DHS shuts DeepSeek out of federal civilian systems — and everything built on its models

• Who: The Department of Homeland Security, acting under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328), following a Federal Acquisition Security Council recommendation.
• What: Exclusion and Removal Order #2026-01: (1) exclusion of IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates from federal civilian agency procurements; (2) removal of all DeepSeek and DeepSeek-affiliate products — plus third-party products and services developed using DeepSeek implementations — from civilian agency information technology.
• When: Filed for public inspection October 19, 2026 at 8:45 am (FR Doc. 2026-21447, docket DHS-2026-0628); scheduled Federal Register publication October 20, 2026. The signed order's listed release date is July 24, 2026.
• Scope: Federal civilian executive branch agencies. National security systems and sensitive compartmented information systems are excluded from this order.
• Why: DHS says DeepSeek models “present multiple threat vectors,” including the risk that use by government employees or vendors “may result in the transfer of sensitive data to the PRC,” plus possible malware or security vulnerabilities in the models.
• Exceptions: Agencies could request exceptions in writing within 60 days of issuance with a compelling justification and proposed mitigations; requests go to the FASCSA Order Implementation Team in CISA's Cybersecurity Division.

The order, in two moves

On Monday, the Department of Homeland Security filed for public inspection a notice confirming the Secretary of Homeland Security had issued an order doing two things at once. First, it excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. — to include affiliated entities as defined in federal acquisition regulations — from federal civilian agency procurements. Second, it requires the removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.

It is the second prong that gives the order its bite. A procurement exclusion alone would simply stop future buying. A removal order alone would invite the same tools back through the next contract. Doing both — and extending the removal requirement to third-party tools built on DeepSeek's models — leaves, as one analyst noted this week, very little room. The signed order is attached as an appendix to the six-page filing, which also lists a contact point: the FASCSA Order Implementation Team in CISA's Cybersecurity Division.

What the order cites — and what it doesn't

The notice's authority comes from the Federal Acquisition Supply Chain Security Act of 2018, and DHS says it acted after reviewing a Federal Acquisition Security Council recommendation and supporting evidence. On the merits, the notice says DeepSeek's models “present multiple threat vectors,” warning that use by government employees or vendors “may result in the transfer of sensitive data to the PRC” and that the models themselves “may contain malware or other security vulnerabilities.” The hedges are DHS's own; the notice identifies no specific instances of data being transferred.

Editorial sourcing on the order notes the data-transfer concern is grounded in DeepSeek's own privacy policy, which places servers in China, while the malware warning leans on a 2025 audit of DeepSeek's iOS app — not the open-weight models that agencies could run on their own servers. Detailed analysis of the filing also flags that the order arrives just two days after DeepSeek's October 17 V4.1-Flash-1017 release, though the order's July signature predates that launch.

Signed in July, revealed in October

Here is the wrinkle. The signed order's listed release date is July 24, 2026 — meaning the ban appears to have been in force for almost three months before the public knew about it. And the order's 60-day window for agencies to request exceptions, measured from issuance, had already elapsed before the notice appeared for public inspection on October 19. Agencies seeking exceptions were past the submission point before the filing was posted.

That sequencing matters less than it looks: DHS can issue these orders without public notice, and the civilian agencies subject to them did not need a Federal Register filing to know. What the public filing does establish is the legal record — and the order is not set-and-forget. The Secretary must review it within a year, and every year after.

Why this is the broadest move yet

This is not Washington's first swipe at DeepSeek, but it is the widest. The Commerce Department barred DeepSeek from government devices in 2025, and the U.S. Navy directed its personnel the same year not to use the technology over security concerns. Several states — including New York, Tennessee, and Virginia — imposed their own restrictions, per Reuters reporting. Abroad, Italy's data protection authority blocked the DeepSeek app in early 2025, while Taiwan, South Korea, and Australia barred it from government devices.

Monday's order goes further, covering every civilian agency and everything they buy. And it lands in a week when Beijing is tightening its own grip: China now wants to control exports of its largest AI models, and DeepSeek is reportedly training its next model on Chinese chips. Meanwhile, the FCC is scheduled to vote October 29 on barring Chinese labs from testing U.S. electronics, per Reuters. DeepSeek and the Chinese embassy in Washington had not commented as of the reports cited.

The vendor inventory problem

The most immediate consequence may fall not on agencies but on their suppliers. Any startup or enterprise selling AI tooling to the federal civilian ecosystem now has to answer a question many can't answer quickly: which models sit inside their products? An agent platform, a document summarizer, or a procurement assistant that quietly calls a DeepSeek implementation underneath is a “third-party product developed using DeepSeek implementations” — and the order says it must be removed from agency systems.

The order does not extend export controls into the private sector, and it explicitly excludes national security systems and sensitive compartmented information systems, which fall under separate orders. But for civilian procurement, model provenance just became a compliance line item. Until products are removed, agencies are directed to monitor network traffic, strengthen logging and data exfiltration controls, and flag anomalous activity.