DHS bars DeepSeek and products built on it from US civilian agencies

DHS bars DeepSeek and products built on it from US civilian agencies

19 October 2026: The US Department of Homeland Security has ordered every federal civilian agency to stop buying DeepSeek products and to remove them from their systems, together with "third-party products and services developed using DeepSeek implementations". The order, issued under the Federal Acquisition Supply Chain Security Act of 2018, is published in the Federal Register on 20 October.

Not yet independently verified. The Federal Register notice appears on 20 October; the order itself is dated 24 July 2026, and one outlet gives a different signing date. The order sets no deadline for removal beyond "immediately". We will update this when it can be confirmed, and remove this note.

What the order requires

Exclusion and Removal Order 2026-01, signed by Homeland Security Secretary Markwayne Mullin and dated 24 July 2026, gives agencies two duties. They must exclude Hangzhou DeepSeek Artificial Intelligence Co., Ltd, its affiliates and their products from procurement "effective immediately", including from approved product lists, equipment lists and e-commerce buying channels. They must also remove DeepSeek products and third-party products built on DeepSeek from their information technology "immediately after the issuance of the Order", or ask for an exception.

Affiliates are defined by the federal acquisition rule's usual control test, so a company that controls DeepSeek, is controlled by it, or shares a controlling owner with it is covered. The order applies to civilian agencies only; defence and intelligence systems fall under their own authorities.

The third-party clause is the part vendors will feel

DeepSeek's own apps were already unlikely to be on a federal desktop. The reach of this order is in its second limb, and its footnote says it covers "third party implementations of DeepSeek used to provide products and services" to civilian agencies. A software vendor that runs a DeepSeek model, or a fine-tune of one, inside a product sold to an agency is now selling an excluded article. That includes models self-hosted on US infrastructure, because the wording turns on what the product was "developed using", not where it runs.

Suppliers to US civilian agencies should therefore expect questions about which foundation models sit behind each AI feature, and should be able to answer them from their own records. Agencies asking for an exception had to file in writing within 60 days of the order, giving the product, the provision and a "compelling justification", with CISA deciding.

Why DHS says it acted

The order cites DeepSeek servers located in China, Chinese law giving state agencies broad access to company infrastructure, the collection of personal data and device fingerprints at sign-up, and the risk that prompts from government staff or vendors reach China, where the data "could produce actionable intelligence on U.S. persons and/or government programs". It also points to published research finding critical vulnerabilities in DeepSeek's iOS app.

Until removal is complete, agencies are told to monitor traffic, add logging and exfiltration controls, and flag anomalous activity. CISA can help agencies that lack the capacity to comply, and the order is reviewed within a year and annually after that. Our government software category lists nine products.

Sources

• Federal Register (public inspection): Notice of Order Regarding Exclusion and Removal of DeepSeek Products, FR Doc. 2026-21447, filed 19 October, publishing 20 October, 19 October 2026
• CyberScoop: DHS bans DeepSeek from federal agencies, 19 October 2026