AI Industry

US Orders DeepSeek AI Out of Federal Civilian Agencies

Oct 20, 2026·3 min read·By Rahish Saifi

Red-handled side cutters beside a blue network cable cut cleanly in two, copper strands showing at both ends, on a grey steel desk

The U.S. Department of Homeland Security has directed every federal civilian executive branch agency to remove DeepSeek products—and third-party tools built on DeepSeek—from government IT and to stop buying them. DHS publicized the order on October 19, 2026; the notice hit the Federal Register on October 20. The ban itself was signed July 24, 2026 and has been effective since then, covering Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and affiliated entities.

Key facts

Item	Detail
Legal instrument	DHS Exclusion and Removal Order #2026-01 under the Federal Acquisition Supply Chain Security Act (FASCSA), 41 U.S.C. 1321–1328
Notice	Federal Register Doc. 2026-21447, Docket DHS-2026-0628, publication date Oct. 20, 2026; filed Oct. 19, 2026
Effective date	Order issued and effective July 24, 2026 (Secretary Markwayne Mullin)
Scope	DeepSeek and affiliated entities (48 CFR 2.101); civilian executive branch agencies—not Defense national-security systems or intelligence community systems under this authority
Required actions	Exclude from procurements immediately; remove DeepSeek and affiliate products plus third-party products/services developed using DeepSeek implementations, unless an exception was granted
Exceptions	Agencies could request a written exception within 60 days of issuance (window closed around Sept. 22, 2026); email FASCSA.Orders@cisa.dhs.gov; CISA reviews; compelling justification and mitigations required
Implementation	CISA FASCSA Order Implementation Team oversees rollout (per MeriTalk)

What DHS ordered

The Federal Register notice formalizes Exclusion and Removal Order #2026-01, issued after a Federal Acquisition Security Council (FASC) review. DHS General Counsel James H. Percival II signed the filing; the signed order is in the appendix and on regulations.gov under docket DHS-2026-0628. Agencies must exclude DeepSeek and affiliate products from procurements (including approved lists and e-commerce channels) and remove those products plus third-party products and services developed using DeepSeek implementations from IT systems, unless CISA had granted an exception during the 60-day request window.

Until removal is complete, agencies should monitor traffic, add enhanced logging and data-exfiltration controls, and flag anomalous activity. CISA may provide technical assistance, and the Secretary must review the order within one year and annually after that. The Wall Street Journal headlined the story on October 19, and BBC News noted the ban had already been in effect since late July for civilian departments such as Treasury, State, and Justice. DHS, DeepSeek, and the Chinese embassy in Washington were contacted for comment in BBC's reporting; no responses were reported.

Why DHS says DeepSeek is a risk

DHS cites DeepSeek servers in the People's Republic of China, where law can compel access to private infrastructure, and warns that hosted accounts collect PII and may fingerprint users. Prompt-and-response use by government staff or contractors "could produce actionable intelligence on U.S. persons and/or government programs." DHS also writes that "DeepSeek's models present multiple threat vectors" and points to NowSecure research from February 2025 on critical iOS app flaws. BBC adds political context—White House tech lead Michael Kratsios on "malicious exploitation" of U.S. AI firms, and copycat allegations from Anthropic and OpenAI—as DeepSeek keeps shipping new models on the commercial side.

It reaches products built on DeepSeek too

Removal is not limited to apps branded DeepSeek. The order covers third-party products and services developed using DeepSeek implementations, so vendors selling into the civilian executive branch must trace whether their stack routes through DeepSeek models, weights, or APIs—even if contracts never name Hangzhou DeepSeek. BBC notes Snowflake, Vercel, and OpenRouter among firms that incorporate DeepSeek for customers; DHS did not cite them in the notice, but the wording is a supply-chain alarm for integrators.

Who is exempt and the 60-day exception window

The order covers federal civilian executive branch agencies, except national-security and SCI systems. The Department of War (Defense) and intelligence community sit outside DHS authority here. Agencies could request a written exception within 60 days of issuance; counted from July 24, that window closed around September 22, 2026. Requests needed justification and mitigations; CISA decides. Email FASCSA.Orders@cisa.dhs.gov.

What it means for developers and AI vendors

FASCSA orders are procurement rules, not model benchmarks, but they can still reshape which APIs appear in government RFPs. Vendors with mixed model routers may need feature flags that hard-block DeepSeek routes for federal accounts and audit logs proving which weights ran on each request. Self-hosted mirrors or fine-tunes derived from DeepSeek checkpoints could still draw scrutiny under the "developed using" language. Civilian agencies face an inventory sprint: intranet chat widgets, coding pilots, and vendor demos that quietly called a DeepSeek endpoint.

What to watch next

Watch whether DHS or CISA discloses which agencies sought exceptions and how CISA's FASCSA implementation team publishes decisions. DeepSeek may keep shipping on the commercial internet even as models vanish from civilian federal networks, and state or allied procurement offices may mirror federal exclusion lists even though DHS did not order them to act.