The US Has Ordered DeepSeek Out of Federal Agencies. What It Means for Australians

TL;DR: The US Department of Homeland Security has ordered DeepSeek out of federal civilian agency systems. Australia did the same for its own government in February 2025. For Australian businesses, our advice is unchanged: keep personal and sensitive information out of DeepSeek's hosted app.

Posted: 26 October 2026 · By Adam · Category: AI Assistants & Chatbots

What changed

On 20 October 2026 the Federal Register published a DHS notice of an order under the Federal Acquisition Supply Chain Security Act of 2018. It excludes DeepSeek's products and services from federal civilian agency procurement. It also orders the removal of DeepSeek products, and "third-party products and services developed using DeepSeek implementations", from civilian agency IT.

The order binds US federal civilian agencies. The notice places no restriction on businesses or the public.

Separately, DeepSeek released DeepSeek-V4.1-Flash-1017 on 17 October 2026. DeepSeek's API docs say the deepseek-flash model "is now served by DeepSeek-V4.1-Flash-1017, and the calling method remains unchanged." It also launched a Search and Fetch API at US$0.75 per 1,000 successful requests per endpoint (~A$1.07 ex-GST at the RBA rate of 0.7018 on 23 October 2026). Billing starts at about 3am AEDT on 1 November 2026; until then, calls through DeepSeek Harness, Claude Code and Codex are free. GST-registered businesses quoting an ABN are not charged GST; other buyers add ~10%. Flash token prices match what we recorded on 28 September.

Why it matters for Australians

Home Affairs' PSPF Direction 001-2025, published 4 February 2025, already requires Australian Government entities to remove DeepSeek from their systems and devices. It is still listed as a current direction as of 23 October 2026.

The US order goes one step further. It reaches products built on DeepSeek, not just DeepSeek's own app. If you sell software to US federal agencies and a feature runs on DeepSeek, check that now.

For everyone else, the issue is where your data goes. DeepSeek's privacy policy says it stores personal data "in People's Republic of China". The OAIC says Privacy Act obligations apply to any personal information you put into an AI tool, and recommends keeping personal and sensitive information out of publicly available generative AI tools.

Does this change our recommendation?

No. Our DeepSeek review already scores it 16/25, with Australian Fit at 1/5 because data is stored in China. Keep the free chat for public, non-sensitive work if you like it. Switch anything involving client, staff or financial data to a tool with Australian data hosting. See our DeepSeek vs ChatGPT comparison.

The open-weight models are a different case. Run on your own Australian infrastructure, your data does not go to DeepSeek's servers.

This is general information, not security or legal advice.

Sources

1. US Department of Homeland Security, Notice of Order, Federal Register 2026-21447, 20 October 2026: https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm (Wayback: https://web.archive.org/web/20261022215716/https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm) and https://www.federalregister.gov/documents/2026/10/20/2026-21447/notice-of-order-regarding-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive (no Wayback copy: federalregister.gov refuses the archive crawler; the govinfo copy above carries the same text). Read 23 October 2026.
2. DeepSeek, "DeepSeek-V4.1-Flash-1017" release note, 17 October 2026: https://api-docs.deepseek.com/news/news261017 (Wayback: https://web.archive.org/web/20261020035732/https://api-docs.deepseek.com/news/news261017/; capture dated 20 October, same-day save did not index; live text re-checked 23 October 2026). Model routing note on the API docs home page: https://api-docs.deepseek.com/ (Wayback: https://web.archive.org/web/20261020041148/https://api-docs.deepseek.com/; capture dated 20 October; live text re-checked 23 October 2026).
3. DeepSeek, Models and Pricing, including the Search and Fetch billing start: https://api-docs.deepseek.com/quick_start/pricing (Wayback: https://web.archive.org/web/20261019235656/https://api-docs.deepseek.com/quick_start/pricing/; capture dated 19 October, same-day save did not index; live text re-checked 23 October 2026). The 28 September Flash rates are in our DeepSeek review's update history.
4. Department of Home Affairs, PSPF Direction 001-2025: https://www.protectivesecurity.gov.au/publications-library/direction-001-2025-deepseek-products-applications-and-web-services (Wayback: https://web.archive.org/web/20261022220033/https://www.protectivesecurity.gov.au/publications-library/direction-001-2025-deepseek-products-applications-and-web-services) and directions list https://www.protectivesecurity.gov.au/protective-security-directions-under-pspf (Wayback: https://web.archive.org/web/20261022215943/https://www.protectivesecurity.gov.au/protective-security-directions-under-pspf). Read 23 October 2026.
5. OAIC, Guidance on privacy and the use of commercially available AI products, published 21 October 2024, updated 17 January 2025: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products (Wayback: https://web.archive.org/web/20261022220058/https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products). Read 23 October 2026.
6. DeepSeek Privacy Policy: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html (Wayback: https://web.archive.org/web/20261016073359/https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html; capture dated 16 October, policy last updated 10 February 2026; live text re-checked 23 October 2026).

Read the full DeepSeek review →