DeepSeek Barred From Civilian Federal Buying and Ordered Out of Agency IT Under DHS FASCSA Order

Civilian federal agencies can no longer buy products or services developed by Chinese AI developer DeepSeek, and they must remove DeepSeek software from their networks, including third-party tools built on DeepSeek models. The Department of Homeland Security issued the order under the Federal Acquisition Supply Chain Security Act of 2018 and published notice of it in the Federal Register on October 20, 2026. DHS General Counsel James H. Percival II signed the notice, FR Doc 2026-21447, under Docket DHS-2026-0628.

The order has two parts. It excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, including affiliated entities as defined in 48 CFR 2.101, from federal civilian agency procurements. It also requires agencies to remove all DeepSeek and DeepSeek-affiliate products, along with third-party products and services developed using DeepSeek implementations, from civilian agency IT. Because of that second clause, contractors who embed DeepSeek models in software sold to civilian agencies are covered too.

How the DeepSeek Exclusion and Removal Order Works

DHS cites the Federal Acquisition Supply Chain Security Act (FASCSA), 41 U.S.C. 1321-1328, and its implementing regulations at 41 CFR 201-1. The Secretary acted after reviewing a recommendation from the Federal Acquisition Security Council, the interagency body FASCSA created to manage supply chain risks by recommending that risky products or services be excluded or removed from federal procurement and IT systems.

"A copy of the signed order is contained in the accompanying Appendix and can be found at https://www.regulations.gov by searching for DHS Docket Number DHS-2026-0628," the notice states.

The appendix in the PDF edition of the notice is printed as scanned images. GovConFeed read it through optical character recognition, so the wording below is approximate. The appendix is titled Exclusion and Removal Order #2026-01 and shows an original release date of July 24, 2026. It applies to federal civilian executive branch agencies and carves out national security systems and sensitive compartmented information systems, which fall under the Defense Secretary and the Director of National Intelligence. Its signature block lists the DHS Secretary and the Director of the Office of Management and Budget.

The appendix tells agencies to exclude DeepSeek and its affiliates from civilian procurement "effective immediately after issuance." That covers agency-approved products lists, service provider equipment lists, and e-commerce marketplaces. Agencies must also remove covered products from civilian IT systems immediately after issuance or seek an exception.

PYMNTS reported that the notice was posted on the Federal Register public inspection site on October 19, a day before publication. OfficeChai reported that this is reportedly the first use of FASCSA against an AI company and that a July memo was made public along with the notice.

Why DHS Treats DeepSeek Models as a Supply Chain Threat

DHS sets out its risk case in the order. DeepSeek is a privately owned company in the People's Republic of China, and its servers are there. For DeepSeek-hosted instances of its models, the account generation process collects personally identifiable information. DHS warns that the prompt-and-response process could send sensitive data to the PRC if U.S. government employees or vendors use it.

"The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs," DHS said in the order, as quoted by PYMNTS.

The department also points to risks in the software itself. "The models themselves may contain malware or other security vulnerabilities," the order states, according to PYMNTS.

That second concern helps explain why the removal requirement goes beyond DeepSeek's consumer chatbot. If a model is the risk, it can carry that risk into any product built on it. So the order applies to "third-party products and services developed using DeepSeek implementations," not only to software DeepSeek sells directly.

The 60-Day Window for Agency Exceptions

Agencies that cannot remove DeepSeek-based tools right away can ask for an exception. According to the OCR text of the appendix, executive agencies may request one from the DHS Issuing Official under 41 CFR 201-1.304(b), such as asking that the order not apply to the agency, to certain actions, or for a delay in compliance. Requests must be in writing and submitted within 60 days of the order's issuance. Because the appendix shows an original release date of July 24, 2026, while the notice was published October 20, readers should confirm with CISA which date starts that clock.

Each request must identify the order, the exception sought, and the covered article. It must also give a compelling justification, such as impact on a mission-critical function, and describe alternative mitigations the agency will use. The Cybersecurity and Infrastructure Security Agency (CISA) reviews requests and issues a written approval or disapproval.

Until removal is finished, the order encourages agencies to monitor traffic entering and leaving their networks, strengthen logging and data-exfiltration controls, and flag anomalous activity. CISA may provide technical assistance. Questions about implementation go to the FASCSA Order Implementation Team in CISA's Cybersecurity Division.

The order is not permanent by default. The DHS Secretary must review it within one year and annually after that.

Where the Order Reaches Beyond DeepSeek's Own Apps

The exclusion follows DeepSeek's corporate family. By using the 48 CFR 2.101 definition of affiliates, DHS covers entities where one controls or can control the other, or where a third party controls or can control both.

The removal side goes further. It applies to any third-party product developed using a DeepSeek implementation, whoever sells it. The appendix says this includes third-party implementations of DeepSeek used to provide products and services to civilian agencies. The procurement exclusion also covers e-commerce marketplaces and approved products lists, so agencies need to check catalog listings as well as new solicitations.

National security systems and sensitive compartmented information systems are outside this order's scope because it exempts them.

What It Means for Contractors

Vendors selling software or IT services to civilian agencies should inventory their products now for DeepSeek components, including models pulled from public repositories and integrated into larger products. Because the order reaches third-party products developed using DeepSeek implementations, a DeepSeek component in a product's stack could plausibly put the whole product in scope for removal.

Agency customers are likely to request attestations about model provenance. Contractors whose offerings rely on DeepSeek should prepare replacement plans. They should also expect that any agency seeking an exception will need detailed facts from them to show mission-critical impact and propose alternative mitigations, within the 60-day window.

Resellers and marketplace vendors should review catalog listings. Firms that sell only to national security systems face fewer immediate obligations under this order, though the annual review could change its scope.