The US Department of Homeland Security has ordered federal civilian agencies to strip DeepSeek's artificial intelligence products out of their information technology and to stop buying them. A notice filed for public inspection at the Federal Register on Monday, October 19, 2026, and scheduled for formal publication on October 20, discloses Exclusion and Removal Order #2026-01, issued under the Federal Acquisition Supply Chain Security Act of 2018. Reuters and Bloomberg Law both reported the move on Monday.
The order has two parts. Agencies must exclude Hangzhou DeepSeek Artificial Intelligence and its affiliates from civilian procurement, effective immediately, covering approved product lists, e-commerce marketplaces and similar buying channels. They must also remove products supplied by DeepSeek or its affiliates, along with third-party products and services developed using DeepSeek implementations, from their systems. A footnote states that third-party implementations of DeepSeek used to serve civilian agencies are included, so vendors that build on the company's models fall within scope, not only DeepSeek's own app and website.
The signed order attached to the notice carries an original release date of July 24, 2026 and the signature of Homeland Security Secretary Markwayne Mullin, with Office of Management and Budget Director Russell Vought copied. It covers civilian executive branch agencies but excludes their national security systems and sensitive compartmented information systems; the law leaves defense and intelligence systems to the Defense Secretary and the Director of National Intelligence. DHS General Counsel James H. Percival II signed the public notice. The documents do not explain why the order surfaced almost three months after its release date.
DHS grounds the decision in data and security risks. The order says DeepSeek's servers sit in China, where the legal system gives government cyber and intelligence services broad authority to access private company infrastructure. For DeepSeek-hosted models, it says account creation collects personally identifiable information and may track and fingerprint users, and that the prompts people type may result in sensitive data reaching China if government employees or vendors use the service. It adds that the models may contain malware or other vulnerabilities, citing outside research that found several critical flaws in DeepSeek's iOS app. Reuters quoted the department as saying the models present "multiple threat vectors".
Agencies that cannot comply at once have a narrow path. They may ask the DHS issuing official for an exception, including a delay, but written requests are due within 60 days of the order's issuance and must include a compelling justification and any alternative mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) reviews those requests. Until removal is finished, agencies are encouraged to monitor traffic, strengthen logging and controls against data exfiltration, and flag anomalous activity. CISA may offer technical help, and the Secretary must review the order within a year and every year after that.
The measure goes well beyond earlier attempts in Congress. The House version of the No DeepSeek on Government Devices Act, introduced in February 2025, is still listed at the introduced stage, with a referral to committee as its latest action. Bloomberg Law noted that DeepSeek has drawn scrutiny in Washington since its R1 model rattled markets early last year, and that its cheaper open-weight models are an increasing challenge to Silicon Valley developers.
Practical questions remain. The documents name no specific products, give no method for finding DeepSeek components inside commercial software, and say nothing explicit about open-weight DeepSeek models that a contractor runs on its own servers, beyond the general reference to third-party implementations. No public response from DeepSeek was found during verification. For federal suppliers, the immediate task is an inventory of where DeepSeek models sit inside the services they sell to civilian agencies.