DHS orders DeepSeek out of US civilian agencies, signed in July

If you build for US federal customers, or sell to someone who does, DHS has just told civilian agencies to stop using DeepSeek. The order is dated July 24, which means it sat unpublished for almost three months before the notice reached public inspection on October 19. We read the notice and the full four-page signed order. This article covers what it requires, what it says about why, and the question it leaves open for anyone running open-weight models.

What does the DHS order require?

It requires federal civilian agencies to exclude DeepSeek from procurement and remove its products from their IT systems. Exclusion and Removal Order #2026-01 is issued under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321 to 1328), and is signed by Homeland Security Secretary Markwayne Mullin with a copy to OMB Director Russell Vought. It tells agencies to:

• Exclude Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd, its affiliated entities and their products from procurement, “effective immediately,” including approved product lists and e-commerce markets.
• Remove products provided by DeepSeek and its affiliates, and “third-party products and services developed using DeepSeek implementations,” from civilian agency information technology, immediately or under an exception.

The order applies to federal civilian executive branch agencies, except their national security systems and secure compartmented information systems. The Department of Defense and the Director of National Intelligence have separate authority over theirs.

When was it signed, and when did it become public?

It was signed July 24, 2026, and the notice became public on October 19. The signed order lists July 24, 2026 as its original release date. The Federal Register notice, FR Doc. 2026-21447, was filed for public inspection on October 19 at 8:45 am and is dated for publication on October 20, with the order attached as an appendix. Reuters reports that a July memo was made public Monday that told agencies to monitor traffic in and out of government websites for DeepSeek risks. We cannot tell from the documents whether that memo is the same order. The gap between July 24 and October 19 is something the notice does not explain.

Why does DHS say it is doing this?

DHS lists four concerns and says DeepSeek’s models “present multiple threat vectors.” The order’s summary of risks says:

• DeepSeek is a privately owned company in China whose servers are located there, and Chinese law gives the state broad access to private company infrastructure.
• For DeepSeek-hosted instances, account creation collects personally identifiable information and may also track and fingerprint users.
• Typical use means presenting information to the model, which may send sensitive data to China if used by government employees or vendors. DHS says that data could “produce actionable intelligence” on US persons or government programs, alone or combined with public data.
• The models themselves “may contain malware or other security vulnerabilities,” and the order cites open-source research finding multiple critical vulnerabilities in DeepSeek’s iOS app.

The footnotes lean on 2025 sources, including a company profile, a privacy policy, a congressional committee report and a NowSecure analysis of the iOS app. We did not check them.

What can agencies do about it?

They can ask for an exception in writing within 60 days of the order’s issuance. Requests go in writing to the DHS issuing official, and CISA reviews them. The order says a request should identify the order and the product, describe the exception sought, give a compelling justification such as effects on mission-critical functions or national interest, and describe any alternative mitigations. Until removal is complete, agencies are encouraged to monitor traffic in and out of the agency, use enhanced logging and data exfiltration controls, and flag anomalous activity. CISA may give technical help to agencies that lack the capability, and the Secretary will review the order within one year and then annually. If the 60 days run from the July 24 signing, the window would have closed around September 22, before the notice was public (our arithmetic). The notice does not say when the clock starts.

Does the order cover open-weight DeepSeek models?

The text does not say. It orders removal of “third-party products and services developed using DeepSeek implementations,” and a footnote adds that this includes “third party implementations of DeepSeek used to provide products and services to civilian agencies.” Neither phrase is defined. It does not mention weights, self-hosted deployments, fine-tunes or distilled models. Whether an agency running an open-weight DeepSeek model on its own servers, or buying a vendor product built on one, is covered is a question the order leaves open. Reuters, reading the same notice, describes the ban as covering DeepSeek products and third-party services using the Chinese model.

What does Reuters add?

Context on earlier bans and a related FCC vote. Reuters says several agencies, including the Commerce Department and the Navy, previously banned DeepSeek on government devices, as did states including New York, Tennessee and Virginia. It adds that the Chinese Embassy in Washington did not immediately comment, and that the FCC will vote on October 29 on barring Chinese labs from testing electronic devices for US use.

What is still unknown?

• What “DeepSeek implementations” means and whether open weights fall inside it.
• Why the order stayed unpublished from July 24 to October 19.
• When the 60-day exception window started, from signing or from public notice.
• How many agencies or vendors are affected, and whether any have asked for an exception.
• Whether DeepSeek or the Chinese government will respond. We found no statement in the sources we read.

What to keep in mind

These are our observations:

• The date matters. This is not a new ban as of this week. The order is three months old and only now public.
• The “third-party products” clause is the broad part. For vendors selling into federal civilian agencies, it is the part to read closely, together with their own counsel.
• The reasons are DHS’s, not findings we tested. The order’s own sources are mostly from 2025.
• This sits next to our other DeepSeek coverage. See the V4.1-Flash-1017 release, the DeepSeek harness and the Cairn panel investigation, where a worker name pointed to DeepSeek.

Editorial review: October 20, 2026 (AI). Prepared from the Federal Register public inspection PDF (FR Doc. 2026-21447, notice and the four-page signed order, read as page images) and Reuters’ October 19 report (opened in a browser). The Wall Street Journal’s first report was not read. We did not check the order’s footnoted sources, contact DHS, CISA or DeepSeek, or review the regulations.gov docket. This is not legal advice.