place.

Why the order sat unpublished for three months

The gap between the July 24 signature and the October 19 public filing is the detail that has generated the most follow-up questions among US technology reporters. Government procurement orders of this kind typically move through internal agency channels before any public filing, and a 60-day exception window reportedly opened for agencies seeking a carve-out tied to mission-critical systems or national-security considerations. That window had already closed by the time the order became public, meaning agencies effectively lost their chance to argue for an exemption before most of the country even knew the policy existed. Neither DHS nor any of the named agencies has published a specific compliance deadline for the physical removal work, and no figure for the number of affected systems or the cost of ripping out DeepSeek-linked software has been made available in current reporting.

That silence on cost and scope is itself informative. Large-scale software removal across federal civilian IT, spanning everything from chatbots embedded in casework tools to backend models quietly licensed through resellers, is rarely a quick fix. The 2019 to 2021 effort to strip Kaspersky antivirus software out of federal systems, triggered by similar data-transfer concerns, took agencies well over a year to fully execute even with a published deadline. DHS has not said whether this removal will move faster, and reporters covering the story have not been able to get a straight answer on timing from the department.

DeepSeek’s status as a company right now

It’s worth being precise about what the order does and doesn’t do to DeepSeek as a business. Hangzhou DeepSeek Artificial Intelligence Co., Ltd. remains an active, operating AI company. It has not been added to the Commerce Department’s Entity List, and the order is not a blanket US ban on private citizens, companies, or state governments using DeepSeek’s products, something separate from the federal civilian restriction entirely. DeepSeek’s consumer chat app, its API, and its commercial pricing all continue to function as normal outside of the newly excluded federal channel.

On the product side, DeepSeek has kept shipping through the period covered by the order. The company released DeepSeek-V4-Pro generally across its app, web service, and API on August 13, 2026, then moved to new peak and off-peak API pricing on August 16, with off-peak rates set at half the peak-hour price. DeepSeek-V4.1-Flash followed on September 10, billed by the company as smarter and more efficient, and an update known as V4.1-Flash-1017 arrived on October 17, just two days before the DHS order became public. None of that product cadence slowed down because of a restriction that, for DeepSeek, mostly affects a procurement channel it was unlikely to have much exposure to anyway given existing scrutiny of Chinese AI vendors in US government circles.

China’s response and the diplomatic temperature

Beijing pushed back quickly once the order became public. China’s government framed the measure as discriminatory, arguing the US was stretching the concept of national security to cover ordinary commercial competition, a line of argument Chinese officials have used consistently since the first wave of chip export controls against Chinese firms began several years ago, as TechRadar noted in its coverage of the growing rift. The response fits a now-familiar pattern: Washington frames restrictions on Chinese AI around data security and espionage risk, Beijing frames the same restrictions as protectionism dressed up as security policy, and neither side’s framing moves the other.

What makes this round notable is the specificity of the DHS language. Rather than a general statement about Chinese AI risk, the order’s text, cited by multiple outlets covering the filing, describes a concrete mechanism: data entered into DeepSeek’s products could reach Chinese state authorities, who have broad legal authority to compel access to infrastructure operated by Chinese companies. That argument doesn’t require proving DeepSeek has already handed over US government data. It only requires establishing that the legal and technical pathway exists, which is a lower bar and one that’s harder for DeepSeek or Beijing to rebut with a simple denial.

How this compares with earlier DeepSeek restrictions

This isn’t the first restriction DeepSeek has faced from a government body, and placing it in that sequence helps explain why DHS felt it had room to move. DeepSeek’s R1 model, released in early 2025, triggered a wave of bans and warnings across multiple countries almost immediately after its surprise debut rattled US AI stock valuations. Italy’s data protection authority ordered DeepSeek’s chatbot pulled from app stores within weeks of R1’s release over data handling concerns. Australia, South Korea, and several other governments issued restrictions on DeepSeek use within government devices during 2025. In the US, individual states and some federal agencies had already moved to block DeepSeek access on government hardware well before this DHS order formalized the policy at the civilian federal level.

What’s different about Order #2026-01 is its reach into the supply chain. Earlier restrictions mostly targeted DeepSeek’s own branded consumer app. This order explicitly captures third-party products and services built on DeepSeek’s underlying models, a category that could include software from vendors who never put DeepSeek’s name on a box but licensed its open-weight models to cut their own AI infrastructure costs. That’s the detail enterprise software buyers, including those outside the US watching for precedent, are now parsing most closely, because it signals that government procurement rules are starting to treat the model layer, not just the branded product layer, as the relevant unit of risk.

DHS also flagged separate security concerns about DeepSeek’s practices

The removal order arrived against a backdrop of security warnings that predate it. CISA, working with the NSA and FBI, issued a joint advisory flagging that China-based AI companies had been running large-scale knowledge-distillation campaigns against US AI models, a separate strand of concern from the data-transfer risk the DHS order centers on but one that feeds the same broader distrust. That advisory specifically named DeepSeek’s R1 and V3 models in the context of security concerns, though it stopped short of recommending the removal action DHS later took. Treating these as connected but distinct: one is about where your prompts end up, the other is about how a rival model might have been trained on outputs scraped from your own systems.

