DHS orders civilian agencies to remove DeepSeek, including third-party products built on it

If you sell software or services to US federal civilian agencies and any part of it runs on DeepSeek, this order is aimed at you, not just at DeepSeek’s own app. The Department of Homeland Security’s notice in the Federal Register (FR Doc. 2026-21447, docket DHS-2026-0628, publication date October 20, 2026) orders agencies to remove “third-party products and services developed using DeepSeek implementations” from their IT systems, on top of banning purchases from DeepSeek itself.

Builder question this answers: does the new federal DeepSeek ban reach my product if I only use DeepSeek models inside it?

What the order says

The appendix to the notice is Exclusion and Removal Order #2026-01, signed by Homeland Security Secretary Markwayne Mullin with an original release date of July 24, 2026. It was issued under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321–1328) and its implementing regulations at 41 CFR part 201-1.

It requires all federal civilian agencies to:

1. Exclude DeepSeek, DeepSeek-affiliated entities, and their products from procurement “effective immediately”, including agency-approved product lists, service provider equipment lists, e-commerce markets and similar buying channels.
2. Remove products from DeepSeek and its affiliates, and third-party products and services developed using DeepSeek implementations, from agency IT systems immediately, or seek an exception.

A footnote says the procurement exclusion is meant “to include third party implementations of DeepSeek used to provide products and services to civilian agencies.” “Affiliate” follows the federal acquisition definition in 48 CFR 2.101: entities where one controls or can control the other, or a third party controls both.

What it does not cover

The order applies to federal civilian executive branch agencies except their national security systems and sensitive compartmented information systems, which fall under the Secretary of Defense and the Director of National Intelligence. It is not a ban on private companies, states, or developers using DeepSeek. Reuters, via BNN Bloomberg, notes that the Commerce Department, the Navy and states including New York, Tennessee and Virginia had already restricted DeepSeek on government devices.

Why DHS says it acted

The order cites DeepSeek servers located in the PRC, PII collection and user tracking in hosted versions, prompts that could move sensitive data to the PRC “if used by U.S. government employees or vendors,” and a warning that “the models themselves may contain malware or other security vulnerabilities.” That last point is worth noting: the concern is stated about the models, not only DeepSeek’s hosted API.

Exceptions and the 60-day clock

Agencies can ask the DHS issuing official for an exception under 41 CFR 201-1.304(b), for example to exempt certain actions or delay compliance. Requests must be in writing within 60 days of the order’s issuance and include the order, the product, a compelling justification and planned mitigations. CISA reviews them; the contact is FASCSA.Orders@cisa.dhs.gov. Until removal is complete, agencies are told to monitor traffic in and out, add logging and exfiltration controls, and flag anomalous activity. DHS will review the order within one year and annually after that.

What to check if you sell to agencies

• Inventory model dependencies. List every place your product calls the DeepSeek API or loads DeepSeek weights, including the open-weight releases we covered in DeepSeek V4.1 Flash 1017 open weights and API features like DeepSeek Search & Fetch.
• Expect customer questions. The order doesn’t spell out whether fine-tuned or distilled derivatives count as “developed using DeepSeek implementations.” If that matters for a contract, ask the agency or CISA in writing instead of guessing.
• Keep a swap path. If you use DeepSeek through an OpenAI-compatible client (see our DeepSeek V4 Flash guide), make the model and base URL configurable per tenant so federal deployments can run on a different provider.

For more model and policy changes that affect builders, see the 7minai homepage.