Direct answer:
The US has formally banned DeepSeek from federal government systems. The Department of Homeland Security ordered civilian agencies to strip out DeepSeek products — and any third-party tool built on its models — from their IT systems, warning that sensitive data could end up accessible to Beijing and that the models themselves may contain malware. (Sources: Reuters, SCMP)
What happened
A notice published in the Federal Register on Monday, October 19, made public what the US government had already been doing quietly: removing DeepSeek from its systems. The Department of Homeland Security told federal civilian agencies — think Treasury, State and Justice — to delete DeepSeek products and any third-party services developed with DeepSeek’s models from their information systems, and barred them from buying more.
The order, signed by the Homeland Security Secretary on July 24, rests on the 2018 Federal Acquisition Supply Chain Security Act and a review by the Federal Acquisition Security Council. DHS said the models pose “multiple threat vectors”: data stored on servers in China where the government can demand access, the risk that using the product “may result in the transfer of sensitive data” to China if used by government employees or vendors, and the possibility that the models “may contain malware or other security vulnerabilities”. Agencies were also told to start monitoring traffic flowing in and out of government websites for DeepSeek-related risks.
This wasn’t out of the blue. The Commerce Department and the US Navy had already banned DeepSeek on government devices, and states including New York, Tennessee and Virginia took similar steps. In April 2025, the House Select Committee on China published a report calling DeepSeek a “profound threat to our nation’s security”, and lawmakers introduced the “No Adversarial AI Act” aimed at restricting federal use of China-linked AI tools. The move comes days after DeepSeek released its upgraded V4.1-Flash model — the same low-cost efficiency that won the startup millions of downloads is exactly what makes Washington nervous.
What it means for UK small businesses
No UK firm is legally bound by a US federal order, but the signal is loud enough to matter for anyone choosing AI tools:
Data residency is now a board-level question. When you paste client data into a chatbot, you should know whose servers it lands on and whose government can knock on that server’s door. This is especially true for regulated sectors — legal, finance, healthcare — where a client’s data ending up in another jurisdiction could be a compliance headache you don’t want. If your AI vendor can’t give you a straight answer on where data is stored, that’s an answer.
Cheap isn’t always cheap. DeepSeek’s whole pitch was frontier-level performance at a fraction of the cost. For a cash-conscious small business that’s tempting — but this ban is a reminder that the real price of an AI tool includes legal risk, procurement risk, and the cost of ripping it out later if circumstances change. Before building a process around any AI vendor, ask the awkward questions up front.
Review what’s already in the building. Many UK businesses adopted AI tools ad hoc — a free account here, a browser extension there — without any central record. Do a quick audit of which AI tools touch your business data, and apply the same suspicion to any of them whose data handling you can’t verify.
Honest limits / what to watch
A ban is a blunt instrument, and this one raises as many questions as it answers. DHS offered no public evidence that DeepSeek has actually exfiltrated data or shipped malware — the order is precautionary, built on what could happen under Chinese law rather than documented incidents. That’s a legitimate security posture for a government, but it’s not proof of wrongdoing.
There’s also a realpolitik dimension: the same week, the FCC moved to bar Chinese labs from certifying electronics for the US market and blocked imports of Chinese drones and consumer routers. The DeepSeek ban sits inside a much wider technology crackdown, and sceptics will read it as partly protectionist — keeping money flowing to American AI firms while hobbling a competitor that undercuts them on price.
For UK readers, the most useful takeaway isn’t “avoid Chinese AI” — it’s “know your supply chain”. The same diligence applies to any AI tool, from any country: where’s the data, who can see it, and what’s your exit plan? If you need help working that into a practical policy, our guide to AI security for growing firms covers the threat landscape.
FAQs
Why did the US ban DeepSeek from government systems?
The Department of Homeland Security said DeepSeek’s models pose “multiple threat vectors”, warning that data could be transferred to China and that the models themselves may contain malware or other vulnerabilities.
Which agencies are affected by the DeepSeek ban?
Federal civilian agencies such as the Treasury, State and Justice departments must remove DeepSeek products and are barred from buying them. Agencies within the Department of Defense are excluded from this order.
Does the ban cover third-party tools built on DeepSeek’s models?
Yes. The DHS order covers DeepSeek products and services plus third-party tools developed using its AI models, including products from affiliated entities.
Can agencies get an exception to the DeepSeek ban?
Yes — agencies can request exceptions 60 days in advance with what DHS calls a “compelling justification”. Exceptions are expected to be rare.
Does the DeepSeek ban affect UK businesses?
Not directly — it’s a US federal order. But it signals how seriously Western governments now treat data sovereignty for Chinese AI tools, which is worth factoring into your own AI procurement decisions.
When did the ban actually take effect?
The underlying order was signed by the Homeland Security Secretary on July 24, 2026; it was made public via a Federal Register notice on October 19, 2026.
