US Federal Agencies Scramble to Purge DeepSeek-Dependent Software in 60-Day Compliance Sprint

Federal procurement officers across civilian agencies face a 60-day deadline to identify and justify every piece of software that runs on DeepSeek models, a scramble triggered by a Department of Homeland Security directive issued in late July and published in the Federal Register on October 19. The order, grounded in the Federal Acquisition Supply Chain Security Act of 2018, bars not only DeepSeek’s own chatbot but any third-party product built atop its implementations — a reach that extends well beyond the Chinese startup itself.

DHS cited the location of DeepSeek’s servers in China and the risk that Chinese authorities could access sensitive US information, labeling the models as presenting “multiple threat vectors.” The department also pointed to publicly available research documenting critical vulnerabilities in DeepSeek’s iOS app, including potential malware pathways. Agencies must now submit written justifications to DHS for any exception, including requests for additional compliance time.

The directive’s breadth catches US vendors that embedded DeepSeek’s open-weight models into analytics dashboards, coding assistants, and document-processing tools sold to the government. Unlike a simple blocklist, the order forces a supply-chain audit: contractors must disclose whether their stack relies on DeepSeek weights, fine-tunes, or API calls. Several industry executives, speaking on background, described the review as “a forensic exercise” that could delay contract renewals and stall pilot programs already underway.

Chinese Foreign Ministry spokesperson Mao Ning denounced the move Tuesday, accusing Washington of stretching national-security arguments to politicize technology and trade, and vowing to “resolutely safeguard the legitimate rights and interests of Chinese companies.” DeepSeek did not respond to a request for comment from The Associated Press.

The order echoes earlier restrictions. In January 2025, the US Navy warned personnel against using DeepSeek, though it later clarified the notice reflected existing policy on publicly accessible generative AI — a policy that also covered ChatGPT. The House of Representatives banned Microsoft Copilot in April 2024 over data-sovereignty concerns, then reversed course in September 2025 after negotiating additional legal and technical safeguards. Anthropic has faced similar scrutiny over its cloud architecture.

No nationwide consumer ban exists. But for the ecosystem of US integrators and resellers that built federal solutions on DeepSeek’s open models, the directive amounts to a mandated re-architecture — one that must be justified, documented, and approved within two months.