DHS orders DeepSeek out of federal civilian agencies, three months after signing the order

By Staff Reporter

WASHINGTON — The Department of Homeland Security has ordered every federal civilian agency to stop buying products from the Chinese artificial intelligence company DeepSeek and to strip its software from government computers, including commercial products that are built on DeepSeek’s models. The order was signed in July. The public is only now seeing it.

The directive, formally Exclusion and Removal Order #2026-01, was published in Tuesday’s Federal Register after being posted for public inspection on Monday. Its cover page carries an “original release date” of July 24, 2026, and the signature of Homeland Security Secretary Markwayne Mullin, with a copy to Russell Vought, the director of the Office of Management and Budget, according to the order reproduced in the notice. Bloomberg and Politico reported on the notice Monday.

What the order requires

DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018, which created an interagency Federal Acquisition Security Council to recommend excluding or removing risky technology from federal systems. The notice says Mullin acted “following review of the Federal Acquisition Security Council Recommendation and affiliated evidence.” Compliance with such orders is mandatory for civilian agencies, according to the Cybersecurity and Infrastructure Security Agency, and federal contractors can be required to remove covered products under standard contract clauses.

The order directs civilian agencies to do two things:

• Exclude DeepSeek, its affiliates and their products from agency purchasing, “effective immediately,” including approved-product lists, service-provider equipment lists and e-commerce marketplaces used to buy hardware, software and services.
• Remove products provided by DeepSeek and its affiliates, “and third-party products and services developed using DeepSeek implementations,” from civilian agency information technology systems “immediately after the issuance of the Order,” or seek an exception.

Agencies had 60 days from issuance to ask for an exception in writing, with a “compelling justification” such as an impact on mission-critical functions, and CISA reviews those requests. Counting from the July 24 release date, that window would have closed in late September, before the order was published. Until removal is complete, agencies are “encouraged” to monitor traffic, step up logging and watch for data exfiltration. DHS must review the order within a year and annually after that.

The order does not reach the Pentagon, the intelligence community or national security systems. Under the 2018 law, the secretary of defense and the director of national intelligence issue their own orders for those systems.

Why DHS says DeepSeek is a risk

The order’s risk summary says DeepSeek’s servers are in China and that “the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure.” It says DeepSeek’s account sign-up collects personal information and “may also track and digitally fingerprint users,” that using its apps “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors,” and that the models “may contain malware or other security vulnerabilities.” Its footnotes cite DeepSeek’s own privacy policy, an April 2025 report by the House Select Committee on the Chinese Communist Party and a February 2025 analysis by the security firm NowSecure of DeepSeek’s iPhone app.

The open question: models running on American clouds

The broadest part of the order is its reach to “third-party products and services developed using DeepSeek implementations.” DeepSeek released its models openly, and U.S. cloud providers began offering them to customers in early 2025, including Amazon Web Services and Microsoft’s Azure AI Foundry. The order’s data-transfer rationale rests on DeepSeek-hosted services, but its removal language covers products “developed using” DeepSeek implementations without distinguishing where they run. The published text does not define the phrase or say whether a DeepSeek model hosted on U.S. infrastructure, or a product fine-tuned from one, must come out. Agencies and contractors will be looking to CISA for that answer.

Congress never finished its own ban

Lawmakers proposed a narrower statutory ban early last year. The No DeepSeek on Government Devices Act was introduced in the House by Rep. Josh Gottheimer, D-N.J., on Feb. 7, 2025, and in the Senate by Sen. Jacky Rosen, D-Nev., on Feb. 27, 2025. Neither bill has moved past committee referral, according to congress.gov (H.R. 1121; S. 765).

The order and the notice are in docket DHS-2026-0628 on regulations.gov.

Photo: Building 1 on the St. Elizabeths campus, the Department of Homeland Security’s headquarters in Washington. Tia Duffour/DHS, via Wikimedia Commons, public domain.