The Department of Homeland Security has ordered DeepSeek out of U.S. federal civilian agencies — and the order reaches well past the Chinese company’s own app. In a filing made public on Monday, DHS barred civilian agencies from buying DeepSeek products and told them to remove not only DeepSeek’s own software but any third-party products and services built on its models, Reuters reported.
The instrument is Exclusion and Removal Order #2026-01, issued under the Federal Acquisition Supply Chain Security Act of 2018 after a review by the Federal Acquisition Security Council. It was filed for public inspection on October 19 and scheduled for publication in the Federal Register on October 20. The order itself, signed by Homeland Security Secretary Markwayne Mullin, is dated July 24 — meaning the ban has existed on paper for nearly three months and has only now become public.
The ban follows the model, not the logo
The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated entities. On the buying side, their information technology products and services are excluded from federal civilian agency purchases. On the removal side, agencies must take DeepSeek and affiliate products off their information systems — along with, in the order’s own phrasing, “third-party products and services developed using DeepSeek implementations.”
That clause is the consequential part. DeepSeek’s models are open and widely reused, so a tool can carry another company’s name on the outside and DeepSeek technology underneath. Under this order, that is enough to put it in scope: agencies, and the vendors who sell to them, now have to know which underlying models their software is built on, not just whose logo is on the contract.
What DHS says the risk is
DHS said DeepSeek’s models present “multiple threat vectors” for federal systems. Use of the product “may result in the transfer of sensitive data to the PRC if used by US government employees or vendors,” the department said, and could “produce actionable intelligence on US persons and/or government agencies. The models themselves may contain malware or other security vulnerabilities.” SiliconANGLE reported that the order also warned the technology could be used to track or digitally fingerprint users.
Those are the department’s stated assessments, not findings from a specific public incident — no source reporting the order describes a particular transfer of federal data. In a separate July memo made public on Monday, DHS told federal agencies to monitor flows of traffic in and out of government websites to address potential risks from DeepSeek, Reuters reported.
A narrow exception door, and no finish line
Both the exclusion and the removal take effect immediately after issuance unless an agency obtains an exception. Agencies could ask DHS in writing within 60 days of the order, offering a compelling justification — for example, that a mission-critical function would fail — along with proposed mitigations; DHS then approves or denies the request in writing. Agencies that cannot comply on their own can ask the Cybersecurity and Infrastructure Security Agency for technical help, and the secretary must review the order within a year and annually after that.
The limits matter as much as the reach. The order covers civilian executive branch agencies; national security systems and secure compartmented information systems sit under separate authorities, and it does not cover the Department of Defense. It is also not a nationwide ban: private businesses and consumers are not ordered to remove anything. And DHS published no deadline by which agencies must finish the removal.
The latest step in a longer squeeze
DeepSeek has been in Washington’s sights since it stunned the industry in 2025 with its R1 model, which was trained using less powerful chips at a fraction of the cost of some American rivals and outperformed models from OpenAI and Anthropic in several complex tests. The Commerce Department last year banned DeepSeek from government devices, the U.S. Navy directed its members not to use the model, and New York, Tennessee and Virginia imposed their own restrictions on state personnel. Lawmakers introduced the No DeepSeek on Government Devices Act in February 2025.
This order is broader than those device-level bans, because it governs procurement and systems, and because of the third-party clause. It lands in the same policy current as other recent federal AI oversight efforts — including a frontier safety bill that Anthropic has been pitching to Congress — in which the government’s leverage is increasingly exercised through what it buys and what its vendors are allowed to build on. The Chinese Embassy in Washington did not immediately comment on the order, according to reports of the filing. What agencies find when they inventory their systems for DeepSeek-derived components will decide how large this ban turns out to be.
