The U.S. just ordered DeepSeek out of federal agencies. What it means for your office

What happened

On Monday, Oct. 19, the Department of Homeland Security made public an order against DeepSeek, the Chinese AI company whose low-cost models drew wide attention in early 2025. The notice was published in the Federal Register on Oct. 20. According to the notice, the order does two things:

1. It excludes products and services from DeepSeek and its affiliates from federal civilian agency purchases.
2. It requires agencies to remove DeepSeek products, and third-party products and services developed using DeepSeek implementations, from civilian agency IT systems.

The order was issued under the Federal Acquisition Supply Chain Security Act of 2018, a law that lets the government shut out suppliers it considers a supply-chain risk. CNBC reports the order was originally issued on July 24 and only made public now. It covers civilian agencies such as the Treasury, State and Justice departments, but not the Department of Defense. CNBC says DHS cited concerns about possible transfers of sensitive U.S. government data to China and security weaknesses in DeepSeek's models. Agencies that needed more time could ask for an exception within 60 days of the order.

What it doesn't do

This is not a ban on private use. As VentureBeat's Carl Franzen put it, no federal rule bars a U.S. company from using DeepSeek with its private customers. The order stops short of putting DeepSeek on the Commerce Department's Entity List. If your business never touches government work, nothing here changes what you're allowed to do.

Defense work is a separate story. VentureBeat reports that a different law, Section 1532 of the 2026 defense authorization act, already bars contractors and subcontractors from using DeepSeek to perform defense contracts, with waivers only from the defense secretary. We didn't check that section against the law's text, so treat it as VentureBeat's reading and confirm it with your contracts person.

Why a 150-person company should care

A lot of mid-size manufacturers and distributors in Dallas-Fort Worth sell to the government without thinking of themselves as "government contractors." They ship parts to a prime contractor, supply an agency through a distributor, or hold a small federal contract on the side.

Federal contracts can carry a clause called FAR 52.204-30. Where it applies, it says contractors may not provide or use, in performing the contract, products covered by an applicable supply-chain order. It also tells contractors to check SAM.gov for these orders at least once every three months, and to report a covered product they find within 3 business days. The clause asks for a "reasonable inquiry," meaning a look at the information you already have. It says that doesn't require an internal or third-party audit.

Whether this particular order reaches your contract is a question for your contracting officer or your customer's contracts team. But the work it implies is the same either way: you need to know what's in your software.

The hard part isn't DeepSeek. It's that most companies can't say which AI models sit under their own tools.

The real issue: "built on" is hard to see

The phrase that matters most in the order is "third-party products and services developed using DeepSeek implementations." DeepSeek released some of its models openly, so anyone can download them and build on them. A chatbot plug-in, a document reader or a "smart" feature inside some other product could run on a DeepSeek model without the name appearing anywhere.

Running it on U.S. servers doesn't settle it. VentureBeat quotes trade lawyers at Sheppard Mullin saying procurement rules "follow the company that developed a model, not the data center." In other words, a DeepSeek model hosted in Virginia is still a DeepSeek model.

That's why the useful takeaway goes beyond DeepSeek. Most offices now have AI inside tools they didn't buy as AI: the email client, the CRM, the PDF reader, a browser extension someone installed. Few companies have a list of which models those tools use. If a customer, an insurer or a contracting officer asks, you want an answer that takes a day, not a month.

The other side

There are fair objections. VentureBeat notes that DHS cites no case of government data actually reaching DeepSeek; the order is about risk, not a known leak. China's foreign ministry, as reported by CNBC from Reuters, said China "consistently opposes the over-generalization of national security." And U.S. models have their own security problems. Swapping one vendor for another doesn't make a tool safe if it has too much access or nobody checks its work.

All true. But for a company that sells to the government, the order is the rule now, whatever anyone thinks of the reasoning. And knowing your vendors is good practice even if you never do.

What to do this month

1. Check your contracts. Search your federal contracts and purchase orders from prime contractors for FAR 52.204-30 or flow-down supply-chain language. If it's there, ask your contracting officer or customer whether this order applies.
2. Ask every software vendor one question: which AI models does your product use, from which company, and where do they run? Get the answer in writing. VentureBeat's checklist suggests the same, including fine-tuned and derived models.
3. Keep government work separate. If anything on your list runs on DeepSeek, keep it away from anything you deliver to, or do for, a federal customer.
4. Put a reminder on the calendar to check SAM.gov every three months if the clause is in your contracts.
5. Don't get locked in. When you build or buy AI tools, ask whether the model can be swapped without a rebuild. Rules like this one can change on short notice.

Our guide Is AI safe for customer and order data? has a longer list of vendor questions.