DeepSeek Federal Ban Reaches Every Product Built on Its Models

The US Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove them from their systems, and the DeepSeek federal ban extends to any third-party product or service developed using DeepSeek’s models. DHS published notice of the order in the Federal Register on October 20, 2026, though the order itself has bound agencies since July 24, 2026.

DHS Used a 2018 Supply Chain Law to Issue the DeepSeek Federal Ban

The order is Exclusion and Removal Order #2026-01, signed by Homeland Security Secretary Markwayne Mullin and copied to Office of Management and Budget Director Russell Vought. Mullin issued it under the Federal Acquisition Supply Chain Security Act of 2018, which created the Federal Acquisition Security Council to recommend removing risky products from federal purchasing and lets the Homeland Security secretary turn those recommendations into binding orders for civilian agencies. The public notice, signed by DHS General Counsel James H. Percival II, appears at 91 FR 66346 under docket DHS-2026-0628.

The Order Covers Treasury, State and Justice and Excludes the Pentagon

The order applies to federal civilian executive branch agencies, with an exception for national security systems and sensitive compartmented information systems. Those systems sit under the authority of the Secretary of Defense and the Director of National Intelligence, which the order notes is outside DHS’s reach. BBC technology reporter Kali Hays reported that the covered agencies include the Treasury, State and Justice departments. The order places no restriction on private companies or individuals.

Third-Party Products Built With DeepSeek Must Also Come Out

The order gives agencies two instructions. First, they must exclude DeepSeek, its affiliates and their products from procurement, effective immediately, including agency-approved product lists, service provider equipment lists and e-commerce markets. Second, they must remove DeepSeek products and “third-party products and services developed using DeepSeek implementations” from agency IT systems, or request an exception. A footnote clarifies that this covers third-party implementations of DeepSeek used to deliver products and services to civilian agencies. The order names no outside vendors. The BBC reported that Snowflake, Vercel and OpenRouter all incorporate DeepSeek in offerings to their customers.

DHS Cites Chinese Data Access Laws and App Vulnerabilities

The order’s risk summary says DeepSeek’s servers are located in China and that Chinese law gives government cyber and intelligence functions broad authority to access private company infrastructure. It says DeepSeek’s account sign-up collects personally identifiable information and may fingerprint users, and that prompts sent by government employees or vendors could transfer sensitive data to China. It also states the models may contain malware or other vulnerabilities, citing a February 2025 NowSecure analysis that found multiple critical flaws in DeepSeek’s iOS app.

Agencies Had 60 Days From Issuance to Seek an Exception

Agencies that cannot comply can ask CISA for an exception in writing within 60 days of the order’s issuance, with a justification tied to mission-critical functions or national interest and a description of any alternative mitigations. Counted from the July 24, 2026 release date, that window closed on September 22, 2026, four weeks before the public notice appeared. Until removal is complete, the order encourages agencies to monitor traffic, add logging and data-exfiltration controls, and flag anomalous activity. The statute requires the secretary to review the order within one year and every year after.

Why This Matters for Engineering Leadership

The clause about third-party products is the one engineering teams need to read twice. A company selling software to a civilian agency now has to answer which models sit underneath each feature, including models reached through routing services, hosted inference providers and open-weight checkpoints a team fine-tuned in-house. DHS can issue the same kind of order against another supplier using the same statute, and the order itself is up for annual review, so this question will come back. The practical answer is a model inventory kept per product: model family, version, where it is hosted, and the path requests take to reach it, owned by a named engineer and updated whenever a team swaps a model. A team with that record answers a contracting officer in an afternoon. A team without it starts a codebase search under deadline.

FAQ