US DHS Orders Federal Agencies to Remove DeepSeek AI Software

The order requires affected departments to withdraw applications using DeepSeek from approved purchasing catalogs, supplier inventories, and online procurement platforms used for federal acquisitions. Military and intelligence organizations are excluded because their procurement operates under separate authorities. Agencies seeking to retain the technology must submit written exemption applications through the Cybersecurity and Infrastructure Security Agency within 60 days, explaining why an exception is necessary for government operations and proposing safeguards.

Officials cited concerns that Chinese legislation allows state intelligence organizations to demand corporate information, raising fears about government access to data processed through DeepSeek. The department also identified privacy risks involving account registration information, user monitoring, and device fingerprinting associated with the company's hosted services. Because conversational AI systems process submitted prompts, officials warned that government employees could inadvertently disclose confidential material through ordinary interactions with DeepSeek, and that information obtained through such exchanges could potentially support intelligence assessments involving American citizens, federal operations, or other sensitive government activities.

Security evaluations by NowSecure also found serious vulnerabilities in DeepSeek's iOS application, adding technical concerns to the government's assessment. The decision relies on the Federal Acquisition Supply Chain Security Act of 2018, which allows authorities to restrict technologies considered dangerous, following a recommendation from the Federal Acquisition Security Council. The notice appears in the Federal Register under docket DHS-2026-0628.

The directive concerns federal technology procurement and deployment rather than establishing a nationwide prohibition on individuals downloading or operating DeepSeek. Privately owned computers and personal installations fall outside the order. The notice does not establish that every DeepSeek deployment has transmitted confidential American information, and its application to third-party implementations raises practical questions about identifying affected software, particularly where developers operate DeepSeek models independently. While completing the removal, agencies are expected to strengthen network surveillance, record suspicious information transfers, and investigate unusual activity involving affected systems. CISA will assist with technical implementation, and the Homeland Security Secretary must reconsider the directive annually.