News & commentary
A July order, revealed in October: DHS tells civilian agencies to strip DeepSeek out
The news is the filing, not the signing. What changed on October 19 is daylight: the rest — the ban, the 60-day exception window — was already running.
Muse-assisted drafting; facts and all eight translations reviewed by the owner. This is not an independent model review. This article was drafted with AI assistance and has not been independently reviewed. Figures and legal text are taken from the Federal Register notice and the signed order it publishes; commentary and interpretation are the author's own. It is not legal advice.
A July order, filed in October
On October 19, 2026, the Department of Homeland Security filed a notice for the Federal Register confirming it had issued Exclusion and Removal Order #2026-01, targeting DeepSeek products in federal civilian information technology systems. The filing entered public inspection at 8:45 a.m.; formal publication is scheduled for October 20 as Federal Register Document 2026-21447.
The signed order printed in the notice's appendix carries an original release date of July 24, 2026, and the signature of Homeland Security Secretary Markwayne Mullin, with a copy to the Office of Management and Budget director. Eighty-seven days separate the printed release date from the public filing.
That gap is the story's load-bearing detail. The news of October 19 is not a new ban — it is the first public sight of an order that has been running since July. Nothing in the notice establishes when each agency received the order, whether any exceptions were granted, or how far removal has progressed.
Exclude and remove
The order does two things in one sentence: exclude DeepSeek, its affiliates and their products from federal civilian agency procurements, and remove DeepSeek products — and third-party products and services developed using DeepSeek implementations — from civilian agency information technology systems.
Exclusion takes effect immediately after issuance and reaches agency-approved products lists, service provider equipment lists, e-commerce markets and similar procurement channels. The notice names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., while the signed appendix prints the fuller “Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.”
The order applies to federal civilian executive branch agencies, except their national security systems and sensitive compartmented information systems. Its legal basis is the Federal Acquisition Supply Chain Security Act of 2018, following a Federal Acquisition Security Council recommendation.
What DHS says the danger is
The order's risk section says DeepSeek's servers are located in the PRC and that the PRC legal system grants extensive authority to government cyber and intelligence functions to access private company infrastructure. On DeepSeek-hosted instances, the order says, account generation collects personally identifiable information and may track and fingerprint users.
Because the applications work through a prompt-and-response process that presents information to the model, the order says use “may result in the transfer of sensitive data to the PRC” — information that, alone or combined with public data, “could produce actionable intelligence” on U.S. persons or government programs.
The order adds that the models themselves “may contain malware or other security vulnerabilities,” citing open-source security research that found multiple critical vulnerabilities in the DeepSeek iOS mobile application. These are DHS's stated findings and rationale; the document does not independently establish that a particular federal deployment transferred data or was compromised.
The 60-day window that had already closed
Agencies may ask the DHS issuing official for an exception — for the agency, for certain actions, or for a delay in compliance — with a compelling justification and proposed mitigations. CISA reviews the requests and provides written approval or disapproval; exception requests go to FASCSA.Orders@cisa.dhs.gov.
But the requests must be submitted in writing within 60 days of the order's issuance. Issued on July 24, the window expired in September — weeks before the October 19 public filing. An agency seeking an exception on the day the notice went public was already past the deadline.
The order also describes interim cybersecurity measures — monitoring traffic in and out of agency systems, enhanced logging, and flagging anomalous activity — while removal is underway, and requires the Secretary to review the order within one year and annually thereafter.
Why the third-party clause is the point
The headline ban on DeepSeek is the obvious part. The substantive part is scope: the order reaches any third-party product or service developed using DeepSeek implementations. A vendor that embedded DeepSeek under a different brand is also out — agencies must audit model lineage inside their software stacks, not just front-end vendor names.
The filing also landed two days after DeepSeek's October 17 release of V4.1-Flash-1017 — but the order's July date predates that release, so the new model changes nothing about the order's reach. The release detail is reported in the cited briefing; it was not independently verified against DeepSeek's own notes.
The already-closed exception window is the governance signal: rules with retroactive teeth, published after the deadline. The order is explicitly limited to civilian executive branch agencies and does not invoke export controls on the private sector — but it is a template any future administration can extend.
Reading the order like an operator
If you sell AI into covered civilian agencies, the order is a to-do list, not a think piece: inventory every place a DeepSeek implementation appears — APIs, SDKs, embedded assistants, white-labeled services — and document the exception posture for each before the next procurement cycle.
Per the cited analysis, this is the first application of the FASCSA mechanism against a named AI software vendor at this scale, and its template is the real story: model-lineage auditing in federal procurement did not exist before this order, and now it does.
Keep the boundary honest: this is not a ban on private-sector use of DeepSeek, not a Department of Defense order, and not a finding that every supplier touching DeepSeek is barred from every federal contract. It is narrower than the headlines — and precisely that narrowness is what makes it enforceable.
Sources and further reading
Source records were reviewed by the owner; no independent factual or model review is claimed.
- DHS / Federal Register (primary)
U.S. Department of Homeland Security (Federal Register)
Recorded publication date ·
Recorded verification time ·
- TFTC (discussion)
TFTC
Recorded publication date ·
Recorded verification time ·
- D-CSIL briefing (discussion)
Derrington Collaborative Synthetic Intelligence Labs (D-CSIL)
Recorded publication date ·
Recorded verification time ·