The Department of Homeland Security has used the federal government's supply-chain exclusion authority to order DeepSeek out of every federal civilian agency. A notice published in the Federal Register on October 20 (filed October 19) does two things. It bars products and services from Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates from civilian agency procurements, and it requires agencies to remove DeepSeek products already in use.

The ban on DeepSeek's own products is not the part drawing criticism. The removal requirement also reaches "third-party products and services developed using DeepSeek implementations." That phrase could cover far more than the DeepSeek chatbot, and according to The Register, it is unclear what "developed using" means.

What exactly was published?

The Federal Register entry (FR Doc 2026-21447, 91 FR 66346, DHS Docket DHS-2026-0628) is titled "Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements." It cites the Federal Acquisition Supply Chain Security Act of 2018, usually shortened to FASCSA (41 U.S.C. 1321-1328), and its implementing regulations at 41 CFR 201-1.

According to the notice, the Secretary of Homeland Security issued the order after reviewing the Federal Acquisition Security Council's recommendation and affiliated evidence. The order has two parts:

  • Exclusion: civilian agencies may not procure IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd or its affiliates.
  • Removal: agencies must remove all DeepSeek and affiliate products, plus third-party products and services developed using DeepSeek implementations, from their IT systems.

The notice is signed by DHS General Counsel James H. Percival II. It says the signed order is in the accompanying appendix and on regulations.gov under DHS Docket Number DHS-2026-0628. The contact for questions is the FASCSA Order Implementation Team in CISA's Cybersecurity Division.

Why now, and why DeepSeek?

CyberScoop reports that the notice includes a letter from Homeland Security Secretary Markwayne Mullin ordering the exclusion of DeepSeek products on June 26, which CyberScoop says indicates the ban has been in place for months. That is nearly four months before the notice was filed. In the letter, according to CyberScoop, Mullin says DeepSeek models store data on servers in China, that models hosted directly by DeepSeek collect personally identifiable information, and that the prompt-and-response process "may result in the transfer of sensitive data" to the Chinese government.

DeepSeek is the only Chinese AI model named in the order. CyberScoop notes that it is one of several Chinese open-weight models that have worried national security officials or been accused of illegally distilling U.S. models, along with Moonshot AI's Kimi and Alibaba's Qwen. Those two are not covered by the order.

Parts of the government had already acted on their own. The Register reports that the Defense Information Systems Agency (DISA) began blocking DeepSeek on Pentagon networks in January 2025, and that the Navy, NASA, the House of Representatives and various states took similar steps. CyberScoop adds that civilian agencies had previously used their own discretion to block such models. The new order sets one requirement for civilian agencies.

Can agencies get an exception?

Yes, but it takes planning. CyberScoop reports that agencies can request exceptions but must submit the request 60 days in advance and give a "compelling justification," such as an inability to fulfil a mission-critical function or other national security considerations. The order also encourages agencies, between issuance and full removal, to monitor network traffic, add enhanced logging and data-exfiltration controls, and detect and flag anomalous activity. In other words, removal is treated as a security event, not just an uninstall.

What's the problem with "developed using"?

Banning an app is easy to scope. Banning everything "developed using DeepSeek implementations" is not. DeepSeek's models are open-weight, so other companies can run and build on them. The Register says it is not clear which third-party products were developed using DeepSeek, nor whether "developed using" means ongoing API access to DeepSeek models or simply an app written with DeepSeek's help.

The Register spoke to Katie Moussouris of Luta Security. She said banning DeepSeek's own app and API is workable, but the order does not say what "developed using" means, and she sees no practical way to verify that nothing a vendor relies on ever touched DeepSeek. She also argued that US hosting of DeepSeek's models avoids most of the risks the order cites, since those centre on data flowing to DeepSeek's servers in China, its data collection and its app.

The Register also points to AI gateways such as OpenRouter and Vercel AI Gateway. These services make DeepSeek's models available through APIs and route requests to providers. Agencies using them could end up using DeepSeek models without meaning to, unless they constrain their AI providers.

Security concerns go beyond data location. Moussouris, quoted by The Register, notes that NIST found DeepSeek more vulnerable to prompt injection than US models and easier to jailbreak, though she says every model has the injection problem. Prompt injection means hiding instructions in content a model processes so it ignores its intended behaviour. A jailbreak means getting a model past its safety guardrails.

What It Means for Defenders

Who is directly affected: federal civilian executive branch agencies. The order covers their IT systems and their procurements. As noted above, DISA already blocked DeepSeek on Pentagon networks in January 2025.

Who should pay attention anyway: contractors and vendors that sell software, SaaS or AI-enabled services to civilian agencies. The order is directed at agencies, but a removal mandate that covers third-party products "developed using" DeepSeek suggests agency buyers will want answers from their suppliers. Expect questions about which models your product uses, where they are hosted, and whether any component came from DeepSeek. Those questions will be easier to handle if you can answer them before they arrive.

What to check now (agencies and the vendors supporting them):

  • Inventory direct use. Look for DeepSeek's own app and API across endpoints, browser extensions and network traffic. Even critics like Moussouris call this part workable.
  • Map your AI supply chain. For every AI-enabled tool, record the underlying model, who hosts it and how it was built. Without that list you can't meet a requirement as broad as "developed using." Moussouris warns that an AI software bill of materials does not record which tools developers used, so it will not settle the question on its own.
  • Review AI gateways and model routers. If you use an aggregation service, check whether DeepSeek models are reachable through it and restrict routing to approved providers. The Register flags this as a path to unintended DeepSeek use.
  • Follow the monitoring guidance. As CyberScoop describes, the order encourages traffic monitoring, enhanced logging, exfiltration controls and anomaly flagging during removal.
  • Plan exceptions early. If a mission system really depends on a DeepSeek-derived component, CyberScoop reports the exception request must be submitted 60 days in advance with a compelling justification.
  • Read the primary documents. The notice says the signed order is in the appendix and on the regulations.gov docket (DHS-2026-0628). Questions on implementation go to CISA's FASCSA Order Implementation Team.

The bigger picture: no patch fixes a supply-chain exclusion. Getting through it comes down to visibility. Organizations that already keep a software and AI component inventory can answer "are we using this?" far faster than those that don't. And because CyberScoop notes that other Chinese open-weight models such as Kimi and Qwen have also worried officials, the same inventory work may be useful again.

Sources