DHS Bans DeepSeek at Federal Agencies: What the Order Covers

By Jaspal Singh October 20, 2026 Updated: October 20, 2026

The Department of Homeland Security has ordered every federal civilian agency to stop buying DeepSeek products and to strip out any already in use, including third-party tools built on DeepSeek. The order also covers agency contracts, so vendors selling AI services to the government now have to show that no DeepSeek model sits inside them.

What Happened

On October 20, 2026, the Federal Register published a DHS notice of order titled "Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements". The document was filed for public inspection on October 19 at 8:45 am and is signed by DHS General Counsel James H. Percival II.

The order itself, numbered Exclusion and Removal Order #2026-01, is attached as an appendix. It is signed by Homeland Security Secretary Markwayne Mullin, copied to Office of Management and Budget Director Russell Vought, and carries an original release date of July 24, 2026. That means agencies had the order for almost three months before the public notice appeared.

The order does two things. It excludes Hangzhou DeepSeek Artificial Intelligence Co., its affiliated entities and their products from civilian agency procurement, effective immediately. It also removes products from DeepSeek, its affiliates, and "third-party products and services developed using DeepSeek implementations" from civilian agency IT systems, also immediately, unless an agency asks for an exception.

Engadget, The Register, CNBC and SiliconANGLE reported the order on October 19 and 20. Engadget noted that it landed a couple of days after DeepSeek released its V4.1-Flash-1017 model. The Register reported that DHS did not answer its request for comment.

Why It Matters

Federal agencies have pushed DeepSeek out piecemeal before. The Register lists the Defense Information Systems Agency blocking it on Pentagon networks in January 2025, the Navy and NASA restricting it that same month, and the House of Representatives banning it on its devices. A bill called the No DeepSeek on Government Devices Act was introduced in February 2025 but never left committee.

This order is broader than those device bans in three ways.

First, it reaches every civilian executive-branch agency at once, from the EPA to the FCC, instead of one department at a time.

Second, it covers procurement as well as use. Agencies must strip DeepSeek from approved product lists, service provider equipment lists, e-commerce marketplaces and "other similar functions that facilitate the procurement" of IT. In practice, DeepSeek cannot win civilian federal contracts, and a reseller cannot slip it in through a catalogue.

Third, it covers products built on DeepSeek, not just DeepSeek's own app. A footnote extends the exclusion to "third party implementations of DeepSeek used to provide products and services" to agencies. That clause matters most for the private sector. DeepSeek's open-weight models are cheap to run, and many startups and integrators quietly use them inside chatbots, coding assistants and document tools. Any of those products sold to a civilian agency is now in scope.

The rationale is set out in the order's risk summary. DHS says DeepSeek's servers are in China, where the legal system "permits extensive authority" for government cyber and intelligence agencies to access company infrastructure. It also says account sign-up collects personal data and may fingerprint users, and that prompts typed by employees or vendors could transfer sensitive data to China. The order adds that "the models themselves may contain malware or other security vulnerabilities". As supporting evidence it cites a February 2025 NowSecure analysis of the DeepSeek iOS app, which reported multiple critical security and privacy flaws.

How It Works

The legal basis is not new. It is the Federal Acquisition Supply Chain Security Act of 2018, usually shortened to FASCSA, along with its implementing rules at 41 CFR part 201-1. Here is the chain from law to an agency's IT desk.

The council recommends. FASCSA created the Federal Acquisition Security Council, an interagency body that assesses supply chain risk in technology the government buys. The council can recommend excluding a source from procurement, removing its products from federal systems, or both. The DeepSeek order says the Secretary acted "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence".

Three officials can issue orders. The law splits authority three ways. The Secretary of Defense covers the Defense Department and national security systems, the Director of National Intelligence covers the intelligence community and compartmented systems, and the Secretary of Homeland Security covers everything else in the civilian government. That is why this order applies to "Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems". The Pentagon's separate DeepSeek block remains its own matter.

"Affiliate" is defined broadly. The order borrows the procurement definition at 48 CFR 2.101. A business is a DeepSeek affiliate if either one controls or can control the other, or if a third party controls or can control both. So a renamed spin-off or a sister company under the same owner does not escape the order.

Removal is immediate, but exceptions exist. An agency that cannot comply can ask the DHS issuing official for an exception under 41 CFR 201-1.304(b). It might ask for the order not to apply to it, to certain actions, or for a delay in compliance. Requests must be in writing within 60 days of the order's issuance. They must identify the product, explain the mission impact or national-interest reason, and describe alternative mitigations. CISA reviews each request and gives a written approval or rejection.

