U.S. Bans DeepSeek From Federal Agencies, and Windows Could Be Caught Up in It

Washington is moving to cut DeepSeek out of federal civilian agencies, and it isn’t doing it softly. A new order published in the Federal Register tells the Department of Homeland Security to make agencies remove DeepSeek products from their IT systems and stop buying anything covered by the ban.

The order reaches beyond DeepSeek itself. It also covers software and services from DeepSeek affiliates, plus third-party products built using DeepSeek implementations. That is the part that makes agency IT teams sweat, because the wording is broad and the government has not spelled out exactly what counts as “developed using DeepSeek.” Exceptions are possible, but only with a compelling justification filed 60 days ahead.

DHS secretary Markwayne Mullin said DeepSeek collects personal data when users make accounts, can digitally track users, and may expose prompts and responses to the Chinese government. The letter making that case also says the models could contain malware or vulnerabilities. Until the tools are fully removed, agencies are supposed to watch their network traffic more closely.

The timing is awkward for Microsoft. Earlier this month, it said Windows would become a platform for “hybrid intelligence,” with models running either locally or in the cloud. DeepSeek V4 Flash, with 284 billion parameters, is slated to run on PCs with Nvidia’s new RTX Spark chip, alongside Microsoft’s own coding model and Nvidia’s Nemotron. Pavan Davuluri, who heads Windows, said the model beats GPT-5 on some coding and reasoning tasks. DeepSeek also released a faster V4.1 Flash last Saturday.

That leaves a real compliance mess. The order doesn’t say whether a DeepSeek model running on a device or hosted on U.S. servers is included, and DHS hasn’t clarified it. Security expert Katie Moussouris called the third-party clause nearly impossible to carry out, saying there are no software bills of materials for AI tools that track every model or component used. For now, federal teams will have to inspect what’s running on their machines and on AI gateways like OpenRouter, which can route requests to DeepSeek depending on the settings.