DHS Orders Federal Civilian Agencies to Remove DeepSeek Products

The Department of Homeland Security (DHS) has ordered federal civilian agencies to stop using DeepSeek products and remove them from government systems.

The order also covers products from affiliates of Chinese artificial intelligence companies, as well as third-party products and services built with DeepSeek technology.

What is DeepSeek?

DeepSeek, formally known as Hangzhou DeepSeek Artificial Intelligence Co., Ltd., develops large-scale language models and provides chatbots, application programming interface (API) services, and models designed for coding and inference tasks.

The company’s AI tools became popular soon after their release, but multiple reports later raised concerns about security risks. Cisco security analysis, CSIS research, Kela research, and a Cloud Security Alliance report have examined potential risks.

There are also concerns that Chinese authorities could access users’ conversations and other information processed through DeepSeek services.

What DHS agencies must do

DHS is taking regulatory action to restrict DeepSeek and related products on critical systems in the United States. The order notice directs affected federal civilian agencies to:

• Immediately remove affected products from procurement systems, including approved product lists and purchasing markets.
• Immediately remove affected products from agency IT systems or request an exception.
• Submit exception requests within 60 days of the order’s issuance. Requests must provide a valid reason and a risk mitigation proposal.

The Cybersecurity and Infrastructure Security Agency (CISA) will review each exception request and issue a written approval or denial.

The order applies to federal civilian agencies within DHS’s purview. It does not generally prohibit private-sector or consumer use of DeepSeek products.

Security and privacy concerns cited by DHS

DHS said the order was prompted by concerns that the Chinese government could access DeepSeek infrastructure, collect personal information, track users, and transfer sensitive government data to China.

The document also cites concerns about potential malware in DeepSeek models and references security findings published in February 2025. In a report on the DeepSeek iOS app, NowSecure identified a security vulnerability.

NowSecure reported unencrypted data transmission, weak encryption algorithms, insecure local storage, the risk of user fingerprinting, and data sharing with Chinese technology company ByteDance, which operates the TikTok short-video platform.

Agencies can request exceptions

The order was published in the Federal Register after appearing on Public Inspection the previous day.

Agencies may apply for an exception within 60 days of the order’s issuance date. If an agency cannot comply because of internal capacity limitations, CISA will provide technical assistance.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report