Full US Ban on DeepSeek: Federal Agencies and Third-Party Services Covered

China-based DeepSeek, which has shifted the balance of the global AI race with its low-cost, high-performance large language models (LLMs), is facing the toughest regulatory move from Washington so far. The US Department of Homeland Security (DHS) has issued a binding directive ordering the complete removal of DeepSeek products from the information technology systems of federal civilian agencies and a halt to new procurement.

This decision covers not only direct app or API use but also third-party commercial software that runs DeepSeek architectures in the background. With it, a new era has begun for the future of open-weight AI models in enterprise supply chains.

The Scope and Legal Basis of the Ban

The directive, made official through the Federal Register, took effect under the 2018 Federal Acquisition Supply Chain Security Act (FASCSA). Prepared as a result of comprehensive risk assessments by the Federal Acquisition Security Council (FASC), the recommendation directly binds all departments and agencies under the civilian executive branch.

The technical and administrative boundaries of the decision consist of these core points:

• Direct product and service ban: All software, web interfaces, mobile apps and API services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates will be fully removed from federal networks.
• Third-party integration restriction: Software vendors serving government agencies will not be able to sell their products to those agencies if the products contain DeepSeek models (for example fine-tuned V3 or R1 derivatives) inside them or in their underlying layers.
• Procurement and contract renewal block: DeepSeek components found in existing systems will be disabled within the set compliance timeline, and no federal budget line can be used to license these technologies.

While the directive covers all civilian federal agencies such as the Departments of State, Treasury and Justice, the Department of Defense (Pentagon) and the intelligence community were left outside the scope of this civilian directive because they are subject to their own independent and stricter national security protocols. As is known, the Pentagon and many military units had already blocked DeepSeek access on their own networks at a much earlier stage.

Cybersecurity and Data Sovereignty Concerns

Behind US security officials adding DeepSeek to the supply chain blacklist are critical findings about both data privacy and cybersecurity architecture. The main risk factors highlighted in the assessment reports are:

1. Data Transfer and Mandatory Legal Access

It was stressed that DeepSeek's cloud-based services send user prompts, uploaded documents, device telemetry data and digital fingerprinting information to servers located in China. Under China's current National Intelligence Law and data security legislation, companies operating in the country are obliged to share this data with the Beijing government on request, which Washington classifies directly as a national security threat.

2. Model Security and Cyber Vulnerabilities

Security reviews pointed out that the models' resistance to generating malicious code or to jailbreaks is below industry standards. In addition, the difficulty of verifying model weights or software packages against malware and backdoor risks at the supply chain level led to a full ban in order to protect civilian public infrastructure.

A Critical Threshold Crossed for Third-Party Software and Open-Weight Models

The most striking aspect of this decision for the tech world is that third-party services are also covered by the ban. With its open-weight models, DeepSeek had become very popular, especially among startups and enterprise software developers. Many SaaS (Software as a Service) companies offered AI features to their customers by hosting DeepSeek models on their own servers or with cloud providers because of the cost advantage.

With the new directive, a strict "AI Bill of Materials" (AI-BOM) audit becomes mandatory for tech companies and system integrators working with US government agencies:

• A software company bidding in a public tender will have to document not only that its product does not connect directly to Chinese servers, but also that the foundation model it runs locally is not based on DeepSeek.
• Derivative models built on DeepSeek weights in open-source communities (fine-tuned or distilled) are expected to be flagged red in enterprise compliance processes.

A Global Wave of Regulation and Industry Impact

Rather than being an isolated decision, this US step forms the most comprehensive link in a widening wave of regulation across the Western bloc. Countries such as Australia, the Netherlands, South Korea, Italy and Taiwan had earlier placed various restrictions on DeepSeek use on government devices, citing data security and espionage risks.

But Washington's use of the FASCSA law to target the lower layers of the supply chain and third-party integrations shows that the sanctions mechanism seen in the past with Huawei and Kaspersky will now be applied directly to AI models as well.

In the coming period, companies building enterprise software will need to prioritize not only performance and token cost but also the model's origin and supply chain compliance when choosing model architectures, so they do not run into regulatory barriers in global markets.