Why It Matters
Federal civilian agencies must exclude DeepSeek products from information technology procurements and remove covered products already deployed on their systems under a Department of Homeland Security (DHS) exclusion and removal order issued under the Federal Acquisition Supply Chain Security Act of 2018.
According to a new Congressional Research Service (CRS) report, the directive marks DHS' first use of this authority and extends to covered federal procurement contracts and subcontractors. Agencies may seek exceptions through the Cybersecurity and Infrastructure Security Agency (CISA).
The DHS order follows similar actions by the Department of Defense (DOD) and the director of national intelligence, marking a coordinated federal effort to restrict Chinese artificial intelligence products over cybersecurity and supply chain concerns. The DOD order, issued Sept. 8 under the "Department of War" designation authorized by Executive Order 14347, was required by the National Defense Authorization Act for Fiscal Year 2026.
The Big Picture
The first exclusion and removal orders under the Federal Acquisition Supply Chain Security Act were issued by the director of national intelligence and DOD targeting Acronis, a cybersecurity company, before DHS exercised the authority for the first time against DeepSeek. The Department of the Air Force had previously issued its own DeepSeek exclusion and removal order on July 10, 2025, preceding the DHS civilian order published Oct. 20.
CISA, the National Security Agency, and the FBI published Joint Cybersecurity Advisory AA26-251A on Sept. 8, identifying DeepSeek among six Chinese AI models allegedly involved in large-scale distillation campaigns targeting U.S. frontier AI models.
The National Institute of Standards and Technology's Center for AI Standards and Innovation found in a September 2025 evaluation that DeepSeek models were more susceptible to jailbreaking and malicious instructions than the U.S. models tested. Its most secure DeepSeek model complied with 94% of malicious requests using a common jailbreaking technique, compared with 8% for the U.S. reference models. The evaluation also found that DeepSeek models repeated inaccurate or misleading Chinese Communist Party narratives four times as often as the U.S. models tested.
The DHS order cites cybersecurity risks associated with DeepSeek's operations in China, including potential government access to sensitive information, collection of personally identifiable information during account registration, retention of user inputs and outputs, and configurations DHS describes as insecure. The order identifies Chinese legal requirements that DHS says could compel the company to provide information to government authorities.
The Federal Acquisition Security Council framework restricts federal procurement and information systems but does not directly prohibit nongovernmental use of DeepSeek. Congress may consider whether restrictions affecting federal contractors could discourage broader private-sector adoption, as federal restrictions on telecommunications equipment produced by Huawei Technologies and ZTE did.
The Bottom Line
The DHS order calls for a review within one year and annually thereafter. Congress may ask the Government Accountability Office (GAO) or agency inspectors general to evaluate how the Federal Acquisition Security Council (FASC) implemented the restrictions, including its procedures for identifying supply chain risks, coordinating across agencies, and enforcing exclusion and removal orders.
Whether to extend restrictions beyond federal systems to broader civilian use of Chinese artificial intelligence tools, or to scrutinize additional Chinese AI companies, remains an open policy question. The FASC framework does not independently authorize a nationwide prohibition on private-sector access to DeepSeek.
Access the Legis1 platform for comprehensive political news, data, and insights
Spot something wrong? Report an issue with this article
