On 19 October, the US Department of Homeland Security made public an order excluding DeepSeek products from federal civilian procurement and requiring their removal from civilian agency IT systems.
The scope extends beyond DeepSeek’s own applications. The government’s notice also covers affiliated entities and third-party products and services developed using DeepSeek implementations. The notice is scheduled for formal publication in the Federal Register on 20 October.
DHS cited potential transfers of sensitive information to China and other cybersecurity risks. These are the department’s stated security assessments—not judicial findings that every DeepSeek-based product has compromised information.
For lawyers, the key consequence is treating underlying technology as a procurement issue. Assessing an AI supplier may require looking beneath its brand to identify embedded models, subcontractors and dependencies.
The order does not itself impose Australian obligations. Its broader relevance is contractual: organisations buying legal AI should consider whether suppliers disclose model dependencies, notify customers of substitutions and can replace a restricted component without losing access to documents or decision records.
The practical question is no longer simply “Which AI product are we buying?” It is also “Whose technology sits underneath it—and can we change it?”
Sources: DHS public-inspection notice; Reuters.
Leave a Reply