DHS DeepSeek Ban: What the Order Covers and Does Not

DeepSeek is not banned for everyone in the United States. The Department of Homeland Security (DHS) ordered federal civilian agencies to exclude DeepSeek products from purchasing and to remove them from their information technology (IT) systems. BleepingComputer reports that the order is not a general ban on private or consumer use.

Is DeepSeek Banned in the US?

The order's reach can be described in these points:

• Who it binds: federal civilian agencies within DHS's authority.
• What agencies cannot buy: DeepSeek products and services, including through approved-product lists and purchasing marketplaces.
• What agencies must remove: DeepSeek and DeepSeek-affiliate products, plus third-party products and services built using DeepSeek implementations, from civilian agency IT.

As the sources describe it, the order applies to federal civilian agencies. The sources do not say how it applies to federal contractors, or to state and local agencies.

What the DHS DeepSeek Ban Orders

The DHS DeepSeek ban has two parts: a procurement exclusion and a removal requirement. The Federal Register notice announces an order issued by the Secretary of Homeland Security. It appears in Volume 91, Number 201 of the Federal Register, on pages 66346 to 66350, under Docket No. DHS-2026-0628. DHS published it on October 20, 2026, and it is signed by James H. Percival II, General Counsel of DHS.

The procurement exclusion covers information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek). It also covers affiliated entities as defined in the Code of Federal Regulations (CFR) at 48 CFR 2.101. The removal requirement applies to all DeepSeek and DeepSeek-affiliate products in civilian agency information technology. It also applies to third-party products and services developed using DeepSeek implementations.

According to BleepingComputer, DeepSeek offers large language models, a chatbot, application programming interface (API) services, and models for coding and reasoning. The sources do not give a precise definition of either "affiliates" or "third-party products."

The Legal Authority Behind It

The order cites the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), found at 41 U.S.C. 1321 to 1328. Its implementing regulations are at 41 CFR 201-1. The notice says the Secretary acted after reviewing a recommendation from the Federal Acquisition Security Council and affiliated evidence.

The signed order is in the notice's appendix. Those pages are published as images, and the text of the signed order is not described here. The notice says a copy can be found at regulations.gov by searching for DHS Docket Number DHS-2026-0628.

What Agencies Must Do and How Exceptions Work

Agencies must exclude and remove covered DeepSeek products immediately, according to BleepingComputer. Exclusion applies to procurement, including approved-product lists and purchasing marketplaces. Removal applies to covered products already in agency IT systems, unless the agency requests an exception.

BleepingComputer's report describes the exception process in four parts:

• Agencies may submit exception requests within 60 days of the order's issuance.
• Each request must explain the justification and the proposed risk mitigations.
• The Cybersecurity and Infrastructure Security Agency (CISA) reviews requests and issues written approvals or denials.
• Agencies that cannot comply because of internal capability restrictions can get technical assistance from CISA.

The sources do not give an issuance date separate from the October 20 publication. This article therefore does not calculate when the 60-day window closes. The sources also do not say whether that window changes when removal must happen.

Neither source says what happens to an agency that does not comply. Penalties and enforcement are unknown from the material used here.

The Concerns DHS Cites

BleepingComputer reports that DHS cites concerns about Chinese government access to DeepSeek infrastructure and data. According to that report, DHS says the Chinese government could access DeepSeek infrastructure, collect personal information, track users, and potentially transfer sensitive government data to China. DHS also cites possible malware in DeepSeek models.

BleepingComputer reports that DHS references a February 2025 report from NowSecure on the DeepSeek iOS app. BleepingComputer describes that report as finding unencrypted data transmissions, weak encryption, insecure local storage, user fingerprinting risks, and data sharing with ByteDance.

These are DHS's stated concerns, as BleepingComputer reports them. No source here independently verifies them. The sources do not report any response from DeepSeek.

What the Order Does Not Cover, and What Is Unknown

Several parts of the order are not settled by the sources used for this page:

• Penalties or enforcement for non-compliance.
• Precise definitions of "affiliates" and "third-party products."
• Whether the 60-day exception window changes removal timing.
• Any reaction from DeepSeek.
• How the order applies to federal contractors, and to state and local agencies.

For federal contractors, state agencies, and private companies, the sources do not say what the order means. The notice's appendix holds the signed order, and the sources here do not quote its text.

The order is published, and the sources report no court challenge. Nothing here predicts whether one will be filed or how it would end.

What This Means for an Ordinary Person

The notice and BleepingComputer's report settle the following points:

• The order covers federal civilian agencies.
• It excludes DeepSeek products from federal civilian procurement and removes them from civilian agency IT.
• BleepingComputer reports it is not a general ban on private or consumer use.

Three questions remain open:

• How far the order reaches past federal civilian agencies.
• Whether penalties apply for non-compliance.
• Whether DHS's stated concerns hold up.

If your question is about your personal data, our guide to protecting your privacy online is a separate place to start. For the wider picture of AI rules, see our AI regulation explainer.

Where the DHS DeepSeek Ban Stands

The DHS DeepSeek ban is published. It applies to federal civilian agencies, and according to BleepingComputer it is not a general ban on private or consumer use. Its reach beyond those agencies is not settled by the sources used here.

For the state and federal split on AI rules, read our state vs. federal AI regulation explainer next.