US Orders DeepSeek Out of Federal Civilian Systems, and the Ban Follows the Model Into Third-Party Tools

WASHINGTON — The United States has ordered its civilian federal agencies to remove products built by Chinese artificial intelligence company DeepSeek from their computer systems and to stop buying them, under a Department of Homeland Security order published in the Federal Register on October 20, 2026 — a ban whose most far-reaching feature is that it follows the model into third-party products built on top of it.

Illustration: A government building with server racks and a padlock — an artist's impression, not a photograph of a federal facility.

What Happened

According to a Congressional Research Service summary of the action, on October 20, 2026, the Department of Homeland Security (DHS) published a "Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements" in the Federal Register. The order requires federal civilian executive branch departments and agencies to bar products made by the People's Republic of China-headquartered firm DeepSeek from their networks and to remove any DeepSeek products that may already have been deployed.

The order was signed by Homeland Security Secretary Markwayne Mullin on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018, and published as Federal Register document 2026-21447 (91 FR 66346, docket DHS-2026-0628), according to reporting by The Hacker News and Forkast. It covers Hangzhou DeepSeek Artificial Intelligence Co., Ltd. — the developer of the R1 and V3 models — and its affiliated entities as defined in federal acquisition rules. Crucially, it also covers "third-party products and services developed using DeepSeek implementations," a phrase the notice itself does not define, according to The Hacker News — a gap that leaves agencies and suppliers to work out, case by case, whether a given tool counts.

DHS cited national-security concerns. According to Reuters reporting carried by The Hindu BusinessLine on October 20, DHS said DeepSeek models pose "multiple threat vectors" and raised concerns that use of the product "may result in the transfer of sensitive data to the PRC if used by US government employees or vendors." The department also said use of the tools "could produce actionable intelligence on US persons and/or government agencies" and that "the models themselves may contain malware or other security vulnerabilities." The wording matters: DHS framed the risks as possibilities that justify a precautionary removal, not as proven findings that every covered product transmitted data or contained malicious code — a distinction noted in coverage by Dig.Watch.

The civilian order sits alongside parallel actions. The Congressional Research Service noted that the Department of Defense issued a similar action on September 8, 2026, and the Director of National Intelligence issued a similar order concurrently with DHS. In other words, the civilian, military and intelligence branches each moved under the same supply-chain law, but this particular order governs only what civilian agencies buy and run. It does not restrict companies or the public from using DeepSeek products, The Hacker News emphasised.

Illustration: A network of software components protected by a shield, symbolising AI supply chain security — an artist's impression, not a diagram of the order.

Background

DeepSeek rose to global prominence as a Chinese AI lab whose open-weight models offered performance that surprised much larger, better-funded rivals at a fraction of the expected cost. Its models were quickly embedded not only in its own chat products but also in tools built by other developers — the exact pattern that makes the DHS order's third-party clause so consequential. A government agency might never have bought anything directly from DeepSeek, yet still run software that quietly depends on a DeepSeek model underneath.

That pattern explains why the order's cost is expected to fall on integrators rather than on DeepSeek itself, as Forkast's analysis put it: the bill for auditing products, identifying DeepSeek components and replacing them lands on the contractors and vendors who embedded the models. Some US agencies and states had already restricted DeepSeek before the federal order, Dig.Watch noted, but the DHS action creates a single, government-wide requirement for civilian agencies, replacing a patchwork of local decisions with one compliance exercise.

The legal machinery is relatively new. Under the 2018 Federal Acquisition Supply Chain Security Act, the Federal Acquisition Security Council recommends exclusion and removal orders, and three officials may issue them: the Secretary of Homeland Security for civilian agencies, the Secretary of Defense for the military and national security systems, and the Director of National Intelligence for the intelligence community, according to The Hacker News. The law was first used in 2025, when the Director of National Intelligence excluded Acronis, a Swiss cybersecurity company, from intelligence community procurement — a precedent that shows the DeepSeek order is part of a growing, rather than one-off, use of supply-chain powers.

China condemned the order, accusing Washington of politicising technology and harming commercial cooperation between the two countries, according to Blockport's October 20 coverage. The timing added a further twist: on the very day the order was published, DeepSeek announced it had open-sourced DeepInfer, the inference framework it uses to operate large-scale AI services — a reminder that the company's technology continues to spread through open channels even as governments try to fence it out of their own systems.

