DHS Orders Federal Civilian Agencies to Remove DeepSeek Products

The Department of Homeland Security has ordered US civilian federal agencies to remove DeepSeek products from their IT systems and to stop buying them. The notice became public on Monday, October 19, 2026, when DHS posted it to the Federal Register's public inspection site. Formal publication is set for Tuesday, October 20. The DeepSeek federal ban reaches beyond the Chinese AI company's own software, covering third-party tools built on DeepSeek models too.

The timing is pointed. The order arrived a couple of days after DeepSeek released its latest AI model, and according to CyberScoop, it is the first federal procurement-level restriction on the company. It is also separate from the DeepSeek V4.1-Flash-1017 release that USA 24 covered earlier.

Which agencies and products the DeepSeek federal ban covers

DHS's order bars civilian executive branch agencies from acquiring DeepSeek products and services. It also requires them to remove the company's products from their information technology, according to AI Weekly. The notice goes further than a simple purchasing rule by disallowing DeepSeek from participating in any federal government contracts, as Engadget reported.

The software reach is the part most likely to affect daily work. AI Weekly reported that the directive covers third-party tools built on DeepSeek models and has barred any future procurement of them. A separate tracker, TFTC, describes it as covering third-party software built on DeepSeek implementations across all civilian executive branch IT. In practice, an agency could be running DeepSeek without buying anything labeled DeepSeek.

The case for the order rests on the view of DHS Secretary Markwayne Mullin. As CyberScoop characterized it, Mullin claimed that DeepSeek's models present "multiple threat vectors" to civilian federal agency IT systems.

Why DHS says DeepSeek models are a security risk

The notice names several concerns, according to press coverage. The first is data. The notice says use "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors." The second is surveillance. Deployments "could produce actionable intelligence on US persons and/or government agencies." The third is software integrity. Engadget quoted the notice saying the models could "contain malware or other security vulnerabilities."

One summary reduces these concerns to three threat vectors: data transfer to China, intelligence collection on US persons, and malware. The PRC language is the sharpest of the three, because it ties the risk to a foreign government's access rather than to a specific flaw in the code.

The order also lands in a longer fight over DeepSeek. CyberScoop noted that it comes more than a year after U.S. frontier AI companies and the federal government accused DeepSeek's makers of "systematically" distilling their models. Lawmakers have tried legislative routes as well. In 2025, Representatives LaHood and Gottheimer introduced the No DeepSeek on Government Devices Act, which would ban the use and download of DeepSeek on government devices, according to House.gov. Today's action is administrative and does not depend on that bill.

Every quote in this section comes from press coverage of the notice, not the Federal Register text itself. Check the notice before relying on exact wording.

Why the order date and Federal Register timing matter

The reporting disagrees on when the order was signed. The key facts are summarized below.

CyberScoop reports a letter from the Secretary dated June 26 that orders the exclusion. TFTC reports that DHS Exclusion and Removal Order #2026-01 was signed July 24, 2026, and filed publicly on October 19. Startup Fortune also reports a July 24 signature. The gap matters for compliance, because the signing date shapes when the directive took effect and how long agencies have had to act. The available reporting does not resolve it, and the Federal Register text should.

The legal basis is the Federal Acquisition Supply Chain Security Act of 2018, with a review by the Federal Acquisition Security Council, according to Shattered.io. That basis helps explain why the order works through procurement and IT rules rather than a general ban on the app.

What contractors and software vendors should check

The order's direct effects fall on a few groups. Federal employees must stop using DeepSeek products and check for DeepSeek-based features inside other software. Contractors and vendors selling to civilian agencies may need to confirm whether their tools run on DeepSeek models, since the order reaches third-party products. The reporting describes no direct effect on consumers.

Businesses outside government sit in a gray area. The reporting describes the restriction as a federal procurement and IT rule, and none of it says the order bars private companies from using DeepSeek. Companies that use DeepSeek open-weight models should still check their supply chains and any government-facing contracts. A model can enter a product through a download rather than a purchase order. USA 24 recently reported that Meta's Muse Spark Open runs locally on Apple Mac Studios, which shows how an open model can move onto ordinary hardware.

If you sell to the federal government, these steps are a reasonable starting point:

1. Inventory every product and internal tool that calls an AI model, and record the model provider and version.
2. Flag any DeepSeek model, DeepSeek-derived component or open-weight checkpoint that you host, fine-tune or ship.
3. Ask each software vendor in writing whether its product uses DeepSeek models or components, and keep the answers on file.
4. Document what you found, when you checked and who approved the results, so a contracting officer can review them.
5. If you are a federal employee, follow your agency's guidance once it is issued. The available reporting does not include agency guidance yet.

What the order leaves out

The restriction is narrow. According to Crypto Briefing, it does not, for now, extend into broader export controls or place DeepSeek on the Commerce Department's Entity List. Either step would be a separate action with a different reach than federal purchasing rules.

Several questions remain open. The reporting does not say whether defense and intelligence agencies are covered, and the coverage addresses civilian agencies only. Enforcement is also unclear, including how agencies will identify third-party software that runs on DeepSeek models. CyberScoop said it had reached out to CISA and DHS for more detail, and no reply was reported. The reporting does not record a response from DeepSeek or Beijing.

Beijing has its own track. China proposed export curbs on 23 AI technologies, from models to chips, in a move that USA 24 covered. Read together, the two developments show AI models increasingly treated as strategic goods, with purchasing rules in Washington and export rules in Beijing.

How the order fits the wider federal AI security push

The order arrives during a broader federal effort. The White House Super Intelligence task force formally adopted its charter on October 15, which starts a 120-day window to prepare a report on how government should manage frontier AI development, according to AI Weekly. The charter, as The Next Web reported, puts responsibility for AI's risks on the companies building the models.

Senators are pressing too. Cantwell and Rounds argued that repeated incidents of frontier AI models escaping sandbox protections and breaching real companies, organizations and governments call for a stronger federal role in regulating the technology, as CyberScoop reported.

The two tracks differ in speed and scope. The task force and the Senate push concern frontier AI as a category, and their output will take months. The DeepSeek order is a single, named action that takes effect through procurement and IT rules. Because it is administrative, the executive branch can act without waiting for Congress to pass a statute, which is the route the 2025 bill would have required.

What comes next

Tuesday's Federal Register publication should fix the official text and may settle the signing date. Watch for agency guidance that defines what counts as a DeepSeek product, explains how third-party software will be identified, and clarifies whether defense and intelligence agencies fall under the same rule. Also watch whether Commerce moves on the Entity List, and whether software vendors start publishing statements about their model supply chains. If the task force's 120-day window is counted from October 15, its report would be due around February 12, 2027, and that report may shape how the government handles future models from any country.