DHS Bars DeepSeek From Civilian Agency IT

In brief

The US Department of Homeland Security has ordered DeepSeek products excluded from federal civilian agency procurements and removed from civilian agency IT systems.
The order also covers DeepSeek affiliates and third-party products built on DeepSeek implementations, under the Federal Acquisition Supply Chain Security Act.
The published notice sets no removal deadline and applies to civilian executive-branch agencies, not the military, states or the private sector.

The US Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to strip them from their IT estates. For anyone selling into, or building on, US civilian government systems, that closes a procurement path for Hangzhou DeepSeek Artificial Intelligence Co., Ltd and for software that embeds its implementations.

The notice, filed for Federal Register public inspection on 19 October 2026 and scheduled for publication on 20 October, is a FASCSA exclusion-and-removal order. It does not name a compliance deadline in the text we read.

What the order actually requires

DHS says the Secretary of Homeland Security has ordered two things after reviewing a Federal Acquisition Security Council recommendation and affiliated evidence.

First, exclusion: information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, including affiliated entities as defined in the applicable rules, may not be procured by federal civilian agencies. Second, removal: all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, must come off civilian agency information technology.

The legal hook is the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328) and its implementing rules at 41 CFR 201-1. The public notice is signed by James H. Percival II, DHS General Counsel. Implementation questions go to CISA’s FASCSA Order Implementation Team.

That matters because the removal limb is broader than a simple ban on buying DeepSeek’s own apps. Third-party tools that ship DeepSeek models or services inside a civilian agency stack fall within the same order.

Why DHS is acting, and who is in scope

Reuters reported that DHS said DeepSeek models pose “multiple threat vectors” and that use “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors.” Those lines, per Reuters, come from the signed order appendix rather than the short published notice.

The notice itself is clear on scope. It speaks to federal civilian agency procurements and civilian agency information technology. It does not extend, on its face, to the US military, to state or local government, or to private companies that choose to keep using DeepSeek.

Agencies and vendors that need operational detail are pointed to the signed order on regulations.gov under docket DHS-2026-0628, and to CISA at fascsa.orders@cisa.dhs.gov.

Our read

This is TSN’s analysis. A FASCSA exclusion that also sweeps in third-party products built on DeepSeek implementations is a supply-chain move, not just an app ban. Civilian agencies and their contractors will need to inventory where DeepSeek code or services sit in their stacks. The open question is timing: the published notice does not set a public removal deadline, so the next signal to watch is how CISA and the agencies phrase implementation guidance once the order is on the Federal Register.

How we sourced this

The exclusion and removal wording is from the Federal Register public-inspection notice and PDF (2026-21447). The appendix pages in that PDF were blank placeholders, so we could not read the signed order itself there.
The “multiple threat vectors” and PRC data-transfer lines are attributed to Reuters, which says they come from the signed order appendix. Reuters’s page was CAPTCHA-blocked on our fetch.