DeepSeek and products built on it have been ordered out of US federal civilian agency IT systems. On October 19, 2026, the Department of Homeland Security filed a public notice with the Federal Register disclosing its Exclusion and Removal Order No. 2026-01: civilian executive branch agencies may no longer procure DeepSeek products, must remove what is already installed immediately, and must also remove third-party products and services developed using DeepSeek implementations. The order was issued under the Federal Acquisition Supply Chain Security Act of 2018 following a Federal Acquisition Security Council recommendation, under docket DHS-2026-0628, with formal Federal Register publication scheduled for October 20.
Signed in July, made public in October
The order is dated July 24, 2026, took effect immediately on issuance, and stayed out of public view for nearly three months. A separate July DHS memo, also made public on October 19, told agencies to monitor traffic flowing in and out of government websites to address potential DeepSeek risks. The order does include an exception process: an agency wanting to keep a covered product had to apply in writing within 60 days of issuance with a compelling justification, handled by the Cybersecurity and Infrastructure Security Agency — but by the time the notice became public, that window had already closed. The order covers civilian executive branch agencies only; it does not extend to the Department of Defense and does not directly regulate private-sector purchasing.
The three threat vectors DHS lists
DHS says DeepSeek's models present multiple threat vectors: sensitive data may be transferred to the PRC if US government employees or vendors use the products; such use could produce actionable intelligence on US persons and government agencies; and the models themselves may contain malware or other security vulnerabilities. The named target is Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. Before this order, the Commerce Department and the Navy had already banned DeepSeek on their own devices, and states including New York, Tennessee and Virginia had taken similar steps. The Chinese Embassy in Washington did not immediately comment when Reuters asked.
The hard part is auditing who actually runs DeepSeek
The difficult part of this order is not banning a brand; it is the reach into third-party products developed using DeepSeek implementations. DeepSeek releases its models as open weights, and many tools call, fine-tune or distill those models under the hood while wearing another company's name on the front. To comply, an agency first has to audit the model lineage of its whole software stack — anything a vendor does not disclose becomes a risk item. For model makers and tool vendors, selling into the US government market now comes with a lineage check. It is the same direction as the proposed expansion of AI technology export controls covered earlier on this site: control is extending from whether you may sell to where your model came from. The Federal Communications Commission is also set to vote on October 29 on barring all Chinese labs from testing electronic devices for the US market, so this supply-chain scrutiny is getting denser, not looser.
