The US Department of Homeland Security has ordered federal civilian agencies to stop using DeepSeek and remove it, including from third-party tools built with the Chinese lab’s technology. That supply-chain clause is the part UK suppliers and security teams should study, because it treats AI model origin as a procurement risk.
What happened
On Monday 19 October 2026 the US Department of Homeland Security (DHS) published notice of an order excluding Hangzhou DeepSeek Artificial Intelligence Co. and affiliated companies from federal civilian agency contracts. The same order tells agencies to strip out any DeepSeek products already in use. Homeland Security Secretary Markwayne Mullin signed it under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), the law that lets the DHS secretary bar risky technology from civilian systems. According to The Hill, the order was first issued in July and only reached the Federal Register this week.
The scope goes well beyond the DeepSeek chatbot. The order covers “all DeepSeek and DeepSeek-affiliate products”, and also third-party products and services “developed using DeepSeek implementations”. BankInfoSecurity reports that agencies have 60 days from issuance to seek exceptions, with the Cybersecurity and Infrastructure Security Agency (CISA) deciding each request in writing. Under the 2018 Act, DeepSeek has 60 days from notice to challenge the order in the US Court of Appeals for the District of Columbia Circuit.
In early 2025 the Defense Information Systems Agency began blocking DeepSeek on Pentagon networks, and the Navy, NASA and the House of Representatives took similar steps. Several US states, along with Australia, South Korea and Taiwan, keep it off government devices.
The technical picture
DHS says the models present “multiple threat vectors”. Its stated concerns fall into three groups. The first is data flow: prompts and responses sent to DeepSeek’s services could move sensitive government or vendor data to China, where DHS says state cyber and intelligence services can access privately held infrastructure. The second is collection: according to The Hill’s reading of the order, the models can harvest personal data and may “track or digitally fingerprint” the people using them. The third is the model itself, which DHS warns could harbour malware or exploitable flaws. The order also tells agencies to monitor traffic for signs of exfiltration and strengthen their logging.
The hard part is the third-party clause. The order does not define “developed using”. It could mean products that call DeepSeek models through an API, products built on its open-weight models, or simply software whose developers used DeepSeek to help write code. AI gateways make this harder. Gateways including OpenRouter and Vercel AI Gateway route each request to whichever provider they judge best by default, so an organisation can end up sending traffic to a DeepSeek model without choosing to.
Katie Moussouris, founder of Luta Security, told The Register that keeping DeepSeek’s own app and API out is achievable, but the downstream clause is not. In her view, an AI software bill of materials does not record which tools developers used, so vendors would have to attest to something that cannot be checked. She also argued that the risks cited are mostly about data reaching servers in China, which US-hosted copies of the models largely avoid. On the model itself, she noted that NIST found DeepSeek more prone to prompt injection and easier to jailbreak than US models.
Why it matters for UK organisations
The order binds US agencies directly, but it reaches further. BankInfoSecurity notes that the Federal Acquisition Security Council’s implementing rule allows exclusion and removal orders to extend to primes and subcontractors working for federal agencies. A 2023 update to the Federal Acquisition Regulation requires contractors to comply. UK defence, technology and professional services firms that sit anywhere in a US federal supply chain should expect questions from their customers about whether their products touch DeepSeek.
Even without a US contract, the order is a template that buyers elsewhere tend to copy. UK public bodies and regulated firms already ask suppliers about hosting location, sub-processors and data transfers. Model provenance is the natural next question on those questionnaires. Organisations that cannot answer it about their own estate will struggle when it arrives.
There is also a plain data protection point. Staff pasting customer records, source code or contract terms into any externally hosted chatbot raises UK GDPR international transfer questions, wherever the provider is based. DeepSeek is simply the case where the destination and its legal environment are most clearly flagged as a risk by a major government.
Expert view
I think the order is right in substance and clumsy in drafting. Blocking a foreign-hosted AI service from sensitive networks is a normal, defensible control. We would recommend the same for any SaaS that takes data offshore without adequate assurances. The trouble starts when model origin is treated as if it were the same risk as data destination. Open weights running on infrastructure you control raise different questions: training data, embedded behaviour, susceptibility to manipulation. Those are real, but they call for testing and monitoring, not a provenance attestation nobody can verify.
When we assess AI deployments, the most common gap is not a rogue Chinese model. It is that nobody can say which models are being called, by which applications, through which gateways. The DHS order will expose that blind spot in US agencies. UK organisations have the same blind spot and nothing forcing them to look.
The second lesson is that AI risk now has a supply chain, and it behaves like any other software supply chain. Prompt injection and jailbreak weaknesses vary between models. Treating model choice as a security decision, with an owner and a record, is overdue.
What to do now
- Inventory AI use. List every model, API key and gateway your applications and staff use, including browser extensions and developer tools. This extends the asset management that underpins Cyber Essentials.
- Pin gateway routing. If you use OpenRouter, Vercel AI Gateway or similar, restrict providers and models explicitly rather than accepting default routing.
- Control egress. Use firewall and secure web gateway rules (the Cyber Essentials boundary firewall control) to block unapproved AI endpoints, and log what remains, in line with the DHS advice.
- Govern installation. Apply application allow-listing and secure configuration so staff cannot add unvetted AI apps or plugins to managed devices.
- Update supplier due diligence. Ask suppliers which models and AI providers their products depend on, where inference runs and how routing is controlled.
- If you sell into US government, prepare a written position on DeepSeek exposure across your products now, before a prime contractor asks.
- Test the models you keep. Include prompt injection and jailbreak testing in assessments of AI features, whichever lab built the model.
Bottom line
The DHS order turns a long-running set of agency bans into a supply-chain rule, and its vague third-party clause will be argued over for months. For UK organisations the message is simpler. If you cannot say which AI models your systems talk to, you cannot answer the question this order poses, and customers and regulators will soon start asking it.
