DHS orders DeepSeek removed from all federal civilian agencies

The Department of Homeland Security has ordered the removal of DeepSeek from all federal civilian agencies and their IT systems, publishing the restriction in the Federal Register days after the Chinese AI company released its latest model.

DHS characterized the risks of DeepSeek use in the notice as potentially resulting in the "transfer of sensitive data" of US government employees and vendors to the Chinese government. That phrase anchors the department's legal and security rationale, and it appears in the official record rather than in a press statement.

The order reaches every civilian agency in the federal government. The Environmental Protection Agency and the Federal Communications Commission are two examples of the bodies that would have to exclude DeepSeek products from use under the restriction. Agencies must also remove any existing DeepSeek-related products already deployed in their systems, not simply block new installations.

What does the notice actually require?

Three obligations follow from the DHS action, as described in the Federal Register notice:

• Civilian agencies must exclude any DeepSeek products from being used in their operations.
• Agencies must remove any existing DeepSeek-related products from their IT systems.
• DeepSeek is disallowed from participating in any federal government contracts.

The third element extends the restriction beyond software on government machines. By cutting the company off from federal contracting, DHS closes a procurement channel, not merely a usage channel.

DHS added a technical justification in the notice. The department said DeepSeek's models could "contain malware or other security vulnerabilities." The claim is stated as a possibility in the notice's own language, but it gives agencies a concrete basis for the removal requirement independent of the data-transfer concern.

Why did the ban land now?

The timing is the most notable feature of the order. DHS issued the restriction on the heels of DeepSeek releasing V4.1-Flash-1017, its latest AI model. The company called the new release "smarter, faster, more efficient" in its own announcement of the model.

The sequence matters for readers tracking US-China AI policy. A sweeping federal restriction landing within days of a major model release signals that DHS is watching the company's product cycle and reacting to it, rather than acting on a slow-moving internal review schedule. The Federal Register notice is the formal instrument; the model release is the proximate event on the calendar.

Is this the first US government action against DeepSeek?

No. DHS' order is the most expansive measure to date, but it is not the first time the Chinese AI company has run into friction with the US government.

Last year, two US Congressmembers proposed a bill that would ban DeepSeek's AI chatbot from government devices. That bill targeted a specific product category — the chatbot — on a specific class of hardware: government devices. The DHS restriction is broader on both dimensions. It covers DeepSeek products generally, applies across federal civilian agencies and their IT systems, and adds a bar on federal contracting.

The escalation track is therefore clear. A proposed legislative ban on one application has been followed by an executive-branch restriction covering the company's products across the civilian federal footprint.

What is at stake in the market?

The context for the friction is competitive as much as it is security-driven. DeepSeek's cheaper AI models have started to rival the likes of ChatGPT or Gemini, according to the trajectory described in the reporting on the order. That cost position is the reason the company has attracted attention from users and scrutiny from Washington at the same time.

For federal agencies, the immediate operational question is removal. Agencies such as the EPA and FCC must now inventory their systems, identify any DeepSeek-related products, and take them out. The contract exclusion adds a compliance task for procurement offices: any pipeline that could have included DeepSeek as a vendor or subcontractor must reflect the ban.

For DeepSeek, the order cuts off the US federal civilian market entirely and arrives in the same week as the company's effort to promote V4.1-Flash-1017 as a step forward in capability and efficiency. The company framed the model as "smarter, faster, more efficient"; DHS framed the company's products as a potential conduit for sensitive data and a possible vector for malware.

The two framings now define the terms of the dispute. One side emphasizes capability and price. The other emphasizes data flows, vulnerabilities, and the destination of government information. The Federal Register notice, with its verbatim warnings about "transfer of sensitive data" and models that could "contain malware or other security vulnerabilities," is the version that now carries force of policy across the federal civilian government.

Whether Congress follows the DHS action with the device-ban bill proposed last year, and whether other governments adopt similar removal orders, will determine whether this notice marks the peak of the restrictions on DeepSeek or the start of a broader pattern.