On October 19, 2026, the U.S. Department of Homeland Security published a notice ordering civilian federal agencies to remove DeepSeek products and any third-party services built on its models from IT systems and to stop procuring them. DHS cited multiple threat vectors, including potential transfer of sensitive data to the People’s Republic of China. The underlying order dates to July 24, 2026, and was signed by Secretary Markwayne Mullin. Technology teams that support federal contracts or handle government data should inventory any DeepSeek use and prepare removal or substitution plans this week.
The Department of Homeland Security on October 19, 2026, directed U.S. civilian federal agencies to remove Chinese AI company DeepSeek’s products and third-party services built on its models from government IT systems and barred further procurement, citing national-security risks of data transfer to China.
- What changed? Civilian agencies must remove DeepSeek products and services developed using its models, and are prohibited from future acquisition.
- When? Notice published October 19, 2026 (Federal Register publication scheduled October 20). Underlying exclusion order dated July 24, 2026.
- Who is affected? Federal civilian executive-branch agencies and their vendors or contractors that process government data or operate on government systems.
- What to do this week? Scan systems, contracts, and vendor stacks for DeepSeek or derivative models; document any instances and plan removal or replacement before the next procurement cycle.
What did the DHS order actually require?
The Federal Register public-inspection notice titled “Order: Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements” requires two actions. First, agencies must remove existing DeepSeek products and any third-party services developed using DeepSeek implementations from their IT systems. Second, they must exclude the company and its affiliated entities from future procurements, including approved product lists and marketplace offerings.
DHS stated that DeepSeek models present “multiple threat vectors.” Specific concerns include the possibility that use by government employees or vendors “may result in the transfer of sensitive data to the PRC,” the generation of “actionable intelligence on U.S. persons and/or government agencies,” and the risk that the models themselves contain malware or other security vulnerabilities. The order was issued under the Federal Acquisition Supply Chain Security Act of 2018 after a Federal Acquisition Security Council recommendation.
How does the scope differ from earlier agency bans?
Individual agencies and states had already restricted DeepSeek. The Commerce Department and the Navy previously barred its use on government devices, and states including New York, Tennessee, and Virginia took similar steps. The October 19 notice is broader: it applies across civilian federal agencies, covers third-party wrappers built on DeepSeek models, and explicitly ties the restriction to procurement as well as installed systems. Department of Defense systems are outside the civilian-agency order.
The notice does not impose a general ban on private-sector or individual use of DeepSeek in the United States. It is limited to federal civilian IT systems and procurements.
Why was the order made public now?
The signed order is dated July 24, 2026. The public-inspection filing on October 19 made the previously internal directive visible and scheduled formal Federal Register publication for October 20. A July memo, also released with the notice, had already instructed agencies to monitor network traffic for DeepSeek-related risks. Publication coincides with ongoing U.S. scrutiny of Chinese AI models and with an FCC vote scheduled for October 29 on barring Chinese laboratories from testing certain electronic devices for U.S. use.
What should technology operators do this week?
Technology teams supporting federal contracts or operating environments that touch government data should treat the notice as an immediate inventory trigger. Search code repositories, API gateways, agent frameworks, and vendor statements of work for DeepSeek model names, weights, or derivative services. Where instances exist, document them and map a removal or substitution path using approved alternatives. Contractors should also check whether any subcontractors or cloud services embed DeepSeek components that could flow into federal work.
Because the order covers third-party services built on the models, simply avoiding the official DeepSeek app is not sufficient. Review model cards, fine-tuning pipelines, and open-weight deployments that may incorporate the restricted technology.
What remains open and what to watch next?
The Chinese Embassy in Washington had not commented at the time of the initial reports. Private-sector users and non-federal entities are unaffected by this specific order. Technology leaders should watch for any expansion of the restriction, additional Federal Acquisition Security Council actions, and the outcome of the October 29 FCC vote on Chinese testing labs. Agencies will also need to implement the removal and exclusion in their acquisition systems; the practical timeline for full compliance is not specified in the notice itself.
FAQ
Does the ban apply to private companies?
No. It applies to federal civilian agency IT systems and procurements, not to private-sector or individual use.
Are third-party services covered?
Yes. The order covers products and services developed using DeepSeek implementations, not only DeepSeek’s own applications.
When did the order take effect?
The signed order is dated July 24, 2026. The public notice appeared October 19, with Federal Register publication scheduled for October 20.
Does it cover Department of Defense systems?
The order is specific to civilian agencies. Defense systems are excluded from this directive.
What threat vectors did DHS cite?
Potential transfer of sensitive data to China, generation of actionable intelligence on U.S. persons or agencies, and possible malware or vulnerabilities in the models.
Last Updated: October 20, 2026.
Related: CoreWeave Bonds Reach Distressed Levels on October 15, 2026: Notes for Technology · UK CMA Proposes Strategic Market Status for Microsoft Business Software, October 16, 2026: Notes for Law · Technology department coverage on Kurums.
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.