The US Department of Homeland Security (DHS) has ordered the removal of DeepSeek products and certain related services from federal civilian executive-branch information technology systems, while also excluding those products and services from covered federal civilian procurement. The order was disclosed in a Federal Register notice made public on October 19, 2026, with formal publication scheduled for October 20.

The measure is a supply-chain security action aimed at government systems and purchasing—not a general prohibition on DeepSeek for everyone in the United States. Its scope also reaches some third-party products and services developed using DeepSeek implementations, making the notice relevant to agencies and contractors that may use the technology indirectly.

The official notice identifies the order as Exclusion and Removal Order #2026-01 and says it was originally issued on July 24, 2026. It invokes the Federal Acquisition Supply Chain Security Act (FASCSA) of 2018. The government’s stated concern is that DeepSeek products may expose sensitive information to the People’s Republic of China when used by federal employees or vendors.

What the DHS order says

According to the official Federal Register notice, DHS is taking two principal actions. First, it excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., including covered affiliated entities, from federal civilian agency procurements. Second, it directs the removal of DeepSeek and covered affiliate products, as well as third-party products and services developed using DeepSeek implementations, from civilian agency IT systems.

The order is grounded in FASCSA, a federal law designed to help the government address supply-chain risks in information and communications technology. Under this framework, designated officials can require agencies to stop acquiring particular products or services and remove them from covered government systems when the statutory process and relevant findings support that action.

The notice says the Secretary of Homeland Security acted after reviewing a recommendation from the Federal Acquisition Security Council (FASC) and associated evidence. The order is directed at the federal civilian executive branch. The document expressly excludes national security systems and secure compartmented information systems from its stated scope.

That distinction matters. The action does not, on its face, establish a blanket ban on every use of DeepSeek by private individuals, universities, state governments, or commercial businesses. Other laws, procurement rules, or organizational policies may impose separate restrictions in particular settings, but those are distinct from this specific DHS order.

Why the US government is concerned about DeepSeek

The notice describes DeepSeek as a privately owned company based in China and says its AI applications present multiple potential threat vectors. The central concern described in the document is the possibility that sensitive information could be transferred to the People’s Republic of China when federal employees or government vendors use affected products.

That concern fits into a broader government focus on software supply chains. AI tools can process prompts, uploaded files, source code, internal documents, and other data that users provide during ordinary work. For government organizations, the security question is not only whether a model produces accurate answers; it is also where data is processed, what information a service retains, which systems it connects to, and what contractual or technical controls apply.

The Federal Register notice sets out the government’s risk rationale, but the public summary should not be read as independent proof that every DeepSeek deployment has transferred sensitive data. The order is an official security and procurement determination. The public-facing document provides the government’s stated basis for action, while organizations evaluating technical risks should distinguish those stated concerns from independently demonstrated incidents.

Reuters reported on October 19 that DHS cited the risk of sensitive data being transferred to China if DeepSeek products were used by government employees or vendors. The Reuters report also describes the restriction on future acquisition by civilian agencies.

Which products and services are covered?

The notice does not limit its language to a single DeepSeek-branded application. Its stated scope includes products and services developed by DeepSeek, covered affiliated entities, and third-party products or services developed using DeepSeek implementations.

The third-party provision is significant because AI technology can be incorporated into another company’s application, development workflow, or service. A government agency may therefore need to examine more than the list of applications installed directly by employees. Procurement teams and IT administrators may need to determine whether a product or service falls within the order’s wording and whether its use is covered by the agency’s implementation obligations.

However, the notice’s wording should not be stretched beyond what it says. It does not mean every product that has ever interacted with DeepSeek is automatically covered. The relevant question is whether the product or service meets the definitions and conditions in the official order. Agencies and suppliers should consult the notice and the applicable implementation guidance rather than relying on a broad interpretation of headlines.

For the same reason, the order should not be described as a universal ban on all open-weight AI models, all Chinese AI products, or all third-party software that offers AI features. The published action specifically identifies DeepSeek products and services, covered affiliates, and certain third-party products and services developed using DeepSeek implementations.

What does the order mean for federal agencies and contractors?

For affected federal civilian agencies, the notice creates a procurement and IT-management issue. Organizations may need to identify covered products, review software inventories, assess whether third-party services incorporate affected implementations, and follow the applicable government process for removal and future purchasing restrictions.

