Full Report
Order disallowing use of Chinese AI service is unhelpfully vague and broad
Analysis Summary
# Regulation/Compliance: DHS Order Prohibiting DeepSeek Products at Federal Civilian Agencies
## Overview
The U.S. Department of Homeland Security (DHS) issued an order directing federal civilian agencies not to use technology products from the Chinese AI lab DeepSeek and to remove any existing implementations. The order also covers "DeepSeek-affiliate products" and "third-party products and services developed using DeepSeek implementations." The article describes the order as broad and vague. It does not define key terms, and it does not address how agencies should handle AI gateway services that may route requests to DeepSeek models. The full PDF was not provided, so the summary relies on the article's description of it.
## Key Details
- **Issuing Authority:** U.S. Department of Homeland Security (DHS)
- **Effective Date:** Not specified in the article. Issued on a Monday shortly before the article's publication date of October 20, 2026. The instruction to "remove any existing implementations" suggests immediate effect, but this should be confirmed against the order.
- **Jurisdiction:** U.S. federal civilian agencies
- **Status:** In Effect (issued; formal effective terms should be verified in the order itself)
## Requirements
### Mandatory Requirements
1. Do not use DeepSeek products or DeepSeek-affiliate products at federal civilian agencies.
2. Remove any existing DeepSeek implementations.
3. Do not use third-party products or services "developed using DeepSeek implementations." The article notes this term is undefined and could mean:
- Ongoing API access to DeepSeek models, or
- Any software whose developers used DeepSeek tools (e.g., for coding or testing).
4. Identify and remove any unintentional DeepSeek model usage, including through AI gateway services (e.g., OpenRouter, Vercel AI Gateway) that may route requests to DeepSeek as a provider.
### Recommended Practices
1. Request written clarification from DHS on the scope of "developed using," including whether it covers API consumption, vendor development tools, and derived models.
2. Obtain vendor attestations about DeepSeek dependencies, recognizing that verification may be difficult.
3. Configure AI gateway provider routing to exclude DeepSeek endpoints.
4. Consult agency legal counsel on whether US-hosted DeepSeek models fall within scope.
5. Track the order for amendments or implementing guidance.
## Affected Organizations
- **Industries:** Federal civilian agencies directly. Contractors and vendors whose products rely on DeepSeek models may be indirectly affected, depending on the final scope.
- **Organization Size:** Not addressed in the article.
- **Geographic Scope:** United States (federal civilian government)
## Compliance Timeline
- **Earlier in 2025:** DISA, the U.S. Navy, NASA, and the U.S. House of Representatives restricted DeepSeek use. (Background, not part of this order.)
- **Order issuance (Monday before October 20, 2026):** DHS order issued.
- **Final deadline:** Not specified. Removal of existing implementations appears to be required, but no date is given.
## Implementation Guidance
### Assessment Phase
- Inventory all uses of DeepSeek, including direct app use, API integrations, and models accessed through gateways or aggregators.
- Identify third-party software and services that may depend on DeepSeek, and review vendor disclosures.
- Review AI gateway and routing configurations to determine whether DeepSeek could be selected automatically.
- Assess whether developers have used DeepSeek tools in code development or testing.
### Implementation Phase
- Block DeepSeek domains, apps, and API endpoints on agency networks and devices.
- Remove DeepSeek implementations and reconfigure affected applications.
- Set AI gateway provider allowlists or denylists to exclude DeepSeek.
- Update procurement requirements and contract language to require disclosure of DeepSeek dependencies.
- Document decisions and interpretations of ambiguous terms.
### Validation Phase
- Verify blocks through network logs and endpoint monitoring.
- Audit gateway routing logs to confirm DeepSeek models are not being selected.
- Obtain and retain vendor attestations.
- Maintain records of the assessment, remediation, and any DHS clarifications for audit purposes.
## Technical Requirements
The article does not specify technical controls. Practical measures implied by the order include:
- Network-level blocking of DeepSeek domains and API endpoints
- Removal of the DeepSeek mobile app from managed devices
- Provider-level exclusion settings in AI gateways
- Software bill of materials (SBOM) or AI bill of materials (AIBOM) tracking, though critics note these may not record developer tool usage
## Penalties & Enforcement
- **Fines:** Not specified in the article.
- **Other Consequences:** Not specified. Contractual and procurement consequences are possible but unconfirmed.
- **Enforcement:** Not described in the article.
## Related Standards
- **NIST CAISI evaluation of DeepSeek models (2025):** Found DeepSeek more vulnerable to prompt injection and easier to jailbreak than U.S. models. The article notes that these weaknesses are not unique to DeepSeek.
- **Software and AI bills of materials (SBOM/AIBOM):** Referenced as a possible compliance mechanism, with the caveat that they may not capture developer tool use.
- **Mobile application security practices (e.g., SSL pinning, plaintext data handling):** Relevant to the DeepSeek mobile app concerns raised in a December 2025 report.
## Resources
- **Official Documentation:** Order PDF (linked in the original article; not provided here). Verify the link on dhs.gov or through official channels.
- **Guidance Documents:**
- NIST CAISI evaluation of DeepSeek AI models: hxxps://www[.]nist[.]gov/document/caisi-evaluation-deepseek-ai-models-report
- NIST news release on the evaluation: hxxps://www[.]nist[.]gov/news-events/news/2025/09/caisi-evaluation-deepseek-ai-models-finds-shortcomings-and-risks
- No DeepSeek on Government Devices Act (introduced February 6, 2025, did not pass committee): hxxps://lahood[.]house[.]gov/2025/2/lahood-gottheimer-introduce-legislation-to-counter-ccp-s-deepseek-ai-software
- **Tools:** Gateway provider-selection documentation (OpenRouter, Vercel AI Gateway) for configuring routing restrictions.
## Practical Recommendations
- Immediately inventory DeepSeek exposure, including indirect exposure through AI gateways and third-party tools.
- Block DeepSeek apps, APIs, and domains on agency systems.
- Configure AI gateways to exclude DeepSeek as a provider.
- Request formal DHS guidance on "developed using," US-hosted models, and AI-assisted development.
- Require vendors to disclose DeepSeek dependencies in writing, and document the limits of what they can verify.
- Review the full order text to confirm deadlines, penalties, and reporting requirements, since the article does not provide them.