DHS orders federal agencies to remove DeepSeek, including tools other companies built on it

The order also covers software other companies built on DeepSeek's open models, and it was signed in July.

By Think Facility · October 20, 2026 · DeepSeek AI policy

On October 20, 2026, the Department of Homeland Security published an order in the Federal Register telling federal civilian agencies to stop buying DeepSeek's products and to pull out the ones they already run. It reaches past the Chinese lab's own apps. It also covers "third-party products and services developed using DeepSeek implementations", meaning software other companies built on DeepSeek's models.

The signed order is older than the notice. DHS Secretary Markwayne Mullin signed it with a release date of July 24, 2026, close to three months before it was published, and copied Russell Vought, who runs the Office of Management and Budget.

Who acted: Department of Homeland Security
Covers: DeepSeek, its affiliated entities and third-party products developed using DeepSeek implementations
Required: exclusion from federal civilian agency procurements and removal from civilian agency information technology
Law: Federal Acquisition Supply Chain Security Act of 2018
Published: Federal Register, 10/20/2026

What agencies have to do

There are two orders in one, and both take effect right away. Agencies have to drop DeepSeek, its affiliates and their products from everything they buy through, including approved product lists and online government marketplaces. They also have to take out whatever is already installed, or ask for an exception.

A bearded man in a navy suit, white shirt and red patterned tie, smiling in front of an American flag and the blue Department of Homeland Security seal — DHS Secretary Markwayne Mullin, who signed the DeepSeek exclusion and removal order. Photo: U.S. Department of Homeland Security (DHS), Public domain, via Wikimedia Commons

An exception request goes to DHS in writing within 60 days of the order, with a reason such as the hit to an agency's mission-critical work. CISA reviews them and answers in writing. Until the software is gone, agencies are encouraged to watch traffic in and out of their networks, log more and flag anything odd.

Some systems sit outside it. National security systems and secure compartmented information systems are excluded, because under the same 2018 law the Defense Department and the Director of National Intelligence issue their own orders.

Why DHS calls DeepSeek a risk

The risk summary runs to about a page. DHS points to DeepSeek's servers being in China, and to Chinese law giving the government's cyber and intelligence services wide access to private companies' infrastructure. It says DeepSeek's sign-up collects personal information and may track and fingerprint users, so whatever a federal worker or contractor types into the model could end up in China.

It adds that the models themselves may carry malware or other security holes, and cites a February 2025 NowSecure report on flaws in DeepSeek's iPhone app. Most of the footnotes point to 2025 material: DeepSeek's privacy policy, a House select committee report, press explainers. I didn't find a new technical finding in it about DeepSeek's 2026 models.

What it means for contractors and open models

The third-party clause is the part that reaches people outside government. DeepSeek gives its model weights away. Its V4.1-Flash-1017 repository on Hugging Face says the weights are licensed under the MIT License and explains how to run the model locally, so a US company can build a product on a DeepSeek model that never touches DeepSeek's servers (we covered how that model ranks among open models on October 19).

DHS's data argument is mostly about DeepSeek's own hosted service. The scope isn't limited to it, though. A footnote says the procurement ban includes third-party implementations of DeepSeek used to serve civilian agencies, so a contractor selling an agency a tool built on a DeepSeek model would have to swap the model out or lose the sale. The order doesn't say how an agency is supposed to find out which model sits under a vendor's product, and I think that's where compliance will get slow.

Congress tried a narrower version first. In February 2025, Representatives Josh Gottheimer and Darin LaHood introduced the No DeepSeek on Government Devices Act, aimed at the app on government-issued phones and computers. The bill text we saved is the version as introduced. This order goes further, from employees' devices to the software agencies buy.

The Chinese Communist Party has made it abundantly clear that it will exploit any tool at its disposal to undermine our national security

From RELEASE: Gottheimer, LaHood Introduce New Bipartisan Legislation to Protect Americans from DeepSeek

The dates that matter next

The timing is odd. If the 60-day clock for exceptions runs from the July 24 date printed on the order, it ran out on September 22, a month before the public notice. We found no statement from DeepSeek on the order when we looked on October 20, 2026.

The law requires the Secretary to review the order within one year and every year after that, which puts the first review due by July 2027.