The market and vendor impact beyond federal agencies

For US government contractors and the systems integrators who serve them, the order creates an immediate compliance task: audit every product and subcontractor relationship for a DeepSeek dependency, document it, and remove or replace it, all without a published deadline to anchor the work against. That ambiguity is its own kind of pressure. Contractors tend to move faster, not slower, when a deadline is unstated, because nobody wants to be the vendor still running a DeepSeek-based tool when an auditor asks the question six months from now.

The order also lands at a moment when DeepSeek has been actively expanding its commercial footprint rather than retreating. The company opened its Search and Fetch APIs to outside developers on October 17, pricing calls at $0.75 per 1,000 successful requests, a move clearly aimed at competing for the same agentic AI workloads that US labs like OpenAI and Anthropic have been chasing. That commercial push, happening in the same week the DHS order became public, highlights that DeepSeek’s business strategy and the US government’s procurement policy are now running on separate, disconnected tracks. One is about growing global developer adoption. The other is about shrinking federal exposure. Readers who want to see how enterprises are approaching alternative inference options can find more detail in our coverage of running DeepSeek V4.1 Flash locally, which is a workaround some organizations have floated as a way to use the model’s capability without the cloud data-transfer exposure DHS flagged.

Competitive field: where DeepSeek sits against US rivals now

The irony of the timing is that DeepSeek’s technical standing hasn’t weakened. Independent benchmarking of the October 17 V4.1-Flash-1017 update put it ahead of Claude Opus 5 on a code-fixing benchmark, at unchanged pricing, according to reporting from Xenospectrum. That’s a reminder that the US government’s procurement decision is a security and sovereignty call, not a verdict on DeepSeek’s competitiveness as a model provider. For companies choosing between frontier AI vendors on pure capability and cost, DeepSeek remains one of the more aggressive players on price, a dynamic covered in depth in our comparison of Grok, ChatGPT, Claude, and Gemini pricing. Enterprise buyers in Ireland and across the EU, who are not bound by the DHS order at all, will keep making that calculation on commercial terms rather than national-security ones, at least for now.

That split matters for how the story develops. US federal agencies are walking away from DeepSeek on security grounds while facing no change in DeepSeek’s technical trajectory. Meanwhile, coding tool vendors and cloud platforms outside the federal procurement bubble, the kind covered in our look at Claude Code, Copilot, and Cursor adoption, continue to evaluate DeepSeek’s models purely on capability and cost, unaffected by a restriction that applies specifically to US civilian government procurement.

Detail	Specification
Order name	Exclusion and Removal Order #2026-01
Signed by	Markwayne Mullin, Secretary of Homeland Security
Signature date	July 24, 2026
Public filing date	October 19, 2026
Covered entity	Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
Scope	Civilian federal executive-branch agencies
Excluded from order	Department of Defense
Reported affected agencies	Treasury, State, Justice
Procurement effect	No new purchases of DeepSeek products or services
Installed-system effect	Removal of existing DeepSeek products required
Third-party coverage	Products and services built on DeepSeek models included
Stated rationale	“Multiple threat vectors,” risk of data transfer to the PRC

DeepSeek’s recent product timeline, in context

Understanding why DHS acted when it did requires seeing the order against DeepSeek’s own release calendar. The company has shipped updates roughly every four to six weeks for most of 2026, a pace that has kept it visible in developer conversations even as governments have tightened restrictions around it.

Date	Event
Early 2025	DeepSeek R1 released, triggers first wave of international government restrictions
August 13, 2026	DeepSeek-V4-Pro reaches general availability across app, web, and API
August 16, 2026	New peak and off-peak API pricing takes effect for the V4 family
September 10, 2026	DeepSeek-V4.1-Flash released with reduced API pricing
October 17, 2026	DeepSeek-V4.1-Flash-1017 update ships; Search and Fetch APIs opened to developers
July 24, 2026	DHS signs Exclusion and Removal Order #2026-01 (not yet public)
October 19, 2026	DHS order becomes public via federal filing

What DHS officials and the order itself say

DHS’s own language in the order is unusually direct for a procurement document. The department stated that DeepSeek presents “multiple threat vectors that pose significant risk to the cybersecurity of U.S. government systems,” according to reporting from Silicon Republic. On the data-transfer question specifically, the order states that the transfer of sensitive information to the PRC, “either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs,” per The Hill’s review of the filing. The order goes further still on the structural concern behind all of this, noting that “the Chinese government has extensive authority to access private infrastructure,” a line that applies to any Chinese-headquartered tech company, not uniquely to DeepSeek, but one DHS chose to put in writing as justification for this specific action.

