DHS Orders DeepSeek Products Removed From Federal Civilian Agency Systems and Contracts

The U.S. Department of Homeland Security has ordered all federal civilian agencies to stop buying products and services from Chinese AI company DeepSeek and to remove the ones they already use, according to a notice filed for public inspection in the Federal Register on October 19, 2026. The removal also covers third party products and services developed using DeepSeek implementations, the notice says.

The notice is scheduled for formal publication on October 20, 2026 and makes public an order issued under the Federal Acquisition Supply Chain Security Act of 2018, a law that lets DHS cut risky technology out of civilian agency systems. It turns an earlier push in Washington's AI policy toward DeepSeek into binding rules for agencies: on February 6, 2025, Representatives Darin LaHood and Josh Gottheimer introduced the No DeepSeek on Government Devices Act to keep the app off federal phones. Bloomberg and The Wall Street Journal also reported on the order.

What exactly does the DHS order require?

The DHS order requires federal civilian agencies to exclude DeepSeek, its affiliated entities and their products from procurement immediately, and to remove DeepSeek products from their IT systems or request an exception, according to the signed order attached to the October 19, 2026 notice.

The procurement ban extends to agency approved product lists, service provider equipment lists, e-commerce markets and similar channels for buying hardware, software and services. A footnote to the removal requirement says it includes "third party implementations of DeepSeek used to provide products and services to civilian agencies." Engadget names the Environmental Protection Agency and the Federal Communications Commission as examples of agencies that fall under it.

Until removal is complete, the order encourages agencies to monitor traffic in and out of their networks, add logging and data exfiltration controls, and flag anomalous activity. The Cybersecurity and Infrastructure Security Agency (CISA) may give technical help to agencies that lack the capacity to comply, and the Secretary of Homeland Security will review the order within one year and every year after.

Why does DHS say DeepSeek is a risk?

DHS says DeepSeek's models "present multiple threat vectors," pointing to servers located in China and a Chinese legal system that, in the order's words, gives government cyber and intelligence functions extensive authority to access private company infrastructure.

The order lists several specific concerns. It says DeepSeek's account signup collects personally identifiable information and may also track and digitally fingerprint users, and that prompts sent to DeepSeek-hosted models could move sensitive data about U.S. government employees or vendors to China. Combined with public data, that information "could produce actionable intelligence on U.S. persons and/or government programs," the order says.

As support, the order cites DeepSeek's own privacy policy, an April 2025 report by the House Select Committee on the Chinese Communist Party and a February 2025 finding by security firm NowSecure that DeepSeek's iOS app had multiple critical vulnerabilities. These are DHS's stated reasons; the order does not describe a specific incident involving a federal agency.

When was the order signed, and who does it cover?

The signed order, numbered Exclusion and Removal Order #2026-01, lists an original release date of July 24, 2026 and is signed by Secretary of Homeland Security Markwayne Mullin, with Office of Management and Budget Director Russell Vought copied, according to the copy attached to the Federal Register notice.

That date matters for how the news reads. Engadget framed the order as coming on the heels of DeepSeek's latest model, but the July 24 date predates DeepSeek's V4.1 Flash 1017 release on October 17, 2026 by almost three months, and also predates the original V4.1 Flash release in September. The notice that made the order public was signed by DHS General Counsel James H. Percival II.

The order covers federal civilian executive branch agencies, except their national security systems and sensitive compartmented information systems. Under the same 2018 law, the Department of Defense, which the order calls the Department of War, and the Director of National Intelligence issue orders for their own systems.

The order also goes much further than the first order under that law. On September 15, 2025, the Office of the Director of National Intelligence excluded Acronis AG and its affiliated organizations, but only for intelligence agencies and contracts involving sensitive compartmented information systems, according to an analysis by law firm Covington.

What we don't know yet

• How agencies and CISA will interpret "DeepSeek implementations", for example whether a DeepSeek open weight model run on an agency's or vendor's own servers counts.
• Why the order dated July 24, 2026 was filed for public inspection only on October 19, 2026, and how many agencies have already removed DeepSeek products.
• How the 60 day window for exception requests, counted from issuance, applies when the order became public almost three months after its release date.
• Whether DeepSeek will respond to the order or challenge it.