A June order, published in October
The Department of Homeland Security has ordered every federal civilian agency to strip DeepSeek out of its information technology and to stop buying it. The notice reached the Federal Register’s public inspection desk at 8.45am Eastern on 19 October and publishes on 20 October under docket DHS-2026-0628.
Two clauses make it broader than the agency-by-agency blocks that came before. The first is the exclusion: products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, “to include affiliated entities as defined in 48 CFR 2.101”, are barred from federal civilian procurement. The second is the removal, which covers “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations”.
That last phrase is the operative one. A contractor selling an agency a document-summarising tool that happens to call a DeepSeek model is covered, whether or not DeepSeek’s name appears anywhere in the contract.
A law written for hardware vendors
The authority is the Federal Acquisition Supply Chain Security Act of 2018, codified at 41 U.S.C. 1321-1328 with implementing regulations at 41 CFR 201-1. DHS says the Secretary acted after reviewing a recommendation from the Federal Acquisition Security Council and the evidence behind it. FASCSA was built to get risky hardware and cybersecurity vendors out of federal systems; this is the statute being pointed at a chatbot.
Implementation sits with CISA. The notice gives a single contact, the FASCSA Order Implementation Team in CISA’s Cybersecurity Division, and the signed order itself is reproduced in an appendix and filed at regulations.gov under the same docket number. The notice is signed by James H. Percival II, the department’s general counsel.
The ban is four months old
The document published this week is a notice of an order, not the order. CyberScoop, which read the appendix, reports that the letter inside it from Homeland Security Secretary Markwayne Mullin is dated 26 June — meaning the exclusion has been operating inside the executive branch for roughly four months before anyone outside it was formally told.
CyberScoop also sets out the department’s stated reasoning: that DeepSeek’s models present “multiple threat vectors”, that data sits on servers in China where the government can compel disclosure from domestic companies, that DeepSeek-hosted models collect personally identifiable information and can track users’ digital fingerprints, and that the prompt-and-response cycle itself may move sensitive material to Beijing. Mullin wrote that such data could yield “actionable intelligence on U.S. persons and/or government programs”.
What agencies have to do
Agencies can ask for an exception, but on DHS’s terms: 60 days’ notice and a “compelling justification”, such as being unable to perform a mission-critical function without the product. Until removal is complete, the department encourages agencies to monitor DeepSeek-bound traffic, raise logging levels, control data exfiltration and flag anomalous activity — advice rather than instruction.
The order’s reach stops at the federal civilian executive branch. It does not bind state governments, private companies or foreign governments, and it is not an Entity List designation, which would restrict exports to DeepSeek rather than purchases from it. Defence and intelligence systems sit outside the civilian branch and are governed separately.
DeepSeek is the only Chinese AI developer named. Alibaba’s Qwen and Moonshot AI’s Kimi have drawn similar national-security commentary in Washington this year, and American labs have accused several Chinese developers of distilling their models, but neither company appears in this order.
The practical test now is auditing. Agencies know which vendors they buy from; they do not reliably know which models those vendors call underneath. Working out how much federal software quietly routes a prompt to a DeepSeek endpoint is the part of this order that has not been done yet.
