DHS Orders DeepSeek and Wrapped Tools Off Civilian Systems

Homeland Security has ordered U.S. civilian agencies to stop buying DeepSeek and to strip the Chinese lab’s products, and tools built on them, from federal IT. Secretary Markwayne Mullin signed that supply-chain order on July 24, 2026.

The public saw it only when the department filed notice on October 19, 87 days later, for Federal Register publication on October 20. The order bars Hangzhou DeepSeek Artificial Intelligence Co., Ltd from civilian contracts and reaches software from other firms that runs on DeepSeek models.

Tools Built on DeepSeek Weights Are in Scope

Most earlier DeepSeek limits named an app on a work phone. This one names a supply chain. Exclusion and Removal Order 2026-01 tells civilian executive branch agencies to stop buying information technology from DeepSeek and its affiliates, and to take DeepSeek products off their systems. It also orders removal of third-party products and services developed using DeepSeek implementations.

That second clause is the part that lands on vendors who never put the DeepSeek name on a box. A footnote in the signed order extends the removal to third-party implementations used to provide products and services to civilian agencies, so a wrapper, a hosted assistant, or a backend that calls DeepSeek weights can fall inside the same purge as the company’s own chatbot.

The order does not define an implementation. DeepSeek publishes open weights that any shop can download and run on its own machines, including machines in the United States. A product that never sends a prompt to a server in China can still sit in scope when it is sold into a civilian agency, because the test is how the product was built, not where the inference runs.

National security systems and secure compartmented information systems are carved out. Those sit under separate Defense and intelligence authorities. The civilian lane is the one this order closes.

The Order Sat Unpublished for 87 Days

Mullin signed Order 2026-01 with an original release date of July 24, 2026, and copied Office of Management and Budget Director Russell Vought. DHS filed the public notice at 8:45 a.m. on October 19, 2026, as Federal Register document 2026-21447, docket DHS-2026-0628. James H. Percival II, the department’s general counsel, signed that notice.

The signed order tells agencies to seek an exception in writing within 60 days of issuance. Counted from July 24, those 60 days ended on September 22, 2026, 27 days before the public filing. Agencies reading the notice in October are looking at an exception deadline that, on the face of the signed order’s own date, has already passed.

THE ORDER’S PUBLIC CLOCK

1. July 24, 2026: Mullin issues Exclusion and Removal Order 2026-01 for civilian agencies.
2. September 22, 2026: Sixty days after that release date, the written-exception window ends if the clock started at issuance.
3. October 19, 2026: DHS files the notice and the signed order for public inspection at 8:45 a.m.
4. October 20, 2026: The Federal Register lists this as the publication date.

A supply-chain order can bind agencies and their vendors before the companies it names can read it. That is the practical effect of pairing an immediate effective date with a filing that arrives in the third month.

What the DeepSeek Removal Order Requires

The exclusion and removal order notice does two jobs at once. It shuts DeepSeek out of civilian buying channels, including approved product lists and e-commerce markets, and it tells agencies to pull covered articles already on their networks, or to ask for an exception. Both steps are effective immediately after issuance unless that exception is granted.

WHAT ORDER 2026-01 REQUIRES

Until removal is finished, Mullin encouraged agencies to watch traffic in and out of their networks, add logging, tighten controls on data leaving the building, and flag odd activity. DHS also committed to review the order within one year and every year after that. Questions on the notice go to CISA’s FASCSA Order Implementation Team.

Mullin Warns of Data Flow to Beijing

Mullin wrote that DeepSeek models present “multiple threat vectors” to civilian agency systems. The case in the order is about where data sits and who can demand it. DeepSeek servers are in the People’s Republic of China, and Chinese law gives state cyber and intelligence services wide reach into company infrastructure.

Account creation on DeepSeek-hosted models collects personal information and can fingerprint users. Prompts from government staff or vendors can carry sensitive material with them. DHS said use of the product “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors.”

The transfer of the aforementioned information to the People’s Republic of China, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs.

Markwayne Mullin, Secretary of Homeland Security, Exclusion and Removal Order 2026-01

The order adds that the models themselves may contain malware or other security holes, and that DeepSeek-related apps can generate inaccurate, biased, or harmful content. The Federal Acquisition Security Council’s underlying evidence file is not in the public notice. The appendix points to DeepSeek’s privacy policy, a House Select Committee on the Chinese Communist Party report dated April 16, 2025, and a NowSecure analysis from February 6, 2025 that found critical flaws in DeepSeek’s iOS app.

NowSecure, a Chicago mobile-security firm, urged enterprises and agencies that day to stop using the iOS app until those holes were fixed. It said it had not studied the Android build. Several of the privacy points Mullin lists could be written about other chatbots, including U.S. ones; the China-sited servers and the Chinese legal reach are the parts that are unique to this target. DeepSeek is the only Chinese model named in the order.

A 2018 Law Now Binds Civilian Contractors

The legal hook is the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328, and the rules at 41 CFR 201-1. That statute is Title II of the SECURE Technology Act. It created the Federal Acquisition Security Council, an interagency body charged with recommending exclusion or removal orders when a covered article poses too great a risk to federal systems.