Contractors and technology suppliers that provide services to civilian agencies may also need to review their offerings and procurement documentation. A service that includes a model or implementation as one component may require a more detailed technical review than a simple brand-name search can provide. The exact obligations depend on the order’s terms and the relevant agency or contract requirements.

The public notice does not provide a specific agency-by-agency completion deadline in its summary. Readers should therefore avoid assuming a deadline that is not stated in the published material. Agencies should follow official implementation instructions and any subsequent guidance rather than infer a schedule from news coverage.

The order also illustrates why AI procurement reviews increasingly need to account for the underlying technology stack. A product’s user interface or vendor name may not fully reveal which model or implementation is running behind the scenes. Government buyers may need clear supplier disclosures, inventories of embedded AI components, and documented processes for checking whether software remains compliant with current procurement rules.

How the order fits into US AI and cybersecurity policy

The action is part of a wider policy debate about AI, data governance, and national security. Governments are assessing not only model capabilities but also the risks associated with vendors, data handling, software dependencies, and the use of AI in sensitive environments.

The FASCSA framework is specifically designed for supply-chain security in federal information systems and procurement. It gives the government a process for restricting identified products and services where supply-chain risks warrant action. In this case, DHS says it reviewed a Federal Acquisition Security Council recommendation and supporting evidence before issuing the order.

The measure should be understood in that legal and administrative context rather than as a general evaluation of DeepSeek’s model quality. The notice concerns whether products and services are appropriate for covered federal systems and procurement. It does not provide a comparative performance assessment of DeepSeek against US-developed AI models, and it does not establish that every use of the technology outside the order’s scope is unlawful.

For businesses outside the affected federal procurement environment, the announcement is still relevant as a signal to monitor AI vendor risk and contractual requirements. Organizations handling sensitive information can review data flows, retention terms, model hosting, access controls, and third-party dependencies as part of their own security processes. Those are prudent risk-management steps, not new legal requirements imposed on every private organization by this particular order.

What remains unclear

Several details should be confirmed from official implementation guidance as it becomes available. The public notice’s summary does not specify a single removal deadline for every affected agency, nor does it provide a complete public inventory of every third-party product that could be captured by the order. Determining whether a particular service is covered may require technical and procurement review.

It is also important to distinguish the date of the underlying order from the publication schedule of the notice. The Federal Register document identifies July 24, 2026, as the order’s original release date. The notice itself was made available for public inspection on October 19 and scheduled for formal publication on October 20. These are different dates and should not be conflated.

The most reliable source for the order’s scope is the official Federal Register document, including the linked public-inspection PDF. News organizations provide useful reporting and context, but their summaries do not replace the legal text.

Frequently asked questions

Has the US banned DeepSeek for everyone?

No. This specific order applies to covered federal civilian executive-branch IT systems and procurement. It is not written as a nationwide ban on personal or general commercial use.

Does the order cover third-party services?

Yes, the notice includes certain third-party products and services developed using DeepSeek implementations, as well as DeepSeek and covered affiliate products. Whether a particular product falls within the order should be determined from the official wording and applicable guidance.

Why did DHS issue the order?

The notice says DHS identified multiple potential threat vectors, including the risk that sensitive data could be transferred to China when affected products are used by government employees or vendors. That is the government’s stated rationale for the supply-chain action.

When was the order issued?

The official document identifies July 24, 2026, as the original release date. The Federal Register notice was available for public inspection on October 19, 2026, and scheduled for publication on October 20.

Does this order prohibit every Chinese AI model?

No. The published order specifically addresses DeepSeek products and services, covered affiliates, and certain third-party offerings using DeepSeek implementations. It should not be generalized into a ban on every Chinese AI model.

Sources and further reading

For related coverage, read our report on running DeepSeek V4.1-Flash locally on two NVIDIA DGX Spark systems.

The bottom line

The DHS order directs covered US federal civilian agencies to remove DeepSeek products and specified related services from their IT systems and bars their future acquisition under the federal supply-chain security framework. Its scope includes certain third-party services using DeepSeek implementations, but it is not a universal prohibition on DeepSeek for the public. The official Federal Register notice is the controlling source for the order’s details; agencies, contractors, and suppliers should use that text and official implementation guidance to determine their obligations.