US orders agencies to remove DeepSeek over China data concerns

The directive, issued in a notice on Monday, requires agencies to remove DeepSeek’s technology from their IT systems. The order also prevents them from acquiring DeepSeek products and services, as well as third-party offerings built using the Chinese company’s AI models.

However, the restrictions do not cover national security systems or secure compartmented information systems, including systems operated by the Department of Defense and the intelligence community.

Why is the US targeting DeepSeek?

The DHS said DeepSeek’s AI models presented "multiple threat vectors.” According to the department, their use "may result in the transfer of sensitive data” to China when accessed by US government employees or vendors.

The DHS pointed to the location of DeepSeek’s servers in the People's Republic of China and said Chinese laws allow government cyber and intelligence authorities extensive access to private company infrastructure.

The department also raised concerns about DeepSeek’s account registration process, saying it collected personally identifiable information and could track and digitally fingerprint users.

The DHS warned that transferring such information to China, either independently or together with publicly available information, "could produce actionable intelligence on US individual and/or government programmes." It added, "The models themselves may contain malware or other security vulnerabilities."

Under the new directive, agencies must remove DeepSeek products, services from its affiliates and third-party offerings developed with its technology. The products must also be excluded from approved product lists, service-provider equipment lists, e-commerce marketplaces and other procurement channels.

Agencies can seek a written exemption within 60 days if they can demonstrate compelling reasons, including potential effects on mission-critical operations or national security.

Until DeepSeek products are completely removed, agencies have been advised to monitor network traffic, improve logging and strengthen controls designed to prevent unauthorised data transfers.

The latest move follows earlier restrictions. The US Department of Commerce and US Navy have previously prohibited DeepSeek on government devices, while New York, Tennessee and Virginia have taken similar measures.

DeepSeek became widely popular after its public release in 2025, with its relatively inexpensive open-source models gaining attention for capabilities comparable to some more costly US alternatives. Companies such as Snowflake, Vercel and OpenRouter have incorporated DeepSeek into services offered to customers.

The directive comes as the Trump administration continues its broader scrutiny of Chinese technology. US AI companies, including Anthropic and OpenAI, have also accused Chinese AI developers of using model distillation to reproduce capabilities from larger systems.

Distillation involves using the outputs and reasoning of a larger AI model to help train a smaller one, adding another layer to the growing technology rivalry between the US and China.