The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products from government information technology systems and exclude the company’s technology from future procurement.
The Federal Register notice covers products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., its affiliates and third-party offerings developed using DeepSeek implementations.
DHS issued the order under the Federal Acquisition Supply Chain Security Act. The agency cited supply-chain concerns involving government data, malware, software vulnerabilities and the possibility that sensitive information could be transferred through infrastructure outside trusted jurisdictions.
The action applies to federal civilian executive branch systems and procurement. It does not directly ban private companies or consumers from using DeepSeek.
The inclusion of third-party products is especially important because agencies may use software built on DeepSeek technology without employees interacting with the model directly. Security and procurement teams will need visibility into the underlying models and services used by vendors.
Seemant Sehgal, founder and CEO of BreachLock, said the order should also prompt private organizations to examine where employees send corporate information.
“The affiliates and third-party products clause in the order is where this gets harder, because an employee does not need to use DeepSeek directly to send data to it,” Sehgal said.
Enterprise security leaders should inventory sanctioned and unsanctioned AI services, document model providers used by third-party applications and apply controls that prevent sensitive information from reaching unapproved systems.