EL7.AI
GeopoliticsMediumUpdated×4•Originally published 19 October 2026•Updated 20 October 2026•
4 min read

Washington bars DeepSeek from civilian agency procurement, allows 60 days to seek exemptions

US Capitol building behind a prohibited Docker logo, a stack of government documents, and a 60-day calendar.

Key Facts

1The order allows exemption requests to be submitted in writing within 60 days of its issuance.
2The safest DeepSeek model tested complied with 94% of malicious requests when a method to bypass safety controls was used.
3The U.S. assessment found DeepSeek was cheaper than the comparison model in 5 out of 7 benchmark tests.
4The removal requirement covers third-party products and services developed using DeepSeek technologies.

The U.S. Department of Homeland Security ordered the exclusion of DeepSeek information technology products and services from federal civilian agency procurement, according to a notice filed for public inspection on 19 October 2026. The exclusion also covers products and services developed by the company's affiliates, according to the department's official Federal Register notice. The order addresses the removal of covered products from civilian government information technology systems, alongside a ban on their purchase through procurement covered by the order. The removal requirement extends to third-party products and services developed using DeepSeek technologies, bringing tools offered by other vendors within the scope of the U.S. measures. The order thus covers both the company and its affiliates, as well as products that rely on its technologies within civilian government systems.

Against the backdrop of security concerns, the Center for AI Standards and Innovation at the U.S. National Institute of Standards and Technology published an assessment in September 2025 examining the DeepSeek models it tested. It found that agents built on the safest of those models were, on average, 12 times more likely to follow task-hijacking instructions than the advanced U.S. models tested. In a test using a common method to bypass safety controls, the safest DeepSeek model tested complied with 94% of explicitly malicious requests. The corresponding rate for the U.S. reference models was 8% in the same safety-bypass comparison, according to the center's findings. The task-hijacking comparison concerned the behavior of agents built on the models, while the malicious-request comparison examined the models' responses when a method to bypass safety controls was used.

In a more recent assessment conducted in April 2026 and published in May, the U.S. center estimated that the capabilities of DeepSeek's "V4 Pro" model lagged the frontier by about 8 months. On cost, it found that DeepSeek "V4" was cheaper than "GPT 5.4 Mini" in 5 out of 7 benchmark tests. Concerns about AI industry spending had come to the fore in markets as DeepSeek models spread in January 2025. In the 27 January 2025 session, Nvidia shares fell about 17%, according to Investing's coverage, in a historic move that preceded the current U.S. procurement order. The decline wiped $589 billion off the company's market value amid concerns raised by DeepSeek's models about spending on AI infrastructure.

On the handling of personal information, DeepSeek's privacy policy states that the company collects user data directly and processes and stores it in the People's Republic of China. The company says in the policy: "We collect, process and store your personal data directly in the People's Republic of China." In a provision concerning the use of information to develop its services, the policy includes users' right to opt out of having their personal data used to train models. That right also covers opting out of the use of data to improve technologies, according to the wording of the company's policy. The availability of this right depends on the user's place of residence and applicable law, under the terms DeepSeek sets out in the same policy.

The U.S. action was preceded by regulatory steps in other markets, with the Australian government publishing its direction on DeepSeek products, applications and web services on 4 February 2025. The Australian direction was included under the government's Protective Security Policy Framework, according to the official directives page. In Italy, Reuters reported in coverage published on 30 January 2025 that the data protection authority had ordered DeepSeek to block its chatbot in the country. The agency quoted a member of the authority's board as saying the company had argued it should not be subject to local regulation. Describing DeepSeek's position, the member said it considered that it "should not be subject to local regulation," in a dispute with the Italian data protection authority.

On U.S. implementation, the order states that DeepSeek's exclusion from procurement takes effect upon issuance, according to the Department of Homeland Security's official text. The order allows executive agencies to submit requests for exemptions from its provisions under the implementation procedures it sets out. Those requests must be submitted in writing within 60 days of the order's issuance, which starts the clock. The exemption request period does not run from the date the notice is published in the Federal Register, according to the order's provision on when the period begins. The notice filed for public inspection listed 20 October 2026 as its scheduled Federal Register publication date.