US orders DeepSeek stripped from all civilian federal IT systems

The latest:

Civilian federal agencies must strip out every DeepSeek product and bar it from future purchasing, under an order Homeland Security filed for public inspection in the Federal Register on October 19, 2026. The order also covers third-party products and services developed using DeepSeek applications. Homeland Security Secretary Markwayne Mullin said the models present multiple threat vectors to civilian agency IT systems.

Details:

• The filing: The notice was lodged at 8:45 a.m. on October 19, 2026 as document 2026-21447, docket DHS-2026-0628, running 6 pages, with formal publication set for October 20. It is titled as an order notice on excluding and removing DeepSeek products from civilian executive branch IT and procurement.
• Legal basis: The notice rests on the Federal Acquisition Supply Chain Security Act of 2018, codified at 41 U.S.C. 1321-1328, and its implementing rules at 41 CFR 201-1. Homeland Security said the order followed review of a Federal Acquisition Security Council recommendation and the accompanying evidence, which the notice does not detail.
• The two commands: Agencies must exclude IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates, as defined under 48 CFR 2.101, from civilian federal procurement. They must also remove existing DeepSeek installations plus any third-party product or service built using DeepSeek applications.
• The stated risk: According to CyberScoop, the order cites data stored on servers in China, where national security laws let the government demand data from domestic companies. DeepSeek-hosted models collect personal information and can track digital fingerprints, and prompt processing may hand Beijing what the order calls “actionable intelligence on US persons and/or government programs.”
• Who signs, who enforces: General Counsel James Percival II signed the public notice, while Mullin signed the underlying order attached to the filing. Enforcement runs through the FASCSA order implementation team inside CISA’s cybersecurity division, reachable at fascsa.orders@cisa.dhs.gov. The order names only DeepSeek among Chinese AI models, leaving other Chinese-developed systems outside its reach.
• Scope and exclusions: Implicator reported the order is dated July 24, 2026 and took effect on issuance, covering civilian executive agencies including Treasury, State and Justice. The Defense Department is not covered, and national security systems fall under separate authorities.
• Waivers and deadlines: Agencies have a 60-day window from issuance to request exceptions with compelling justification and proposed safeguards, such as an inability to perform a critical mission or national security considerations. The notice sets no removal deadline and no separate effective date. The secretary must review the order within one year, then annually.
• Interim measures: Until removal is complete, agencies are encouraged to monitor network traffic, strengthen logging, apply data loss prevention controls and watch for anomalous activity. The order states the models may contain malicious software or security vulnerabilities, citing open-source research on flaws in the DeepSeek iOS application.
• Earlier restrictions: Commerce and the Navy had already banned DeepSeek on government devices, the Defense Information Systems Agency blocked the chatbot in January 2025, and New York, Tennessee and Virginia restricted its use. Before this order, agencies blocked the models at their own discretion, Commerce told FedScoop last year.
• No comment: Homeland Security, DeepSeek and the Chinese embassy in Washington did not respond to requests for comment, according to Implicator. Dates in the record differ: CyberScoop reported Mullin’s letter is dated June 26, while Implicator put the order itself at July 24.

Between the lines:

The removal clause reaches past DeepSeek itself to any third-party product built using its applications, which turns a single-vendor ban into a supply-chain screening problem for government software vendors. With no removal deadline set and a 60-day waiver window running, agencies face pressure to inventory dependencies before they can even know what qualifies for an exception.

What’s next

The order publishes formally on October 20, 2026. Watch the 60-day waiver window for which agencies claim mission-critical exceptions, and the secretary’s mandated review within one year on whether the exclusion is extended or narrowed.