Washington bans Chinese AI DeepSeek, and any software built on it, from civilian agencies

Signed on July 24, the order stayed confidential for nearly three months. The US Department of Homeland Security (DHS) filed it on October 19 with the Federal Register, the federal government's official gazette, which publishes it this Tuesday, October 20. Its goal: to remove the Chinese AI company DeepSeek from the entire federal civilian administration.

The text, signed by Homeland Security Secretary Markwayne Mullin, relies on a 2018 law on supply chain security in federal procurement. It places two obligations on civilian agencies:

• stop buying products from DeepSeek or its affiliated entities, effective immediately, including through approved product catalogs;
• remove these products from their IT systems, along with any "third-party products and services developed from DeepSeek implementations."

Why DHS considers DeepSeek dangerous

DHS says DeepSeek's models present "several threat vectors." It notes that the company's servers are located in China and that Chinese law grants intelligence services broad access powers. It adds that, for instances hosted by DeepSeek, account creation collects personal data and could be used to track users. According to the text, the questions that officials or contractors put to the model could send sensitive data to China. The models themselves "could contain" malware or vulnerabilities. DHS cites research that found several critical flaws in DeepSeek's iOS app.

This is not the first US measure. According to Next, citing Reuters, the Department of Commerce and the Navy had already banned DeepSeek from their devices, as had the states of New York, Tennessee and Virginia. Beijing denounced an abuse of the notion of national security, AFP reports. DeepSeek has not commented publicly.

What the text leaves unclear

The order provides no list of products. The wording covering products "developed from" DeepSeek is broad. It could apply to a coding assistant, a search tool or an online service built on one of the company's models, such as the open-source coding model released on October 17. The text does not say how to treat an open-weight model downloaded and run on US servers.

Agencies could request an exception in writing within 60 days of signing, providing a "compelling justification." Counting from July 24, that window closed on September 22. The order does not apply to national security systems, which fall under the Pentagon and the intelligence community. It will be reviewed every year.

What a European company can take from this

None of this applies in Europe. But DHS's approach raises a useful question for any IT department: which models are actually running behind your teams' AI tools?

• Take inventory of the tools that let users choose the model. Many offer DeepSeek in a simple menu.
• Distinguish the app or API hosted by DeepSeek, where data goes to its servers, from an open-weight model that you run yourself.
• During the removal period, DHS recommends that agencies monitor inbound and outbound traffic, strengthen logging and check for data leaks. These measures apply to any AI tool.

It remains to be seen whether other allied countries will follow Washington, and how US vendors that offer DeepSeek models to their public-sector customers will react.