US federal agencies told to remove DeepSeek AI within 60 days

What happened

The US Secretary of Homeland Security has ordered federal agencies to remove all DeepSeek products and services from their systems, placing the Chinese-hosted AI model under direct government scrutiny. Agencies have 60 days to purge the technology from their IT estates.

Agencies that have a "compelling justification" for keeping DeepSeek can apply for an exemption by written request to the Cybersecurity and Infrastructure Security Agency (CISA). The Department of Homeland Security (DHS) based the order on several concerns about the hosted model, including data sovereignty, the reach of Chinese legal frameworks and security vulnerabilities.

The decision comes as DeepSeek continues to release models that, in some cases, match or outperform those from American AI laboratories, according to the reporting carried by InfoWorld.

Why it matters

For leaders, the order is less about one model than about where AI services come from and how their data is handled. Any hosted AI tool sits inside a chain of data flows, hosting jurisdictions and third-party dependencies. Government action of this kind suggests those chains now need the same due diligence applied to other critical suppliers. Organisations that embed AI into case handling, knowledge search or internal workflows should be able to say where prompts, documents and outputs are processed, and which legal regime governs them.

Erik Avakian, technical counselor at Infotech, has described the core risk: when organisations use hosted AI services, they may be sending sensitive material into environments they can see very little into. That visibility gap, rather than a model's benchmark performance, is what procurement and digital transformation teams now need to close.

The Renascence take

Most coverage will read this as a US–China story. For experience and service leaders, it is a design problem. People using AI in public services and enterprises rarely see where their data goes, and trust is built or lost on that invisibility.

The mistake is treating model selection as a product decision when it is really a service decision. Customers and employees will never read a data-residency clause, but they will feel the consequences when a tool is withdrawn mid-process or a case stalls during a forced migration. Operators should map every AI touchpoint as they would a service journey, marking where data leaves the organisation, who can access it and what the fallback is if a provider becomes unavailable. Build that resilience in before a regulator or a headline makes the decision for you.