The Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove them from their systems. The order also reaches third-party products and services built using DeepSeek technology. It was published in the Federal Register on October 20.
The timing is awkward for a lot of American companies. Over the past several months, firms from startups to household names have been moving work to Chinese models because they cost a fraction of U.S. alternatives. Washington is now pulling the other way.
What the Order Does
The order was issued by the Secretary of Homeland Security under the Federal Acquisition Supply Chain Security Act of 2018, known as FASCSA, after a recommendation from the Federal Acquisition Security Council. The Federal Register notice is docketed as DHS-2026-0628.
It excludes IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates from federal civilian procurement. It also requires removal of all DeepSeek and DeepSeek-affiliate products, and of “third-party products and services developed using DeepSeek implementations,” from civilian agency IT systems.
According to BleepingComputer, agencies must immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces, and immediately remove them from IT systems or seek an exception. Exception requests are due within 60 days and must explain the justification and proposed risk mitigations. CISA reviews the requests, and agencies that cannot comply for capability reasons can get CISA technical help.
Reasons cited include concern that the Chinese government could access DeepSeek infrastructure, collect personal information, track users, and obtain sensitive government data. BleepingComputer also notes the order cites a February 2025 NowSecure report on the DeepSeek iOS app.
Homeland Security Secretary Markwayne Mullin warned that information processed through DeepSeek could help produce intelligence about U.S. individuals or government programs, per The Cyber Security Hub.
Those are the government’s stated risk assessments. The Hub is careful to note they are not public confirmation that every DeepSeek deployment contains malicious code or that any agency has been breached.
There is one documented infrastructure lapse: in January 2025, Wiz researchers disclosed an exposed DeepSeek database holding more than one million log entries, including chat history and secret keys, which DeepSeek secured promptly. That showed a real weakness. It did not establish Chinese government access.
It is not a general ban. BleepingComputer is explicit that the order is “not a general ban on private or consumer use.” It governs federal civilian agencies and their procurement. A December 2025 law had already restricted DeepSeek in intelligence agencies’ national security systems, per TechCrunch. China’s Foreign Ministry spokesperson, Mao Ning, said Beijing opposes overstretching national security and politicizing technology and trade.
Other governments and agencies acted first. The Hub notes that Australia’s Department of Home Affairs issued a mandatory DeepSeek direction in 2025 requiring government entities to block and remove it, and that Reuters earlier reported restrictions at the Commerce Department, the Navy, and several U.S. states.
The Phrase That Matters: “Built Using”
For most readers, the most consequential words are the ones about third-party products. An agency cannot simply delete an app. If a vendor’s software uses a DeepSeek model under the hood, the order appears to reach that product too.
The published notice does not define how deep that reaches. The sources reviewed for this article do not explain whether it covers a product that runs DeepSeek weights on a vendor’s own servers, a model fine-tuned from DeepSeek, or a system that calls DeepSeek through a cloud provider. The full order text appears in the notice as images and was not readable for this report.
The Cyber Security Hub adds a wrinkle that matters for the pricing story below. DeepSeek publishes downloadable models, including smaller ones based on Qwen and Llama architectures that were trained on reasoning data generated by DeepSeek’s R1.
An independently run local deployment is technically a different arrangement from DeepSeek’s hosted chatbot. But the Hub warns that this should not be treated as an assumed exemption, because the architecture of a system and the scope of a government order are separate questions.
Companies that sell to federal civilian agencies should read the order itself, ask their own suppliers what models sit inside their products, and talk to counsel before the 60-day exception window closes.
The Pricing War Behind the Headline
DeepSeek is a symbol here, but the underlying story is cost. Fortune compared output-token prices in late July: about $50 per million for Anthropic’s Fable, $15 for Moonshot’s Kimi K3, $4.40 for Z.ai’s GLM-5.2, and about $0.87 for DeepSeek-V4-Pro. Those are list prices for different capability levels, not like-for-like comparisons, but the gap is large enough to change buying decisions.
Fortune and Rest of World report a string of companies shifting some work to Chinese models:
- DoorDash. CTO Andy Fang said a Moonshot model delivers “better quality” at a “cheaper cost” for an experimental ordering tool.
- Cursor. The coding tool’s Composer 2 agent was built with Moonshot’s Kimi.
- Coinbase. Its CEO said in June that the company halved its AI spending by moving employees to Kimi and GLM, per Fortune.
- Lindy. The AI assistant maker moved from Anthropic to DeepSeek’s V4 models, and its founder told Rest of World the switch saved “millions of dollars.”
- Airbnb. It reportedly uses Alibaba’s Qwen for customer service. Airbnb says it uses a limited number of open-source Chinese models through approved U.S.-based providers, and CEO Brian Chesky has said no data goes to the model developers.
- Microsoft. It is exploring DeepSeek or another open-source model as a cheaper option for Copilot Cowork, per Rest of World.
The usage numbers are striking but need care. Fortune reports that in one week in July, Chinese models took 57% of the tokens U.S. firms used on OpenRouter, a model marketplace. But tokens are not dollars.
