DHS Orders DeepSeek Removed from All US Civilian Agency Systems
What happened
The US Department of Homeland Security issued a directive ordering the removal of DeepSeek products and third-party services built on the DeepSeek model from civilian federal agency IT systems. The order also prohibits future acquisition of any such products by civilian agencies. DHS stated that DeepSeek poses "multiple threat vectors" and warned that use by government employees or vendors "may result in the transfer of sensitive data to the PRC." The department further warned that the models could produce actionable intelligence on US persons or government agencies, and that the models themselves may contain malware or other security vulnerabilities. A July DHS memo, made public alongside the order, had already instructed agencies to monitor traffic flows in and out of government websites to address DeepSeek-related risks.
Why it matters
- ·Vendors supplying AI-powered services to federal agencies must audit their stacks immediately. Any third-party service that incorporates DeepSeek models is now banned, not just direct use of the product.
- ·The explicit malware warning from DHS creates a model-integrity precedent. Compliance teams cannot treat AI model provenance as a vendor-relationship question only; it is now a security control question with regulatory teeth.
- ·Private-sector organizations with government contracts face indirect exposure. If a contractor's internal tools rely on DeepSeek, that dependency may put contracts, clearances, or data-handling agreements at risk.
Governance controls affected
What to do now
- ☐Audit all AI products and third-party services in your technology stack to identify any that incorporate DeepSeek models, including embedded or white-labeled integrations.
- ☐Update vendor due diligence questionnaires to require explicit disclosure of any underlying model provenance, specifically asking whether DeepSeek or any PRC-origin model is in the supply chain.
- ☐Review contracts with vendors supplying AI services to federal agency clients and assess whether DeepSeek use triggers breach, termination, or notification obligations.
- ☐Establish or update cross-border data transfer controls for AI pipelines to flag any data flows to jurisdictions subject to national security restrictions.
- ☐Brief the board or audit committee on DHS's malware and intelligence-collection findings, and document the organization's current exposure and remediation timeline.
What to watch next
The Federal Communications Commission is scheduled to vote on October 29 on barring Chinese labs from testing electronic devices sold in the US, a move that could affect hardware procurement as well as software governance. Compliance teams should monitor whether the DHS order is extended to defense contractors or regulated industries beyond federal civilian agencies. State-level bans already in place in New York, Tennessee, and Virginia suggest further legislative activity at the state level is likely.
Stay ahead of stories like this
Get developments like this, plus everything else that matters in AI governance. Every Thursday.
Recent issues
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
- AI systems built to extend your reach are now extending attackers' reach too, and regulators in California and South Korea are making clear that containment failures belong to deployers, not just vendors.8 Oct
Free every Thursday. Unsubscribe anytime.