Why It Matters

The order matters most for what it signals about how governments will now treat AI models: not as ordinary software purchases, but as supply-chain risks that travel inside other products. Until now, a procurement ban usually named a company and its products. This order names a company, its affiliates, and anything built using its implementations — effectively asking every federal technology supplier to prove a negative, or at least to audit its own supply chain well enough to answer the question. That is a new compliance burden, and it will not stay confined to DeepSeek: once a government establishes that model provenance is a procurement issue, every widely used model becomes a candidate for the same treatment.

For the AI industry, the order sharpens a dilemma that open-weight models created. Open models spread fast precisely because anyone can download, adapt and embed them. That openness is a feature for researchers and small developers, but it makes provenance hard to track — and, as this order shows, hard to remove. Vendors that built products on DeepSeek models now face a choice: replace the underlying model, seek an exception, or give up federal civilian customers. Each option costs time and money, and none is as simple as uninstalling an app.

For the US-China technology rivalry, the order is another step in a steady decoupling of government systems, following earlier restrictions by the Commerce Department, the US Navy and several state governments, as Blockport noted. The order does not settle the underlying argument — whether DeepSeek's models actually pose the risks DHS describes, or whether the risks are inherent in any foreign-built model used by government — and DHS's own "may" and "could" language leaves that argument open. What it does settle, for now, is the practical question for civilian agencies: DeepSeek, and anything built on it, has to come out.

Illustration: A developer reviewing code with a compliance checklist — an artist's impression, not a photograph of a federal contractor.

What Happens Next

Compliance is now the main event. Agencies must begin removing covered products immediately, according to Blockport's coverage, and have 60 days to request an exception — a request that must come with supporting justification and proposed mitigation measures, Dig.Watch reported. Those exception requests will be revealing: they will show how widely DeepSeek components had spread into civilian systems, and which capabilities agencies consider hard enough to replace that they are willing to argue for keeping them under safeguards.

Suppliers, meanwhile, face an audit exercise with an undefined key term. Because the order does not define "DeepSeek implementations," vendors will need to ask their own suppliers whether products fall under the ban, and agencies will need to decide how much proof to demand. Expect guidance, questions and disputes in the coming weeks as that definition is tested against real products — and expect other governments and large companies to watch the process, since many face the same provenance question in their own systems.

Longer term, the order points toward a world in which AI procurement comes with a bill of materials, much like food labelling or aircraft parts: not just what a product does, but which models it contains and where they came from. Whether that world makes government systems safer, or simply more expensive and slower to build, will depend on how cleanly the DeepSeek removal goes. If agencies and vendors can audit and replace components without breaking services, the model will spread. If the exercise turns into a long, costly hunt through nested supply chains, it will become a cautionary tale — and either way, it will shape how the next model, from whichever country, is treated when it reaches government desks.

Sponsored: explore today's featured sponsored offers

FAQ

What exactly did the US order?

A Department of Homeland Security order, published in the Federal Register on October 20, 2026, requiring federal civilian agencies to remove DeepSeek and affiliate products, plus third-party products and services developed using DeepSeek implementations, and to stop buying them.

Does the ban apply to ordinary companies or the public?

No. This order covers federal civilian executive branch systems and procurements only, according to The Hacker News. Parallel military and intelligence orders cover their own systems.

Why did DHS say DeepSeek was a risk?

DHS cited concerns that use of the models may result in sensitive data being transferred to China, could produce actionable intelligence on US persons or agencies, and that the models may contain malware or other vulnerabilities — framed as risks, not as proven findings about every product.

What is the "third-party" clause, and why does it matter?

It extends the ban beyond DeepSeek's own products to tools built by other companies using DeepSeek implementations, so suppliers must audit their products for embedded DeepSeek components. The notice does not define "DeepSeek implementations."

Can agencies get an exception?

Yes — written exception requests with supporting justification and proposed mitigation measures may be submitted, and agencies have 60 days to request one, according to coverage by Dig.Watch and Blockport.

Sources

• US Department of Homeland Security, "Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements," Federal Register, October 20, 2026 (91 FR 66346, FR Doc 2026-21447, docket DHS-2026-0628).
• Congressional Research Service, "Removing PRC Artificial Intelligence Models from Federal Agencies," In Focus, October 2026.
• Reuters, "US orders DeepSeek removal from civilian government IT systems over security concerns," via The Hindu BusinessLine, October 20, 2026.
• The Hacker News, "U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases," October 21, 2026.
• Forkast, "DHS Ordered Every Federal Agency to Purge DeepSeek," October 20, 2026.