Rest of World cites Vercel data showing DeepSeek’s share of token usage rose from under 1% to 17% in May while its share of revenue stayed near 1%. Cheap models move a lot of volume and not much money.
The reasons for the price gap, per Fortune, include cheaper power in China, labs accepting thinner margins to win share, constraints from export controls that pushed efficiency, and permissive open licenses that let users run the models themselves at no licensing cost.
Many Chinese labs release weights openly, so companies can host a model on their own hardware or through a U.S. cloud provider.
How U.S. Labs Have Responded
The U.S. labs have not stood still. The Financial Times, as summarized by Dealroom on August 14, reported that OpenAI cut prices on its GPT-5.6 Luna model by 80% and that Anthropic launched Opus 5 at half the price of Fable 5. Dealroom says average prices paid for leading U.S. models fell almost a quarter since mid-July, though top-tier pricing held firmer.
Dealroom’s advice is useful for buyers: track the price per completed task, not the list price per token. A cheaper model that needs more retries, more review, or more human cleanup can cost more in practice. Our AI ROI Measurement Playbook covers how to count that full cost.
Disclosure: Anthropic, which makes Claude, is one of the companies discussed in this section.
The Backlash Was Already Building
Congress moved before DHS did. On April 29, the House Homeland Security Committee and the House Select Committee on the Chinese Communist Party opened a joint investigation into PRC-developed AI models and sent letters to Airbnb and Anysphere, Cursor’s parent, per Nextgov. A letter to DoorDash followed on July 31, per a McGuireWoods summary.
The committees asked about the companies’ use of Chinese models, the reasons for those choices, communications with providers, and in-person briefings. They cited data access, supply-chain and cybersecurity risk, censorship, and alleged distillation, where one model is trained on another’s outputs.
They also pointed to China’s 2017 National Intelligence Law. Anysphere was criticized for not disclosing that Composer 2 was built on Kimi.
Distillation claims run through the whole dispute. Per Nextgov, Anthropic accused DeepSeek, Moonshot AI, and MiniMax in February of generating 16 million exchanges with Claude through about 24,000 fraudulent accounts, and OpenAI told the House China Select Committee it had seen ongoing DeepSeek attempts to distill its models. These are the companies’ allegations.
McGuireWoods notes the probe covers both API-accessed models and self-hosted open-weight models, and that scrutiny can include document production and possible testimony. It reported no final findings as of mid-September.
What It Means for Companies
The cost case for Chinese models is real, and so is the political and legal exposure. A company does not have to choose one blindly. It does have to choose on purpose. Five steps follow from what the record shows.
- Find out where Chinese-origin models run. Check direct API use, aggregator routing, self-hosted weights, and models embedded in vendor products. Many firms will find uses nobody approved.
- Separate the risk by deployment. A self-hosted model that never sends data out is a different risk from a hosted service in China. Document which one you use, and remember that self-hosting changes the data flow, not necessarily whether an order covers the product.
- Classify the work. Low-sensitivity, high-volume tasks are the likeliest fit for cheaper models. Customer data, regulated data, and anything touching government work calls for more caution.
- Check your federal exposure. If you sell to civilian agencies, ask suppliers what models their products use, and read the order text before the exception window closes.
- Build for swapping. Keep prompts, evaluations, and integrations portable so a model can be replaced if law, price, or performance changes.
Keep your logs. Removing a product does not show what was already sent to it. DHS has encouraged agencies to strengthen monitoring during the transition, including network-traffic review, better logging, controls against data exfiltration, and detection of unusual activity. The same questions apply to any company: which services were used, what information reached them, and what evidence remains.
Write down the reasoning. McGuireWoods advises documenting security and legal reviews of any PRC-based model use, and examining vendor contracts and disclosure duties, especially for consumer-facing platforms that hold sensitive data. Our AI Compliance Readiness Playbook covers building the inventory and vendor file that make this answerable.
Bottom Line
Two forces are colliding. Price is pulling companies toward Chinese open models, and national security policy is pushing agencies and, increasingly, their suppliers away from them. The order does not ban private use, but it tells every company with a federal customer to know what is inside its products.
Cheap tokens are not free. The real price includes review time, vendor risk, and the chance that a political decision changes your cost structure overnight. The companies best placed are the ones that can name every model they use, say why, and replace it quickly.
Sources: AI Pulse · Compliance Watch · workplaceai.ai. DHS order: Federal Register notice 2026-21447 (published October 20, 2026; docket DHS-2026-0628); BleepingComputer (October 20, 2026); TechCrunch (October 20, 2026); Quartz (October 19, 2026); The Cyber Security Hub (October 20, 2026), which is also the source for the Wiz, Australia, and earlier U.S. restriction details. Pricing and adoption: Fortune (July 17 and July 26, 2026); Rest of World (2026); Dealroom summary of a Financial Times report (August 14, 2026). Congressional investigation: Nextgov (April 29, 2026); McGuireWoods (September 14, 2026). Prices are list prices for models of different capability, per Fortune, and are not like-for-like. Company statements and allegations are reported as such and have not been independently verified. This article is general information, not legal advice.