DHS orders DeepSeek stripped from all federal civilian IT systems

Summary

• DHS ordered DeepSeek products removed from federal civilian agency IT and barred from procurement.
• The order also covers third-party products and services built using DeepSeek applications.
• Vendors selling to civilian agencies face exclusion unless their agency wins a narrow exception.

The latest

Chinese AI developer DeepSeek has been banned from federal civilian government technology under a Department of Homeland Security order filed for public inspection in the Federal Register on October 19, 2026. The order bars procurement of DeepSeek products and requires agencies to rip out existing deployments, including third-party tools built with DeepSeek applications. Homeland Security Secretary Markwayne Mullin said the models present multiple threat vectors to civilian agency systems.

Details

• The filing: The notice, document 2026-21447 in docket DHS-2026-0628, runs 6 pages and was filed at 8:45 a.m. on October 19, 2026, for official publication the following day. It is titled as an order notice on the exclusion and removal of DeepSeek products from federal civilian executive branch IT and procurement.
• Legal basis: DHS cited the Federal Acquisition Supply Chain Security Act of 2018, codified at 41 U.S.C. 1321-1328, and its implementing regulations at 41 CFR 201-1. The notice says the order followed review of a Federal Acquisition Security Council recommendation and accompanying evidence.
• What it covers: The order excludes IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates, as defined under 48 CFR 2.101, from civilian agency procurement. It separately requires removal of those products and of third-party products and services developed using DeepSeek applications.
• Stated reasons: According to CyberScoop, Mullin's letter cites data stored on servers in China, where national security laws give the government broad authority to demand data from domestic companies. DeepSeek-hosted models collect personal information and can track user digital fingerprints, the reasoning states.
• The intelligence risk: Prompt and response processing could transfer sensitive data to the Chinese government, providing what the order describes as "actionable intelligence on U.S. persons and/or government programs." The order also says the models may contain malware or vulnerabilities, citing open-source research on flaws in DeepSeek's iOS application.
• Who signs, who enforces: General Counsel James Percival II signed the notice, with Mullin's underlying order attached. Enforcement runs through the FASCSA order implementation team in CISA's cybersecurity division. The notice sets no removal deadline and no separate effective date. CyberScoop reported Mullin's letter is dated June 26.
• Scope and exceptions: Implicator reported the order is dated July 24, 2026, took effect on issuance, and covers civilian executive agencies including Treasury, State and Justice. Defense is excluded, and national security systems fall under separate authorities. Agencies have 60 days to request exceptions with compelling justification and proposed safeguards.
• Interim measures: Until removal is complete, agencies are encouraged to monitor network traffic, strengthen logging, apply data loss prevention controls and watch for anomalous activity. The secretary is required to review the order within one year and annually thereafter.
• Prior restrictions: Commerce and the Navy had already banned DeepSeek on government devices, the Defense Information Systems Agency blocked the chatbot in January 2025, and New York, Tennessee and Virginia restricted its use. Before the order, agencies blocked the models at their own discretion.
• No comment: DHS, DeepSeek and the Chinese embassy in Washington did not respond to requests for comment, according to Implicator. DeepSeek is the only Chinese model named in the order.

Between the lines

The removal mandate reaches further than the procurement ban. By covering third-party products built using DeepSeek applications, the order puts the compliance burden on vendors who may not advertise which model underpins their software. With no removal deadline set and the exception window limited to 60 days, agencies face an open-ended cleanup against a fixed deadline for asking out.

What's next

The order publishes officially on October 20, 2026. Watch the 60-day exception window for which agencies file compelling-justification requests, and the secretary's mandatory review within one year for any expansion to other Chinese models.

Source: Federal Register, CyberScoop, Implicator