US Homeland Security bans DeepSeek tools across federal civilian agencies

The United States Department of Homeland Security has published an official directive ordering federal civilian agencies to halt purchases of artificial intelligence software from Chinese firm DeepSeek and remove existing installations from their systems.

Published in the Federal Register on 20 October 2026, the order applies across civilian executive branch bodies. It covers direct DeepSeek applications along with third-party software and digital services built on top of DeepSeek models. Under the rules, agencies must purge the tools from their IT environments and clear them from approved vendor lists.

Data transfer and software risks

The notice states that the company operates servers in mainland China, where local laws give security authorities broad scope to inspect private computing systems and corporate records. Department officials noted that interactive prompts and business queries sent through these tools could expose operational data to outside interception.

The directive also flagged flaws identified during technical reviews of DeepSeek mobile software, including user tracking risks and system vulnerabilities. Agencies have 60 days to request specific exemptions through the Cybersecurity and Infrastructure Security Agency if an application is required for essential functions. Otherwise, systems must be replaced while staff enforce tighter network monitoring on outbound connections.

The decision follows similar steps taken previously by individual defence and intelligence bodies, but expands those curbs across more than 100 federal agencies. Australia took comparable steps regarding government devices in early 2025.

What this means for Australian businesses

For small and medium enterprises in Australia, this development is a practical reason to check where your business data travels when using automated tools.

• Check your software stack, because many affordable customer service and writing tools integrate third-party models in the background. Check which providers power your external apps and where their processing servers operate.
• Keep business secrets out of consumer chatbots, as staff members often copy customer databases, financial figures or contract drafts into free online assistants without knowing that prompts may sit on overseas servers.
• Review contracts if you supply government or American partners, since businesses that sell software or consulting services into US supply chains or public agencies may soon face stricter vendor questionnaires regarding embedded code and underlying AI models.
• Establish clear workplace rules by giving staff a simple list of approved platforms, maintaining basic data hygiene, and avoiding tools that collect device fingerprints or lack transparent data retention policies.