The United States has formally banned DeepSeek from federal civilian systems. On October 20, 2026, the Department of Homeland Security published an order requiring civilian agencies to remove every product and service developed by DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), its affiliates, and any third-party tool built on its technology from their IT systems, and barring agencies from buying such products in the future. The order, signed by Homeland Security Secretary Markwayne Mullin on July 24, 2026, was issued under the Federal Acquisition Supply Chain Security Act of 2018. It does not restrict private companies, consumers, or state and local governments.
What the DHS order actually says
The Federal Register notice does two things, and both are worth reading carefully. First, it excludes information technology products and services developed by DeepSeek and its affiliated entities from civilian agency procurement. Second, it removes all DeepSeek and DeepSeek-affiliate products from agency IT systems, along with third-party products and services “developed using DeepSeek implementations.”
That last phrase is the part that has compliance teams paying attention. The notice does not define what counts as a “DeepSeek implementation.” A chatbot app that calls DeepSeek’s API is clearly covered. A vendor tool that quietly uses a DeepSeek-derived model under the hood is harder to spot, and that ambiguity is exactly what agencies and contractors will now have to work through.
The order names the company directly: Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the well-known R1 and V3 models. Affiliates are covered under the definitions in federal acquisition rules.
Who the order covers, and who it does not
Under the 2018 law, the power to issue these orders is split between three officials: the Secretary of Homeland Security for civilian agencies, the Secretary of Defense for the Department of Defense and national security systems, and the Director of National Intelligence for the intelligence community. This particular order comes from the DHS Secretary, so it binds federal civilian agencies only.
That includes large departments such as Treasury, State, and Justice. It does not cover:
- Private companies and the general public, who can keep using DeepSeek as before
- State and local governments
- Defense Department and national security systems, which would require a separate order from the Secretary of Defense
- The intelligence community, which would require an order from the Director of National Intelligence
Agencies have 60 days to remove DeepSeek, with exceptions possible
Agencies must strip covered technology from their IT systems within 60 days of the order. That clock puts the practical deadline in mid-December 2026.
Agencies that believe they have a compelling reason to keep using a covered product can ask for an exception. Under the regulations governing these orders, exception requests must be in writing and include a compelling justification, such as an impact on mission-critical functions or a national-security consideration, plus proposed risk mitigations. DHS directs questions about the order to CISA’s FASCSA Order Implementation Team at fascsa.orders@cisa.dhs.gov.
The law also requires the issuing official to notify the company named in the order and the appropriate congressional committees, and to review the order at least once a year. So this is not necessarily permanent: it can be revisited, narrowed, or expanded.
Why federal contractors should read the fine print
The order reaches beyond government employees into the contractor base. A federal contract carrying FAR clause 52.204-30 bars the contractor from providing or using, in performing the contract, any product or service covered by an applicable FASCSA order, unless the issuing official has granted a waiver.
The clause imposes ongoing duties on contractors:
- Search SAM.gov for the phrase “FASCSA order” at least once every three months
- Make a reasonable inquiry into the supply chain whenever a new order could affect them
- Report any covered product or service they have provided or used to the contracting officer within 3 business days of identifying it
- Send further information on mitigation within 10 business days of that report
- Include the clause in their subcontracts, pushing the obligation down the chain
One detail matters for existing work: an order issued after a solicitation applies to an existing contract only once the contracting officer adds it through an amendment or modification. Contractors should not assume they are automatically in or out; the paperwork has to catch up.
For any business that sells to the government, the message is that the provenance of AI technology now counts as a supply-chain security question. If your product embeds or derives from DeepSeek models, expect to be asked about it.
Why this is happening now
The order did not come out of nowhere. US restrictions on DeepSeek started as a patchwork of device bans. By February 2025, Congress, NASA, the Navy, the Pentagon, and the state of Texas had all barred DeepSeek from government devices. Bills to ban it on government devices were introduced in both the House and Senate that month but had not advanced past committee as of October 21.
The DHS order represents a step change: instead of one agency or state banning an app on phones, the federal procurement system itself is being closed to the company’s technology across civilian agencies.
This is also not the first time the 2018 law has been used. Its first exclusion order came in 2025, when the Director of National Intelligence excluded Acronis, a Swiss cybersecurity and data protection company, from intelligence community procurement and ordered its products removed from intelligence community systems.
The Federal Register notice itself gives no reasons for the order. But the concern is not hard to infer. DeepSeek’s own privacy policy says it collects, processes, and stores users’ personal data in the People’s Republic of China. Reporting on the notice described concerns that sensitive data entered into DeepSeek services could be transferred to China or become accessible to Chinese authorities, and that the models could expose government systems to vulnerabilities or other security risks. Security Magazine, working from the public-inspection copy, reported the order describes DeepSeek as presenting “multiple threat vectors” to IT systems.
