On 20 October 2026 the Department of Homeland Security published notice in the Federal Register of an order covering the Chinese AI developer DeepSeek. It does two things. It excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, including affiliated entities as defined in applicable regulations, from federal civilian agency procurements. It also removes all DeepSeek and DeepSeek-affiliate products, along with "third-party products and services developed using DeepSeek implementations", from civilian agency information technology.

The notice is catalogued as FR Doc. 2026-21447 (91 FR 66346, Docket No. DHS-2026-0628). It is signed by James H. Percival II, General Counsel of the Department of Homeland Security.

What the order says

The notice says the Secretary of Homeland Security acted under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA, 41 U.S.C. 1321-1328) and its implementing regulations at 41 CFR 201-1. It says the Secretary acted "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence".

The signed order itself sits in an appendix, which the Federal Register prints as scanned images. The notice points readers to regulations.gov, under docket DHS-2026-0628, for a copy. The account of the order's details below comes from two trade outlets, Security.io and GovConFeed, and from TechCrunch. GovConFeed says it read the appendix by optical character recognition, so its wording is approximate.

Who is covered

Security.io and GovConFeed both say the order applies to Federal Civilian Executive Branch agencies and excludes national security systems and compartmented information systems, which Security.io calls "secure" and GovConFeed "sensitive". GovConFeed says those excluded systems fall under the Defense Secretary and the Director of National Intelligence.

The order's reach goes past DeepSeek's own products. Security.io reads the removal clause as meaning that a product sold under another provider's name may still be covered if its service was developed using a DeepSeek implementation. It also stresses that the order binds covered federal civilian agencies directly and is not a general prohibition on private companies. GovConFeed says contractors who embed DeepSeek models in software sold to civilian agencies are covered.

Why DHS says it acted

TechCrunch reports that DHS raised concerns about DeepSeek's handling of user data. In TechCrunch's account, the order warned that sensitive information from U.S. government users could potentially be accessible to Chinese authorities under Chinese law.

GovConFeed gives more of the order's reasoning. DeepSeek is a privately owned company in the People's Republic of China, and its servers are there. For DeepSeek-hosted instances of its models, account generation collects personally identifiable information. GovConFeed cites PYMNTS for two lines from the order. In PYMNTS's quotation, the order says that transferring such information to the People's Republic of China, alone or combined with publicly available data, "could produce actionable intelligence on U.S. persons and/or government programs". PYMNTS also quotes the order on the software itself: "The models themselves may contain malware or other security vulnerabilities."

Security.io's reading is that the order attributes no cyber incident or actor and records a government supply-chain risk decision concerning DeepSeek. It adds that the order does not report a confirmed agency compromise.

Exceptions and timing

TechCrunch says agencies can request exceptions. GovConFeed and Security.io describe the process the same way. Requests must be in writing, submitted within 60 days of the order's issuance, and include a compelling justification and alternative mitigations. GovConFeed says the Cybersecurity and Infrastructure Security Agency (CISA) reviews requests and issues a written approval or disapproval.

The date that starts the 60-day clock is unclear in GovConFeed's account. Its reading of the appendix shows an original release date of 24 July 2026, while the notice was published on 20 October. GovConFeed tells readers to confirm with CISA which date starts the clock. Security.io also gives 24 July 2026 as the order's original release date.

Until covered products are fully removed, both outlets say the order encourages traffic monitoring, enhanced logging and data-exfiltration controls. Questions go to the FASCSA Order Implementation Team in CISA's Cybersecurity Division.

Beijing's response and the wider picture

TechCrunch reports that Chinese Foreign Ministry spokesperson Mao Ning said on 20 October that Beijing opposes "overstretching the concept of national security and politicizing technology and trade issues", according to an official briefing. TechCrunch also quotes her saying: "We will resolutely safeguard the legitimate rights and interests of Chinese enterprises."

TechCrunch places the order in a longer run of U.S. measures. It says a law passed in December 2025 targeted DeepSeek's use in intelligence national security systems, and that the new order extends restrictions to federal civilian agencies, covering both new purchases and existing IT systems. It also recalls that DeepSeek's R1 reasoning model shook the AI industry in January 2025 and triggered a sharp sell-off of Nvidia shares. TechCrunch further says the U.S. accused DeepSeek and five other Chinese AI companies of using large-scale model distillation to extract information from American AI systems, according to a September report. It adds that OpenAI and Anthropic have separately raised concerns about DeepSeek's alleged use of distillation, a technique that uses outputs from one AI model to train another.

What stands out

My reading is that the second clause matters more than the first. Removing products "developed using DeepSeek implementations" changes the question for agencies and suppliers. As Security.io puts it, the decision "is not simply whether employees can access a DeepSeek website. It is whether organisations can prove which model implementations sit inside products acquired under other names." Among the things Security.io lists as still emerging are CISA implementation guidance, agency exception decisions and authoritative clarification of embedded or hosted implementation scope.

Sources

Federal Register (2026) 'Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements', Federal Register, 20 October 2026, available at: https://www.federalregister.gov/documents/2026/10/20/2026-21447/notice-of-order-regarding-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive (Accessed: 21 October 2026).

GovConFeed (Draper, S.) (2026) 'DeepSeek Barred From Civilian Federal Buying and Ordered Out of Agency IT Under DHS FASCSA Order', GovConFeed, 21 October 2026, available at: https://govconfeed.com/article/dhs-deepseek-fascsa-exclusion-removal-order-october-2026 (Accessed: 21 October 2026).

Park, K. (2026) 'US orders federal agencies to remove China's DeepSeek AI from their systems', TechCrunch, 20 October 2026, available at: https://techcrunch.com/2026/10/20/us-orders-federal-agencies-to-remove-chinas-deepseek-ai-from-their-systems/ (Accessed: 21 October 2026).

Security.io Intelligence Desk (2026) 'DHS DeepSeek order reaches third-party AI products and services', Security.io, 21 October 2026, available at: https://www.security.io/articles/2026/10/21/dhs-deepseek-removal-order (Accessed: 21 October 2026).

U.S. Government Publishing Office (2026) 'Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements', Federal Register Vol. 91, No. 201, pp. 66346-66350, govinfo.gov, 20 October 2026, available at: https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm (Accessed: 21 October 2026).

Picture credits

  • Top picture. US Department of Homeland Security (photo: Tara Molle), public domain (source)