Interim controls cover the gap. Until removal is finished, the order encourages agencies to monitor traffic in and out of the affected systems, add logging, put controls on data exfiltration, and flag anomalous activity. CISA may provide technical help to agencies that lack the in-house skills to comply.

The order is reviewed yearly. FASCSA requires the Secretary to review the order within one year and every year after that, so it stays in force until DHS lifts it.

For an IT team, the hard part is inventory. A DeepSeek model can sit several layers down: a vendor's chatbot that routes some queries to a hosted DeepSeek endpoint, a coding tool with a DeepSeek option, or an AI gateway that picks the cheapest provider per request. The Register pointed out that gateways such as OpenRouter and Vercel AI Gateway can send traffic to DeepSeek models unless the customer restricts which providers they use. Agencies, and the vendors that serve them, will need to audit model routing as well as installed apps.

What's Still Unknown

Whether self-hosted open weights count. The order speaks of DeepSeek "products" and "third-party products and services developed using DeepSeek implementations". It doesn't say whether an agency running DeepSeek's open-weight model on its own hardware, with no data leaving the building, is covered. A critic quoted by The Register reads the order as reaching US-hosted versions. The text points that way but doesn't spell it out.

What "developed using" means. It is unclear whether a model fine-tuned from DeepSeek weights, or distilled from DeepSeek outputs, counts as a third-party product developed using DeepSeek. The same goes for software whose code was written with DeepSeek's help. The order doesn't define the phrase.

How vendors will prove compliance. The public order describes agency duties, not a contract clause. Expect contracting officers to ask vendors for attestations, but the form and the penalties for a false one aren't published yet.

Why the July order was published in October. The order is dated July 24, 2026, and the notice appeared on October 20. DHS hasn't explained the gap, or said how many agencies sought exceptions in the meantime.

Whether states and contractors' own policies follow. Several US states already restrict DeepSeek on government devices. A federal order often becomes the template for state procurement rules and for large contractors' internal policies, but none had announced changes when this was written.

Frequently Asked Questions

Does the DHS order ban DeepSeek for ordinary Americans?

No. The order applies only to federal civilian executive-branch agencies, their IT systems and their procurement. Private individuals and companies can still use DeepSeek's app and models in the US. The order does matter to businesses that sell to the government, because products built on DeepSeek can no longer be supplied to civilian agencies, and those vendors may need to replace the model.

Which federal agencies are covered by the DeepSeek order?

All federal civilian executive-branch agencies, such as the EPA, FCC and the Department of Health and Human Services. It does not cover their national security systems or secure compartmented information systems. Those, along with the Defense Department and intelligence community, fall under the Secretary of Defense and the Director of National Intelligence, who hold separate FASCSA authority.

When does the DeepSeek removal take effect?

Immediately. The order, dated July 24, 2026, says agencies must exclude DeepSeek from procurement and remove its products from their systems straight after issuance. An agency that cannot meet that deadline must request an exception in writing within 60 days. The public Federal Register notice followed on October 20, 2026.

What is FASCSA?

FASCSA is the Federal Acquisition Supply Chain Security Act of 2018. It set up the Federal Acquisition Security Council to assess supply chain risk in technology the government buys. It also lets the Secretaries of Homeland Security and Defense and the Director of National Intelligence issue binding orders that exclude a supplier from procurement or remove its products from federal systems.

Are apps built on DeepSeek models included?

Yes. The order removes "third-party products and services developed using DeepSeek implementations" from civilian agency IT, and a footnote extends the exclusion to third-party implementations used to provide products and services to agencies. A chatbot, coding assistant or document tool sold to an agency that runs on a DeepSeek model falls within scope, even when DeepSeek's name never appears.

Can an agency get an exception to the DeepSeek order?

Yes. Under 41 CFR 201-1.304(b), an agency can ask the DHS issuing official to waive the order, limit it to certain actions, or delay compliance. The request must be written, filed within 60 days of issuance, and explain the mission impact and planned mitigations. CISA reviews each request and replies with written approval or disapproval.

Why did DHS say DeepSeek is a risk?

The order says DeepSeek's servers are in China, where the law allows broad government access to company infrastructure. It says account creation collects personal data and may fingerprint users, and that prompts from federal staff or vendors could move sensitive data to China. It also warns the models may contain malware or vulnerabilities, citing a 2025 NowSecure report on the iOS app.

Is this the first US government action against DeepSeek?

No. In January 2025 the Pentagon's IT agency began blocking DeepSeek, and the Navy, NASA and the House of Representatives restricted it in the same period. A bill to ban it on government devices was introduced in February 2025 but stalled. This order is the broadest so far because it covers every civilian agency and their procurement at once.