The US Department of Homeland Security has ordered every federal civilian agency to stop buying DeepSeek products and to remove them from government IT systems, according to a notice filed with the Federal Register on Monday. The DeepSeek ban reaches past the Chinese company's own app. It also covers third-party products and services built on DeepSeek implementations, which could pull in software that agencies never bought under the DeepSeek name.
The order, numbered 2026-01, was signed by Homeland Security Secretary Markwayne Mullin and is dated 24 July 2026, Mad Robot reported. The notice is scheduled to publish in the Federal Register on Tuesday, 20 October, as document 2026-21447 under docket DHS-2026-0628.
What the DeepSeek ban requires
DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018, known as FASCSA. PYMNTS reported that the law lets the department exclude or remove risky products and services from federal procurement and IT systems.
According to Mad Robot's reading of the order, agencies must:
- Stop buying DeepSeek products "effective immediately," including through approved product lists and e-commerce marketplaces.
- Remove DeepSeek and covered third-party products from agency systems immediately.
- Until removal is finished, monitor network traffic in and out, increase logging, add controls against data leaving agency systems and flag anything unusual.
The order applies to the federal civilian executive branch. National security systems, which fall under the Pentagon and the Director of National Intelligence, are excluded. It names Hangzhou DeepSeek Artificial Intelligence, its affiliates and their products.
Agencies that cannot comply may ask for an exception, a partial exemption or a delay. Requests must be made in writing within 60 days of the order's issue date and must give a "compelling justification," such as harm to mission-critical work, plus any alternative safeguards, Mad Robot reported. The Cybersecurity and Infrastructure Security Agency (CISA) reviews each request. The Secretary must review the order within a year and every year after that.
Sixty days from 24 July ran out on 22 September, weeks before the public saw the order. Reuters, in a report republished by Daily Sabah, described the July document as a DHS memo to agencies, which suggests agencies had it well before Monday's filing.
Why DHS says DeepSeek is a risk
DHS said DeepSeek's models "present multiple threat vectors," according to PYMNTS. The department pointed to Chinese laws that let the government access private company infrastructure, an account sign-up process that collects personal information, and a prompt-and-response design that requires users to hand information to the model.
"…could produce actionable intelligence on U.S. persons and/or government programs." (DHS order, as quoted by PYMNTS)
DHS also said the models "may contain malware or other security vulnerabilities." Mad Robot reported that the order cites a February 2025 NowSecure audit that found multiple critical flaws in DeepSeek's iPhone app. It also cites DeepSeek's privacy policy, a 2020 DHS business advisory on Chinese data risks and an April 2025 report by the House Select Committee on China. The order does not describe any case of government data actually reaching DeepSeek, Mad Robot noted.
DeepSeek has not commented. The Chinese Embassy in Washington did not immediately respond, Reuters reported.
The open question: open-weight models and tools built on them
DeepSeek releases its models with open weights, so anyone can download them, run them on their own servers or build them into products. The order does not list which third-party products are covered. It also does not say how agencies should treat DeepSeek models hosted on US companies' servers, Mad Robot reported.
Gabrielle Hempel, a security operations strategist at Exabeam, told Security Magazine that the breadth of the language raises questions about software provenance and supply-chain compliance. She accepted the concerns about data sovereignty and foreign intelligence collection but said where a model runs matters.
"A locally-deployed model with appropriate controls presents a different risk profile than a foreign-hosted service." (Gabrielle Hempel, Exabeam)
"The challenge will be making those requirements sufficiently clear and technically enforceable," Hempel said.
What contractors and vendors should check
For companies selling to civilian agencies, the practical work is an inventory. FASCSA orders reach contractors through Federal Acquisition Regulation clause 52.204-30. A Mondaq analysis of an earlier FASCSA order explains that contractors with this clause must watch for new orders, make a reasonable inquiry into whether they use covered products, notify contracting officers and apply mitigation. In that earlier case, any use found had to be reported within three business days, with mitigation details due within ten.
Because the DHS order covers products built with DeepSeek implementations, that inquiry would go beyond the DeepSeek chatbot. Vendors would need to check whether any product, plug-in or hosted service they sell runs a DeepSeek model, including models fine-tuned from DeepSeek weights. The order does not say where that line sits, so contractors may need to put the question to contracting officers directly.
That earlier order, the first of its kind, was issued by the Director of National Intelligence in September 2025 against Swiss firm Acronis AG and gave no public rationale, according to Mondaq. The DeepSeek order sets out its reasons.
How it fits the wider US-China AI picture
The order turns a patchwork of earlier restrictions into one rule for civilian agencies. The Commerce Department banned DeepSeek on government-furnished equipment in March 2025, and the Navy also blocked it, according to Reuters reporting cited by PYMNTS and Mad Robot. Texas was the first US state to bar it from government devices, PYMNTS reported, and New York, Tennessee and Virginia followed. Abroad, Italy's data protection authority blocked the app in early 2025, while Taiwan, South Korea and Australia barred it from government devices.
It also lands among other federal moves against Chinese technology. The Federal Communications Commission will vote on 29 October on barring all Chinese labs from testing electronic devices for US use, Reuters reported.
Washington is building AI oversight on the domestic side too. The Trump administration's Super Intelligence Force told AI labs at its first meeting to report incidents. This order adds a supply chain rule for which models agencies may run.
With no list of affected products, the first public sign of the order's reach may come from contracting officers' questions to vendors.
