DHS orders DeepSeek out of federal systems. Inventory your models.

The DHS DeepSeek ban is now public. The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products from their IT systems and to stop buying them. The notice goes into the Federal Register on October 20. If you sell software to government, the question is no longer "do we use the DeepSeek app?" It is "which model is inside each feature we ship?"

What actually happened

Per CyberScoop and Engadget, the order uses the Federal Acquisition Supply Chain Security Act of 2018 and follows a review by the Federal Acquisition Security Council. It bars civilian agencies from buying IT products and services from Hangzhou DeepSeek Artificial Intelligence, and it tells them to remove what is already installed. Engadget reports that the notice also bars DeepSeek from federal contracts.

DHS gave three reasons: possible transfer of sensitive data to the PRC, data that "could produce actionable intelligence on U.S. persons," and the risk of malware or vulnerabilities in the models. CyberScoop reports that agencies can ask for exceptions only with a "compelling justification," such as a mission-critical function they cannot otherwise do.

The scope is the part to watch. Decrypt reports that the order reaches third-party services built on DeepSeek models, not only DeepSeek's own app. We have not read the final Federal Register text yet, so treat that as reported, not confirmed. The order does not ban private-sector use, and it does not cover national security systems.

The timing is awkward for DeepSeek. Two days earlier it shipped V4.1-Flash-1017 under an MIT license, with new Search and Fetch APIs.

Why the DHS DeepSeek ban matters for your business

Most small software shops do not call DeepSeek directly. They call a router, a framework default or a vendor's "AI feature" — and do not know which model answers. That is exactly the gap this order exposes.

If you sell to federal agencies, or to a prime contractor that does:

1. Build a model inventory. For each AI feature: provider, model ID, where it is hosted, and who chose it. Include fallbacks in your router config. A fallback to a DeepSeek model counts.
2. Ask your vendors the same question. Put "which models do you use, and can we exclude some?" into your next renewal.
3. Make the model a config value, not a code change. If a buyer says "no DeepSeek," you should be able to swap in an hour, then re-run your evals.

Open weights do not make this simpler. A self-hosted DeepSeek model has no data path to China, but a procurement officer may still ask. Have the answer in writing before they do.

Sources: CyberScoop, Engadget, Decrypt.