The Homeland Security secretary issues those orders for civilian agencies. The Defense secretary and the Director of National Intelligence issue counterpart orders for their own systems. CISA staffs the council’s information-sharing work. Mullin acted after reviewing a council recommendation and the evidence that came with it.

The order does not stop at the agency help desk. Federal contractors on civilian awards already live under a FAR ban on prohibited covered articles. That clause tells them not to provide or use a source or article that a FASCSA order has barred, unless a waiver is in place, and it applies to subcontractors on the same work.

WHAT CIVILIAN VENDORS MUST DO

• Stop selling covered gear: Do not offer DeepSeek, affiliate products, or tools built on DeepSeek implementations to civilian agencies.
• Inventory the model stack: Check whether any product on a civilian contract, including a U.S.-hosted build, was developed using DeepSeek weights.
• Watch the contract clause: FAR 52.204-30 treats a DHS FASCSA order as binding on civilian awards, and a contracting officer can force a swap.

The hard part is the inventory. DeepSeek’s weights are public, cheap to run, and easy to hide behind another brand. Changing the label on a chatbot does not take it outside the order if the model underneath is DeepSeek. CISA had not, in the public filing, published a list of commercial products that count.

NASA, the Navy and a Bill That Never Passed

Civilian agencies were the remaining gap. The Defense Information Systems Agency blocked DeepSeek on Pentagon networks in late January 2025, after defense staff had reached the chatbot from work machines. NASA’s chief artificial intelligence officer told staff on January 31, 2025 that DeepSeek was not authorized on agency data, devices, or networks, because its servers operate outside the United States. Navy correspondence that same month told personnel to avoid DeepSeek under standing rules against public open-source AI for official work. The Commerce Department barred it on work devices. New York, Tennessee, and Virginia took similar steps on state systems.

Congress tried to write a government-wide app ban and did not finish the job. On February 7, 2025, Rep. Josh Gottheimer of New Jersey introduced the No DeepSeek on Government Devices Act with Rep. Darin LaHood of Illinois. The bill would have directed the Office of Management and Budget to pull the DeepSeek application, and successor apps from High Flyer, off federal information technology. It was referred to the House Committee on Oversight and Government Reform and did not become law.

In June 2026, DeepSeek was still off the Commerce Department’s Entity List. People familiar with the process said an interagency committee had already approved the company, memory chipmaker CXMT, and more than 100 other Chinese firms for that list, and that the administration had not published the names. The list had seen no new additions since October 2025. The civilian DeepSeek purge arrived through procurement law instead of export control.

Sen. Tom Cotton of Arkansas called the civilian order the right move and said the government should not rely on Chinese AI models.

This is the right move by @DHSgov.

The U.S. government shouldn’t rely on Communist Chinese AI models, including DeepSeek.https://t.co/aJTQDmsJ2U

— Tom Cotton (@SenTomCotton) October 19, 2026

U.S. labs have separately accused Chinese firms, DeepSeek among them, of copying American models through distillation. That fight is not what this order cites. The filing’s own evidence list is the privacy policy, the House report, and the iOS study. DeepSeek had not issued a public comment on the notice as of the evening of October 19, and the Chinese embassy in Washington did not immediately comment. CISA’s FASCSA team is the contact printed on the notice.

Frequently Asked Questions

Does the DHS DeepSeek Order Ban the Chatbot for Ordinary Users?

No. Order 2026-01 binds federal civilian executive branch agencies and the vendors who sell them IT. It does not restrict private companies, universities, or state and local governments, and DeepSeek’s consumer app remains available to the public.

Who Is Hangzhou DeepSeek Artificial Intelligence?

It is a Hangzhou company founded in 2023. The House bill summary identifies High Flyer, a hedge fund created by DeepSeek’s chief executive, as the lab’s reported sole funder, and the order’s affiliate test follows the definition in 48 CFR 2.101 rather than the DeepSeek brand name alone.

What Is a FASCSA Order?

It is an exclusion or removal order issued under the Federal Acquisition Supply Chain Security Act, Title II of the SECURE Technology Act signed December 21, 2018. The Federal Acquisition Security Council recommends the order; the Homeland Security secretary issues it for civilian agencies, while Defense and the Director of National Intelligence issue counterpart orders for their systems.

Does This DHS Order Cover the Pentagon and Intelligence Agencies?

No. National security systems and secure compartmented information systems are excluded from Order 2026-01. The Defense Information Systems Agency’s January 2025 step was a network block of the chatbot on Pentagon IT, a different tool from a civilian FASCSA order, and Defense and intelligence FASCSA orders are issued by those authorities, not by DHS.

Where Do Federal Contractors Check for FASCSA Orders?

FAR 52.204-30 tells contractors to search the System for Award Management at SAM.gov for the phrase FASCSA order and to treat a listed DHS order as applying to civilian awards. The DeepSeek notice also points implementation questions to CISA at fascsa.orders@cisa.dhs.gov.