Banning DeepSeek isn't enough. Federal agencies must also address DeepSeek-developed products and services across procurement. Lineaje xBOM Manager and UnifAI help reveal what's hidden and govern what's in use.
.png)
A Russian nesting doll looks like a single object. Open it, and there's another inside. Then another. And another. Modern software and AI supply chains work much the same way. An enterprise application may rely on a third-party service, which incorporates an AI framework, which depends on a model implementation the organization never directly selected. That hidden dependency is now more than a security concern. It can become a compliance problem.
On October 20, 2026, the Department of Homeland Security (DHS) published notice of an order requiring federal civilian agencies to remove DeepSeek products from their IT systems and excluding DeepSeek-developed products and services from federal civilian procurements. The removal requirement also extends to third-party products and services developed using DeepSeek implementations.
The critical question isn't simply whether your organization uses DeepSeek. It's whether DeepSeek exists somewhere inside the technology you depend on.
Lineaje's view: You can't secure what you can't see inside your software and AI supply chain. xBOM Manager continuously discovers and inventories software and AI components, identifies hidden dependencies, assesses risk, and validates compliance against policies and requirements. UnifAI complements this visibility by discovering AI assets and enforcing governance policies at runtime. Together, they help organizations uncover hidden exposure, govern AI usage, and take action.
Lineaje's 2026 RSAC research found that only 17% of surveyed organizations have full visibility into their AI-generated code, despite 89% expressing confidence in their ability to secure it.
The software supply chain adds another layer of complexity. According to Lineaje's software supply chain research, open-source dependency chains can extend up to 60 levels deep, making it increasingly difficult to understand every component and technology embedded within an application.
Lineaje's research also found that approximately 70% of a typical application's code is open source, and 68% of components within a sourced open-source package are dependencies inherited from other packages. Each dependency can introduce additional components and technologies that organizations may never have directly evaluated.
The DeepSeek restriction exposes why this visibility gap matters. Organizations may know which AI applications they've approved, but that doesn't mean they know which models, frameworks, or technologies are embedded within third-party software. Removing a restricted technology requires more than identifying its direct users. It requires understanding where technology exists across the software and AI supply chain.
This is where Lineaje's xBOM Manager becomes critical. By continuously discovering software and AI components, tracing dependencies, assessing risk, and maintaining compliance evidence, xBOM helps organizations identify potential exposure to restricted technologies that traditional application inventories may overlook.
The compliance question is no longer just what AI you approved. It's what AI is actually inside.
The DHS order highlights a broader challenge: restricted AI technology can be embedded several layers beneath the applications organizations knowingly deploy. Like Russian nesting dolls, each layer can conceal another dependency.
These five layers illustrate a potential dependency chain, not categories defined by the federal order. Organizations may know which applications and vendors they use without knowing which AI models and dependencies are embedded beneath them.
Lineaje's approach addresses both sides of that challenge: xBOM Manager reveals the software and AI components, dependencies, and third-party technologies embedded across the supply chain. UnifAI discovers AI assets, derives governance policies, enforces controls, and demonstrates compliance. Together, they help organizations move beyond simply banning a technology to understanding where it exists, assessing exposure, and governing its use continuously.
The distinction is critical: A ban establishes the rule. Supply chain intelligence and enforceable AI governance make it actionable.
This is where Lineaje moves from supply chain uncertainty to actionable intelligence.
xBOM: Reveal What's Inside
Lineaje's xBOM Manager provides continuous discovery, dependency visibility, risk assessment, and compliance evidence across the software and AI supply chain. Through AIBOM management and third-party supplier BOM intelligence, xBOM helps organizations identify embedded AI components, trace dependencies, assess potential exposure to restricted technologies, and maintain evidence to support compliance.
UnifAI: Discover and Govern AI
While xBOM reveals what's embedded in the software supply chain, UnifAI helps organizations discover and govern AI assets and usage. UnifAI identifies AI models, agents, tools, and applications, assesses potential security and policy violations, and enforces governance controls through centralized policies and AI guardrails.
Together, xBOM and UnifAI connect what's inside your software supply chain with how AI is governed and controlled—turning visibility into actionable governance.
The DeepSeek order illustrates a broader challenge for AI compliance: restricting a technology doesn't necessarily eliminate its presence within the software and services organizations depend on.
For federal agencies, this creates a supply chain visibility challenge. For enterprises, it reinforces the importance of understanding what's embedded in third-party technology—and governing AI continuously.
Because banning a model is one thing. Knowing everywhere it's embedded is another. Know What's Inside. Govern What Runs.
