Three months in a drawer. The USA bans DeepSeek from its civil administration. Indeed, the Federal Register published this Tuesday, October 20, the order from the Department of Homeland Security. This excludes DeepSeek from any purchases by federal civilian agencies. He also orders the “immediate” removal of its products from state computer systems.
The text also targets “third-party products and services developed from DeepSeek implementations”. In other words, the formula goes beyond the Chinese application. It affects any American software that includes it.
The order is signed by Secretary Markwayne Mullin and dated July 24. It therefore precedes the Beijing investigation by two months. China has in fact opened its own procedure at DeepSeek for leaking data to the United States.
The legal tool is new for the DHS. Indeed, the “Exclusion and Removal Order #2026-01” is based on the Federal Acquisition Supply Chain Security Act of 2018. This law makes it possible to exclude a supplier deemed dangerous without going through Commerce or the entity list. The only known precedent is the US intelligence order against Acronis in 2025.
This covers all civilian agencies except national security systems. It applies to the application as well as the API and affiliates of “Hangzhou DeepSeek Artificial Intelligence”. Finally, the notice is published in the Federal Register under number 2026-21447.
The reasons are contained in a few sentences. “DeepSeek models present multiple threat vectors,” DHS writes. First, the servers are in China. There, “the legal system grants government cyber and intelligence functions broad access to private company infrastructure.” Next, account creation collects personal data. It “can also track and digitally fingerprint users”.
Finally, the models themselves “may contain malware”. The only document in the file, however, is a report from NowSecure from February 2025 on the flaws in the iOS application. No evidence of malicious code in a specific model is provided.
If the USA bans DeepSeek, it leaves a door. Agencies that cannot do without it have 60 days to request an exception from CISA. Additionally, DHS will review the order annually.
The sentence that worries you is in a footnote. The removal extends to “third-party implementations of DeepSeek used to provide products and services to civilian agencies.” However, DeepSeek weights are open sourced under the MIT license. Thus, the V4 Pro version of August 2026 has 1,600 billion parameters. The V4.1-Flash update was released on Sunday.
These models have been running at Amazon Bedrock and Microsoft Azure since 2025. Perplexity even produced a “de-censored” version. Additionally, gateways like OpenRouter or Vercel AI Gateway route requests to “the best available provider.” This can therefore be DeepSeek without the agency knowing it. Microsoft also plans to run V4 Flash locally in Windows.
Katie Moussouris, founder of Luta Security, poses the problem to The Register. “Banning the DeepSeek app and API is feasible. The problem is the ban on third-party products and services developed using DeepSeek implementations. According to her, the order "does not say what 'developed from' means." Therefore, “every publisher should attest that nothing they rely on has ever touched DeepSeek. There is no practical way to verify this.”
She adds that a model hosted in the United States avoids “most” of the risks listed. But the USA bans DeepSeek even in third-party software. The order does not provide any exemption for self-accommodation. Federal software publishers will therefore have to choose between an impossible audit and a change of model.
Beijing responded Tuesday with the voice of Mao Ning. The spokesperson denounces “the excessive generalization of national security”. She also promises to “firmly defend the legitimate rights and interests of Chinese companies”. DeepSeek did not respond. The Information reports, however, that the company is now co-designing Huawei's Ascend 960DT chip. It is expected in the first quarter of 2027.
