DHS Orders DeepSeek Out of U.S. Federal Civilian Systems

U.S. federal civilian agencies now have to remove DeepSeek products from their IT environments and can no longer buy them. The ban also reaches third-party products and services "developed using DeepSeek implementations." It's only the second time Washington has used its federal supply-chain exclusion authority, and it has direct consequences for every vendor and contractor selling into the federal government.

What happened

Homeland Security Secretary Markwayne Mullin signed a removal and exclusion order dated July 24, 2026 under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). The order was filed for public inspection on October 19 and published in the Federal Register on October 20, 2026, 87 days after it was signed.

Key points of the order:

• Who is covered: Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 models, along with its affiliates as defined in federal acquisition rules.
• What is banned: DeepSeek products already in use must be removed, and no new DeepSeek IT products or services can be bought. The same applies to third-party offerings built on DeepSeek implementations.
• What is not defined: The notice doesn't say what counts as a "DeepSeek implementation." Vendors that bundle or fine-tune open-weight models will have to interpret that themselves.
• Who is not covered: The order applies only to what civilian agencies buy and run. It places no restriction on private companies or the public.
• No stated rationale: The Federal Register notice gives no reasons. The signed order (four scanned pages) is filed on regulations.gov under docket DHS-2026-0628. DeepSeek's own privacy policy says it collects, processes and stores users' personal data in the People's Republic of China.

FASCSA was first used in 2025, when the Director of National Intelligence excluded Swiss data-protection vendor Acronis from intelligence community procurement. Agencies must comply with exclusion orders. They can request an exception from the issuing official, but the request must be in writing and give a compelling justification.

Why it matters: the contractor obligations

Most of the practical impact falls on federal contractors. Under FAR clause 52.204-30, a contractor may not provide or use any product or service covered by a FASCSA order while performing a federal contract, unless the issuing official grants a waiver. The clause also requires contractors to:

• search SAM.gov for "FASCSA order" at least every three months;
• make a reasonable inquiry into their supply chain when a new order could affect them;
• report any covered product or service they have provided or used to the contracting officer within 3 business days of identifying it;
• follow up with mitigation details within 10 business days;
• flow the clause down to their subcontracts.

For existing contracts, an order issued after the solicitation applies only once the contracting officer adds it through an amendment or modification. Contractors should still treat it as imminent.

The broader context: by February 2025, Congress, NASA, the U.S. Navy, the Pentagon and the state of Texas had already banned DeepSeek on government devices. Bills that would bar it from federal devices had been introduced but had not passed committee as of October 21. China's foreign ministry said Beijing "consistently opposes the overstretching of the concept of national security" and would protect the interests of Chinese companies.

What to do

1. Inventory your AI usage. List every place DeepSeek models, APIs or SDKs show up in your products, internal tools, CI pipelines and SaaS integrations. Include developer laptops and browser extensions.
2. Check what's inside third-party components. The "developed using DeepSeek implementations" wording points to embedded and derivative use. Ask your suppliers directly which models power their AI features.
3. Map it to your federal contracts. If you sell to U.S. civilian agencies, find out where FAR 52.204-30 applies, set up the quarterly SAM.gov check, and prepare a 3-day / 10-day reporting process.
4. Document your interpretation. Until "DeepSeek implementations" is defined, write down how you draw the line (hosted API, open weights, fine-tunes, distilled models) so you can defend it to a contracting officer.
5. Review data flows. Whatever your regulatory exposure, check which data you send to any externally hosted AI model and where it ends up.

Finding a model dependency buried in a codebase is a software supply-chain problem. Our team's AI-assisted code review inventories the third-party libraries, SDKs and model integrations in your source, so you can show exactly where a restricted component is used and where it isn't.

Source: The Hacker News — "U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases" (October 21, 2026). Summarized and analyzed by the 4Tify team.