The U.S. Department of Homeland Security (DHS) has issued an exclusion and removal order that bars information technology products and services from Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (DeepSeek) and its affiliated entities from procurement by the federal civilian executive branch, and requires civilian agencies to remove those products from their information systems. The notice was filed for public inspection at the Federal Register on October 19 under document number 2026-21447 and was formally published on October 20.
The order is numbered DHS 2026-01 and was signed by Homeland Security Secretary Markwayne Mullin. According to public reports, it was signed on July 24 but was not announced at the time; it entered the Federal Register process three months later.
What the order covers
The legal basis is the Federal Acquisition Supply Chain Security Act (FASCSA), passed in 2018. The law lets the Department of Homeland Security, the Department of Defense and the Director of National Intelligence each issue supply chain security orders for the systems under their own authority. DHS is responsible for federal civilian agencies.
The order has two parts.
- Exclusion: agencies may no longer procure products from DeepSeek or its affiliates. That covers approved product lists, e-commerce procurement platforms and similar channels, and takes effect immediately.
- Removal: DeepSeek and affiliate products must be removed from agency IT systems, along with third-party products and services developed using DeepSeek implementations.
National security systems and systems handling classified compartmented information are outside the scope; those fall to the Department of Defense and the Director of National Intelligence respectively.
Agencies can apply for exceptions, including full waivers, partial waivers or extensions. Requests must be made in writing within 60 days of the order being issued, with "compelling reasons" and alternative security measures attached, and are approved by the Cybersecurity and Infrastructure Security Agency (CISA). Until removal is complete, agencies must strengthen network traffic monitoring and logging and add controls against data exfiltration. The order will be reviewed once a year.
Earlier bans
At the federal level, the Department of Commerce and the Navy have each previously banned DeepSeek on work devices. At the state level, New York, Tennessee and Virginia have done the same. Abroad, Italy's data protection authority blocked the DeepSeek app early last year, and Taiwan, South Korea and Australia have also barred its use on government devices.
Most of those were internal rules of a single department or a single government. The DHS order rests on federal law, covers all civilian agencies at once and extends to third-party products, which is a step up in force. The first publicly issued exclusion order under FASCSA appeared last September, from the Office of the Director of National Intelligence, and targeted the Swiss software company Acronis.
Who the third-party clause could reach
The clause that deserves the closest attention is the one on third-party products. DeepSeek's V3, R1 and V4 series were all released with open weights, and many U.S. cloud platforms and SaaS companies deploy them on their own servers and package them into services sold to customers, including government customers.
The order gives no list of affected third-party products, and it does not say whether DeepSeek models deployed on American companies' servers, with no data sent back to China, must be removed. Public reports point to this as the vaguest part of the text. If enforcement follows the broadest reading, any provider whose service calls a DeepSeek model underneath would have to prove to its civilian-agency customers that it is "clean," or switch models.
Chinese AI companies that sell overseas, have DeepSeek integrated into their products and are bidding on U.S. government work or its contractors' work will see their eligibility affected directly. Under procurement rules, federal contractors must periodically check the list of FASCSA orders, and this order has now entered that check.
DeepSeek had not responded publicly as of publication.
Sources: U.S. Federal Register public inspection document (to verify the document number, order name and scope), Inside Government Contracts on FASCSA procedures, CocoLoop, Mad Robot's reading of the full order (to verify the signatory, the 60-day exception window and the CISA approval process).