Secretary Mullin’s written guidance accompanying the order also addressed the transition period. He noted that during the stretch between the order’s issuance and full removal of covered products from agency systems, federal agencies are encouraged to take interim steps such as monitoring traffic flow in and out of the agency, implementing enhanced logging and controls on data exfiltration for the relevant systems, and detecting and flagging anomalous activity, reports covering the order’s guidance language say. That guidance is itself an acknowledgment that removal won’t happen overnight and that agencies need interim risk mitigation while the physical and contractual work of stripping DeepSeek products out gets done.

What this means for cybersecurity and compliance teams

Federal contractors and the vendors who sell to them now face an audit obligation that didn’t exist in writing before October 19. For compliance and security teams, the practical first step is a dependency map: which products, scripts, or integrations in a given agency’s stack rely, even indirectly, on a DeepSeek model. That’s a harder exercise than it sounds, because open-weight models get embedded in downstream tools in ways that aren’t always disclosed on a vendor’s marketing page. Teams that have already built out logging and data-flow visibility, the kind described in our guide to GDPR data breach response planning, are better positioned to answer the “where does this data actually go” question quickly, even though that guide was written for a different regulatory regime.

Cloud architecture choices matter here too. Organizations running mixed-cloud environments that include any Chinese-model-derived inference layer, whether through AWS, Azure, or GCP deployments, will want to revisit vendor contracts for AI model provenance clauses. Our comparison of AWS, Azure, and GCP growth in Ireland covers how these platforms are positioning themselves on data residency, a factor that’s about to matter more to US-facing contractors than it did a year ago.

Predictions: where this goes from here

Several trajectories look plausible based on how similar restrictions have played out before, though none of them are confirmed and all deserve to be read as informed speculation rather than fact.

Expect DHS or another federal body to eventually publish a firm removal deadline, following the pattern set by the earlier Kaspersky removal effort, since open-ended compliance windows tend to get formalized once agencies start asking for clarity.
Other US allies that have already restricted DeepSeek at the agency level, including some in the EU, may face pressure to match the US civilian-government standard, particularly if Washington raises the issue in bilateral tech-policy discussions.
DeepSeek is likely to keep shipping new models on its existing four-to-six-week cadence regardless of the US restriction, since its commercial base is overwhelmingly outside the US federal market to begin with.
More vendors will start disclosing AI model provenance in contracts with government buyers, treating “which foundation model powers this feature” as a standard procurement question rather than an afterthought.
China’s response is likely to stay rhetorical rather than escalate into matching restrictions on US AI firms operating in China, continuing the asymmetric pattern seen in the chip export control disputes of recent years.

The bigger picture: AI procurement as a national security tool

This order is best read as part of a broader pattern rather than an isolated event. Since DeepSeek’s R1 model first disrupted assumptions about Chinese AI capability in early 2025, governments worldwide have been building out the regulatory and procurement machinery to treat foundation models as a supply-chain security category, similar to how telecom equipment and critical infrastructure components are already vetted. The Federal Acquisition Supply Chain Security Act, the same legal basis DHS used for this order, was written years before DeepSeek existed, but it’s increasingly being applied to software and AI products rather than just physical hardware and network equipment.

What’s new in this specific order is the explicit inclusion of third-party products built on DeepSeek’s models. That’s a template other agencies, and potentially other governments, are likely to copy, because it closes the most obvious loophole: rebranding or lightly modifying a restricted model to avoid the restriction by name. If this approach spreads, AI vendors serving government markets anywhere, Ireland and the EU included, should expect procurement questionnaires to start asking not just “which AI features does your product have” but “which underlying model trained them, and where is that model’s company headquartered.”

Frequently asked questions

What exactly did DHS order?
DHS ordered civilian federal agencies to remove DeepSeek products from their IT systems and barred those agencies from purchasing DeepSeek products or services going forward, including products built on DeepSeek’s AI models by third parties.

When was the order signed, and when did it become public?
The order, numbered Exclusion and Removal Order #2026-01, was signed on July 24, 2026, by Secretary Markwayne Mullin, and became publicly known through a federal filing on October 19, 2026.

Does the order apply to the Department of Defense or the US military?
No. The order specifically covers civilian executive-branch agencies. Department of Defense agencies are excluded from its scope.

Which agencies have been named as affected?
Reported examples include the Department of the Treasury, the Department of State, and the Department of Justice, though the order applies broadly across covered civilian agencies, not only those three.

Why did DHS cite as its reason for the ban?
DHS said DeepSeek’s models present “multiple threat vectors” and that use of the products “may result in the transfer of sensitive data to the PRC if used by U.S. government or vendors.”

Is this a nationwide ban on DeepSeek for everyone in the US?
No. The order applies to covered civilian federal government procurement and installed systems. It does not restrict private companies, individual consumers, or state and local governments, though some of those have imposed their own separate restrictions previously.

Has DeepSeek responded to the order?
No direct statement from DeepSeek or its representatives responding to the order has been made publicly available as of this writing.

Is there a deadline for agencies to finish removing DeepSeek products?
No specific compliance deadline for full removal has been published. Agencies had a 60-day window from the July 24 signing to request exceptions, which has already closed.

DHS Orders DeepSeek Purged: 60-Day Window Already Shut [2026]