DHS Orders Federal Civilian Agencies to Drop DeepSeek, Including Products Built on It
A DHS order published in the Federal Register on October 20 bars federal civilian agencies from buying DeepSeek products and requires them to remove DeepSeek and third-party products built on it. It does not cover private use or national security systems.
The U.S. Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove those already in their systems, including third-party products and services built on DeepSeek. The notice of the order was published in the Federal Register on October 20, 2026, as document 2026-21447, under the Federal Acquisition Supply Chain Security Act of 2018.
The order, labeled Exclusion and Removal Order #2026-01 and signed by Homeland Security Secretary Markwayne Mullin, lists an original release date of July 24, 2026. The signed order, reproduced as images in the notice's appendix, directs agencies to do two things. First, "exclude DeepSeek, DeepSeek-affiliated entities, and their products from civilian agency procurements, effective immediately after issuance of this Order, to include agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions that facilitate the procurement of information technology hardware, software, and services." Second, "remove products provided by DeepSeek, DeepSeek-affiliated entities, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems immediately after the issuance of the Order, or seek an Exception."
The order names Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. as the source and uses the federal procurement definition of affiliates in 48 CFR 2.101, covering any business where "either one controls or can control the other" or a third party controls both. In its summary of risks, DHS says DeepSeek's servers are located in China, that its account process collects personally identifiable information and "may also track and digitally fingerprint users," and that prompts from government employees or vendors could transfer sensitive data to China. It also cites outside research finding multiple critical vulnerabilities in DeepSeek's iOS app.
The third-party clause is what matters most for vendors. The removal requirement is not limited to DeepSeek's own apps and services: it extends to "third-party products and services developed using DeepSeek implementations," and a footnote in the order adds that this is meant "to include third party implementations of DeepSeek used to provide products and services civilian agencies." For a company that builds DeepSeek models into a product sold to civilian agencies, that wording puts the product within the order's removal requirement, unless the agency using it obtains an exception. The order does not define "DeepSeek implementations" further.
The order's reach is limited. It "Applies To: Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems." Its background section notes that the Homeland Security Secretary's authority does not extend to systems under the Department of War (the Defense Department) or the Office of the Director of National Intelligence, which issue their own orders. It is directed at agencies' procurement and IT systems; it does not address use of DeepSeek by private companies or individuals.
Agencies can ask for relief. Under 41 CFR 201-1.304(b), an agency may request an exception from the DHS issuing official, "such as asking that the order not apply to the agency, certain actions, or for a delay in compliance." Requests must be "submitted in writing within 60 days of the issuance of this order" and include a compelling justification, such as the impact on mission-critical functions, along with any alternative mitigations. CISA will review requests and issue a written approval or disapproval. Until covered products are fully removed, agencies "are encouraged to take steps to address risks to their systems," such as monitoring traffic, enhanced logging, controls on data exfiltration, and flagging anomalous activity. CISA may provide technical help to agencies that lack internal capability, and the Secretary must review the order within one year and annually after that.
The notice does not say whether the 60-day exception window runs from the July 24 release date or from the October 20 publication, and DHS has not published a list of affected third-party products. The full order is available on regulations.gov under docket DHS-2026-0628.
