The US Department of Homeland Security (DHS) has directed all federal civilian agencies to remove information technology products developed by Chinese artificial intelligence startup Hangzhou DeepSeek Artificial Intelligence Co. from their systems, and has barred further procurement of such products, according to a federal notice. The order is scheduled for publication in the Federal Register on Tuesday, 21 October 2025, and marks one of the most direct regulatory actions Washington has taken against a Chinese AI firm.

Scope of the Order

The directive applies specifically to federal civilian agency IT systems and procurement processes — it does not constitute a blanket ban on private businesses or individual Americans using DeepSeek products. Crucially, the restrictions also extend to third-party products and services built using DeepSeek implementations, significantly widening the net beyond the company's own direct offerings.

The DHS said the order was issued under the Federal Acquisition Supply Chain Security Act of 2018, following a review of a recommendation by the Federal Acquisition Security Council and supporting evidence. The invocation of this statute signals that US authorities regard DeepSeek's presence in federal systems as a supply-chain security risk, not merely a policy preference.

Regional Precedent: South Korea's Earlier Move

The US action follows a similar step taken by South Korea in February 2025, when its foreign, trade, and defence ministries blocked access to the Chinese AI service on government computers. Seoul cited concerns over user data collection practices and the risk of information leaks — concerns that broadly mirror those driving Washington's directive.

Linked Cyber Threat: AI-Powered Attack on South Korean Banks

The DHS order lands alongside a separate but related development. US cybersecurity firm CrowdStrike this week published a report revealing that an unidentified hacker, believed to be a Chinese speaker, used AI-powered hacking tools to breach multiple South Korean financial institutions and steal data between late September and early October.

According to the report, the attacker deployed ARTEX — an open-source, AI-powered penetration-testing tool developed in China — alongside large language models (LLMs) to execute the attacks. Institutions affected reportedly include Hana Bank, KB Kookmin Bank, and Shinhan Bank. Financial authorities and investigators in South Korea have since launched probes into the breaches.

What This Signals for US-China AI Competition

DeepSeek drew global attention earlier in 2025 when its open-weight AI model rivalled the performance of leading US systems at a fraction of the reported cost, triggering a sharp selloff in US tech stocks. The DHS directive now transforms what had been a commercial rivalry into a formal national security confrontation. This is the first time a specific Chinese AI firm's products have been formally removed from US federal civilian IT infrastructure by statutory order — a precedent that could accelerate scrutiny of other Chinese AI tools used in sensitive environments.

Notably, the move comes amid a broader pattern of Washington tightening supply-chain guardrails around Chinese technology, following earlier restrictions on Huawei, ZTE, and, in the software domain, TikTok. The CrowdStrike findings add empirical weight to the threat narrative the DHS is citing. How other allied governments respond — and whether private-sector guidance follows — will define the next phase of this escalation.