The U.S. Department of Homeland Security has ordered federal civilian agencies to remove products from Hangzhou DeepSeek Artificial Intelligence and its affiliates from their IT systems, along with third-party products and services built on DeepSeek, and to stop buying them. The order, FASCSA Exclusion and Removal Order #2026-01, carries an original release date of July 24, 2026. DHS made it public on October 19 through a Federal Register notice scheduled for publication on October 20. The ban covers DeepSeek's own apps and also software from other vendors that is built on DeepSeek models.

Key Facts

Details
Order FASCSA Exclusion and Removal Order #2026-01, signed by Homeland Security Secretary Markwayne Mullin, with OMB Director Russell Vought copied
Order date The signed order lists an original release date of July 24, 2026, and the BBC reports the ban has applied since the end of July. CyberScoop described the letter as dated June 26
Public notice Federal Register Doc. 2026-21447, docket DHS-2026-0628, filed for public inspection October 19 and scheduled for publication October 20, signed by DHS General Counsel James H. Percival II
Legal basis Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328) and 41 CFR part 201-1, after a recommendation from the Federal Acquisition Security Council
Who must comply Federal civilian executive branch agencies. National security systems and sensitive compartmented information systems are excluded; the Defense Department and the intelligence community fall under separate authorities
Procurement Agencies must exclude DeepSeek, its affiliates and their products from purchasing, including approved product lists, equipment lists and e-commerce markets, effective immediately
Removal Agencies must remove DeepSeek and affiliate products, and third-party products and services "developed using DeepSeek implementations", immediately or seek an exception
Exceptions Written requests within 60 days of the order, with a "compelling justification" such as impact on mission-critical functions, plus any planned mitigations
Interim steps Until removal is complete, agencies are encouraged to monitor traffic in and out of the agency, add logging and data exfiltration controls, and flag anomalous activity
Review CISA may give technical help; the Secretary must review the order within one year and every year after

Background

DHS's Stated Reasons

The order's risk summary says DeepSeek's servers are in China and that Chinese law gives the government broad power to access private company infrastructure. It says DeepSeek-hosted versions of its models collect personally identifiable information during account creation and may track and digitally fingerprint users. Because the apps work by prompt and response, the order says use by government employees or vendors "may result in the transfer of sensitive data to the PRC", which could "produce actionable intelligence on U.S. persons and/or government programs".

The order also says the models "may contain malware or other security vulnerabilities". As support it cites a February 2025 NowSecure analysis of DeepSeek's iOS app and a House Select Committee on the CCP report from April 2025. CyberScoop noted that some of these concerns, such as data collection, could apply to other AI models as well, and that DeepSeek is the only Chinese AI developer named in the order.

Earlier Steps

DeepSeek drew wide attention in 2025 with low-cost open-weight models. Before this order, individual agencies decided for themselves whether to block it. CyberScoop says the Commerce Department confirmed this to FedScoop last year. In June 2025, Senators Rick Scott and Gary Peters introduced the No Adversarial AI Act, which would bar executive agencies from using AI from companies based in China, Russia, Iran and North Korea, The Record reported.

Third-Party Products

The order's wording on third-party products matters because DeepSeek releases its models openly, so they can run on other companies' servers. The BBC notes that Snowflake, Vercel and OpenRouter offer DeepSeek models to their customers. A footnote in the order says the scope includes "third party implementations of DeepSeek used to provide products and services" to civilian agencies.

What We Don't Know Yet

  • How many agencies were using DeepSeek models, directly or through vendors, and what they have removed since July.
  • How agencies will identify products "developed using DeepSeek implementations" inside software they already run.
  • Whether any agency has asked for or received an exception.
  • Why DHS published the order about three months after issuing it.
  • How DeepSeek and the Chinese government will respond. The BBC said it had asked DHS, DeepSeek and the Chinese embassy for comment.

Sources