Technology, Federal Cybersecurity & China
Federal Agencies Ordered to Remove DeepSeek Products From Civilian Systems
The Homeland Security directive covers DeepSeek products and third-party services built with the Chinese AI model, citing risks to sensitive government data.
A government-wide removal directive
The Department of Homeland Security is directing U.S. civilian agencies to remove DeepSeek products and third-party services using the Chinese artificial-intelligence model from federal information systems, Reuters reported Monday. The notice also bars future acquisition of covered products and services. The directive focuses on civilian agencies rather than every national-security network, which may operate under separate rules. Agencies will need to identify both direct installations and less visible vendor dependencies.
Data transfer is the stated concern
DHS said DeepSeek models present multiple threat vectors and could result in sensitive information being transferred to the People’s Republic of China when used by government employees or contractors. AI services can receive prompts, uploaded documents, logs and metadata. A security review therefore must examine where data is processed, retained and accessible. The risk is not limited to classified material; procurement, personnel and internal operational information may also require protection.
Third-party use complicates compliance
A software product may incorporate an outside model without displaying its name to the end user. Agencies will have to question vendors, review software bills of materials and examine contracts rather than rely only on application inventories. Contractors should disclose model providers and changes in their technical stack. A broad prohibition that is not paired with clear definitions could either miss embedded uses or cause agencies to remove unrelated products unnecessarily.
Removal must preserve federal operations
Some offices may have adopted AI tools for translation, research, coding or document review. Abrupt removal can interrupt workflows, so agencies need approved alternatives and a method for preserving records without carrying risk into replacement systems. Security teams should revoke access tokens, inspect integrations and confirm that stored data is handled according to contract and law. Simply deleting a visible application may not eliminate accounts, cached material or vendor-held information.
Procurement policy is becoming technology policy
The federal government is a major buyer, and exclusion from its systems can influence private-sector assessments and vendor behavior. That leverage should be applied through documented criteria that other suppliers can understand. Country of origin may be one factor, but agencies also need standards for security testing, incident reporting, data localization and model updates. Consistent requirements can reduce the risk of substituting one opaque service for another.
The implementation questions
The notice’s deadlines, definitions and waiver process will determine how quickly the order changes federal systems. Congress can ask agencies to report affected products, replacement costs and any evidence of prior data exposure. Public reporting should avoid revealing exploitable details while showing whether compliance is complete. The broader lesson is that AI inventory is now a basic cybersecurity control: agencies cannot manage model risk if they do not know which systems and vendors are using which models. Independent testing and vendor attestations should be checked against actual network activity rather than accepted as complete proof of compliance.
Reporting note: This article draws on public records and verified reporting; material claims are attributed in the text.