The China angle
The order lands in the middle of a broader US-China fight over AI. The United States has been restricting China’s access to advanced AI chips and chipmaking equipment, and American officials have claimed that Chinese startups including DeepSeek used a technique called distillation to extract performance from advanced US models at scale, a claim China has denied. Just last week, China put forward measures to restrict exports of some advanced AI models of its own.
Beijing pushed back on the DHS order. At an October 20 briefing, China’s foreign ministry spokesperson Mao Ning said China consistently opposes what she called the overstretching of the concept of national security, and that Beijing will resolutely safeguard the legitimate rights and interests of Chinese companies. China’s foreign and commerce ministries condemned the move and vowed countermeasures. DeepSeek did not immediately respond to requests for comment.
AI is expected to be on the agenda when US and Chinese leaders meet on the sidelines of the APEC summit in November, which could determine whether this escalates or gets folded into a broader negotiation. The pattern of US-China AI friction is not new: earlier this year, Meta’s reported $2 billion acquisition of the Chinese AI startup Manus was unwound after an order from Beijing, a reminder that both sides are treating AI companies as strategic assets. (Manus raises over $500M after Meta’s $2B acquisition was blocked: what happens next)
What this means for you
If you work in a federal civilian agency
Expect an inventory request soon. Your agency needs to find not just apps labeled DeepSeek but any third-party product or service “developed using DeepSeek implementations,” which means asking vendors hard questions about the models behind their tools. The 60-day removal clock is already running.
If you are a government contractor
Audit your supply chain now rather than waiting for the contracting officer’s amendment. Check SAM.gov for the FASCSA order, review any AI-powered components in products you deliver under federal contracts, and remember the 3-business-day reporting obligation once you identify something covered.
If you run a business that uses AI
The order does not bind you. But it is a signal about where procurement standards are heading. Knowing which models sit inside the AI tools you buy is becoming basic due diligence, and enterprise AI governance is moving toward documented provenance for every model in the stack. This is also part of a wider shift toward scrutinizing how AI systems handle data: regulators in the EU are already pushing AI transparency rules such as watermarking, which we covered in OpenAI textGrain explained: ChatGPT’s invisible watermark.
If you are an ordinary consumer
Nothing changes for you. The ban covers what civilian agencies buy and run. It does not restrict companies or the public.
What happens next
The immediate timeline is the 60-day removal window, which closes in mid-December 2026. Watch for three things: whether the Secretary of Defense or the Director of National Intelligence issues parallel orders covering military and intelligence systems, whether DHS or CISA publishes guidance defining “DeepSeek implementations” (the undefined term that is currently the biggest compliance headache), and how China responds beyond its statements, whether through countermeasures or negotiation at the November APEC meeting.
Longer term, this is about the open-model supply chain. DeepSeek’s R1 and V3 are open-weight models, and open models are being built into products everywhere, as we discussed in Meta Muse Spark Open explained: specs, release date, and why the open-weight AI race just changed. Banning a model’s presence in government systems while it remains freely available worldwide is a test of whether procurement rules can keep up with how AI actually spreads. And on the security side, the episode underscores how fast AI-driven risks are moving: just weeks ago, Anthropic was disclosing rogue agent incidents and AI-generated security programs (Anthropic Cyber Mission explained).
FAQ
Is DeepSeek banned in the US?
No, not generally. The DHS order only applies to federal civilian agencies’ IT systems and procurement. Private companies, consumers, and state and local governments are not restricted by this order.
Why is the US government banning DeepSeek?
The Federal Register notice gives no specific reasons, but reporting on the order points to national-security concerns: DeepSeek’s privacy policy states user data is stored in China, and officials worry that data entered into DeepSeek services could be transferred to China or accessed by Chinese authorities, alongside concerns about vulnerabilities or malware in the technology.
What is the deadline for agencies to remove DeepSeek?
Agencies have 60 days from the order to strip DeepSeek and DeepSeek-derived products from their IT systems, putting the practical deadline in mid-December 2026. Agencies can request written exceptions from CISA with a compelling justification.
Does the ban cover products that use DeepSeek’s models?
Yes. The order explicitly covers third-party products and services “developed using DeepSeek implementations,” not just DeepSeek’s own apps. However, the notice does not define that phrase, which creates a compliance gray area for agencies and contractors.
Can contractors keep using DeepSeek under existing contracts?
An order issued after a solicitation applies to an existing contract only once the contracting officer adds it through an amendment or modification. Contractors subject to FAR clause 52.204-30 must check SAM.gov for FASCSA orders at least quarterly, audit their supply chains, and report covered products within 3 business days of identifying them.