DeepSeek is out of US civilian agencies, and so is software built on it

The US Department of Homeland Security has ordered civilian federal agencies to stop buying DeepSeek products and to take them out of their IT systems. The order also reaches past DeepSeek itself: agencies must remove "third-party products and services developed using DeepSeek implementations."

The order, Exclusion and Removal Order #2026-01, carries an original release date of July 24, 2026 and is signed by Homeland Security Secretary Markwayne Mullin, with Office of Management and Budget director Russell Vought copied. It was not public until DHS filed a notice in the Federal Register on Monday, Oct 19; the notice, with the signed order attached, was published on Tuesday, Oct 20. DHS used its powers under the Federal Acquisition Supply Chain Security Act of 2018, after a recommendation from the Federal Acquisition Security Council.

What it requires. Two things, both effective "immediately after issuance." First, exclude DeepSeek, DeepSeek-affiliated entities and their products from civilian agency procurement, including approved-product lists and e-commerce buying channels. Second, remove products provided by DeepSeek and its affiliates, and third-party products and services built using DeepSeek implementations, from agency IT systems. Until removal is complete, agencies are encouraged to monitor traffic, add logging and data-exfiltration controls, and flag anomalous activity. CISA, the government's cyber defence agency, may provide technical help.

Why DHS says it acted. The order says DeepSeek's models "present multiple threat vectors." It points to DeepSeek's servers being in China, Chinese law giving the state broad access to company data, DeepSeek's account sign-up collecting personal information, and prompts from government staff or vendors potentially sending sensitive data to China. It also says the models "may contain malware or other security vulnerabilities" and cites 2025 research by the security firm NowSecure that found critical flaws in DeepSeek's iOS app.

Who it covers. Federal civilian executive branch agencies, which CNBC notes includes Treasury, State and Justice. It does not cover the Defense Department or the intelligence community, which issue their own orders, and it excludes national security systems. Nothing in it applies to private companies or individuals.

The part for AI vendors. If you sell software or services to a civilian agency and your product runs on a DeepSeek model, it is in scope. The order does not define "DeepSeek implementations" beyond a footnote that says the term includes third-party implementations of DeepSeek used to provide products and services to civilian agencies. It does not say whether a model fine-tuned from DeepSeek weights, or self-hosted on a US cloud, counts. Expect procurement teams to start asking which models sit under the tools they buy.

The catch on exceptions. Agencies can ask DHS for an exception, such as a delay, but the request has to be made in writing "within 60 days of the issuance of this order." By our count, 60 days from July 24 ran out around Sept 22, about a month before the order was made public. The published notice doesn't say when agencies themselves received the order. Either way, vendors and the public are learning the rules after the window.

The response. China's foreign ministry told Reuters it would safeguard the rights of its companies; spokesperson Mao Ning said China "consistently opposes the over-generalization of national security," as reported by CNBC. DeepSeek did not immediately respond to CNBC. The new order extends earlier, narrower limits: CNBC and TechCrunch note that Congress restricted DeepSeek in intelligence community systems in December 2025.

Our take. The headline is about a Chinese chatbot. The practical change is the supply-chain clause. "Which model is inside?" is now a federal procurement question, and vendors who swap models behind a stable product name should be ready to answer it in writing.

What we did and didn't do: we read the Federal Register notice and the signed order in full on Oct 20. China's response and the list of covered departments come from CNBC's reporting; background on earlier restrictions comes from CNBC and TechCrunch. We are not lawyers, and this is not legal advice. Not sponsored, no affiliate links.

MODEL Editors