DHS has published an order that excludes DeepSeek products from federal civilian procurement and directs their removal from civilian agency IT

Key takeaways

• The order directs agencies to "Exclude" DeepSeek, its affiliated entities and their products from civilian agency procurements, including approved product lists and e-commerce markets.
• It also directs removal of products provided by DeepSeek and of third-party products and services developed using DeepSeek implementations.
• Agencies may ask the DHS Issuing Official for an exception in writing within 60 days of issuance of the order.
• The Secretary of Homeland Security will review the order within one year and annually thereafter, according to the order.

What does the DHS order require federal civilian agencies to do?

Two things, under the heading "Required Actions". First, agencies are to exclude DeepSeek, DeepSeek-affiliated entities and their products from civilian agency procurements, "effective immediately after issuance of this Order", and the order says this includes agency-approved products lists, service provider equipment lists, e-commerce markets and similar functions that facilitate buying IT hardware, software and services. Second, agencies are to remove products provided by DeepSeek, affiliated entities, and third-party products and services developed using DeepSeek implementations from their IT systems, "immediately after the issuance of the Order, or seek an Exception".

The Federal Register notice states the legal basis: the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328) and its implementing regulations at 41 CFR 201-1, following review of a Federal Acquisition Security Council recommendation and affiliated evidence. The order text adds that the Secretary may issue exclusion and removal orders on the Council's recommendations to the extent they are not covered by the Department of Defense (named in the order as the Department of War) or the intelligence community.

Who does the order cover, and does it reach contractors directly?

The order says it applies to "Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems". The order treats an individual or business as an affiliated entity if, directly or indirectly, either one controls or can control the other, or a third party controls or can control both, with a reference to the definition of affiliates in 48 CFR 2.101. The company named in the Federal Register notice is Hangzhou DeepSeek Artificial Intelligence Co., Ltd; the order's own text names Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.

The duties in the order fall on agencies. The text we read does not impose a certification or reporting step on contractors. Its reach to vendors comes through two phrases: procurement exclusion covers "third party implementations of DeepSeek used to provide products and services" to civilian agencies, and removal covers third-party products and services "developed using DeepSeek implementations". A product that wraps or embeds a DeepSeek model is therefore within the wording, though the order does not define "implementations" further.

What exceptions, timing and follow-up does the order set?

Executive agencies may request an exception from the DHS Issuing Official under 41 CFR 201-1.304(b), including a request that the order not apply to the agency, to certain actions, or that compliance be delayed. The order says requests must be "submitted in writing within 60 days of the issuance of this order". The order lists what a request must contain: the order identified, the exception sought, the covered product or service, "compelling justification", and any alternative mitigations. CISA reviews requests and gives written approval or disapproval.

In the interim, the order says agencies are "encouraged" to take steps such as monitoring traffic, enhanced logging and controls on data exfiltration, and detecting anomalous activity. It says CISA may provide technical assistance to agencies without internal capability to comply. The Secretary will review the order within one year and annually after that. Questions go to FASCSA.Orders@cisa.dhs.gov.

Why does the order say DeepSeek products are a risk?

The order's "Summary of Risks from Source" describes DeepSeek as a foreign, privately owned company in the People's Republic of China. These are the order's statements, not our findings. It says DeepSeek servers are located in the PRC and that the PRC legal system permits extensive government access to private company infrastructure. It says DeepSeek-hosted instances collect personally identifiable information and may track users, that use of DeepSeek applications by U.S. government employees or vendors may result in sensitive data reaching the PRC, and that the models themselves may contain malware or other vulnerabilities. It cites open-source research reporting critical vulnerabilities in the DeepSeek iOS app. Earlier regulators have acted on DeepSeek for data protection reasons, including Italy's Garante and South Korea's PIPC; those are separate instruments.

What should federal contractors and AI vendors check now?

The order addresses agencies, so the practical questions are about what your customers will ask. The steps below are our suggestions, not requirements of the order.

• List every DeepSeek model, API, hosted service or fine-tuned derivative inside products or services you sell to federal civilian agencies, including components supplied by your own subcontractors.
• Check whether any product reaches agencies through a schedule, approved product list or e-commerce market, since the order names those channels for exclusion.
• Decide who answers an agency inquiry about DeepSeek content, and keep the answer in writing and consistent across contracts.
• Watch your contract clauses and agency notices for flow-down language. Our piece on the GSA AI clause and OMB flow-downs covers a separate contractor-facing instrument, and the D.C. Circuit supply-chain exclusion ruling concerns a different exclusion.

What are the key dates and deadlines in the order?

What we did not verify

What we opened: all five pages of the Federal Register notice (91 FR 66346-66350, FR Doc. 2026-21447) as published on govinfo.gov, including the signed order in the appendix, which is printed as page images, on 24 October 2026.

What we did not open: the docket on regulations.gov (DHS-2026-0628), the Federal Acquisition Security Council recommendation, the evidence behind the order's risk statements, the FASCSA statute and 41 CFR 201-1 themselves, and any agency or CISA implementation guidance. We could not confirm whether the 60-day exception window runs from the 24 July 2026 release date or from Federal Register publication, because the order says only "issuance".

What we refuse to claim: that the order binds private contractors directly, that it sets a vendor certification or reporting duty, that any agency has completed removal, or that the order's risk statements about DeepSeek have been independently confirmed.

Related briefings

• AI Regulation News hub
• North America AI regulation tracker
• GSA AI clause and OMB M-25-22 flow-downs for federal contractors
• D.C. Circuit upholds supply-chain exclusion in Anthropic v. Department of War
• Italy Garante DeepSeek processing block
• South Korea PIPC generative AI privacy action on DeepSeek