ings
The US Department of Homeland Security has disclosed an order requiring covered federal civilian executive branch agencies to exclude DeepSeek products from procurement and remove them from their IT systems. Its reach includes products from DeepSeek affiliates and third-party products and services developed using DeepSeek implementations.
The notice was filed for public inspection on October 19, 2026, with Federal Register publication scheduled for October 20. The attached order lists an original release date of July 24. Public disclosure therefore should not be confused with the start of the order’s requirements. Source: DHS notice and signed order.
Third-Party Branding Does Not Set the Boundary
The order addresses both purchasing and existing deployments. Covered products must be excluded from procurement channels, including approved product lists, and removed from agency IT systems.
For suppliers, the third-party provision is particularly significant. A product sold under another company’s brand may still fall within scope if it uses a DeepSeek implementation. Agencies therefore need to look beyond the seller’s name to the underlying technology.
The document does not separately resolve every fine-tuning or distillation scenario. The treatment of individual products will depend on their implementation and further guidance.
The order applies to covered federal civilian procurement and IT systems. It does not establish a blanket prohibition on private use across the United States. It also expressly excludes national security and compartmented information systems from its stated scope; separate restrictions may apply to those systems.
The Security Concerns Cited by DHS
DHS identifies risks involving data transfers, personal information collection and software security.
For DeepSeek-hosted services, the agency raises concerns that sensitive information submitted by government employees or vendors could be transferred to China. It also discusses registration data, potential user tracking and device fingerprinting.
The order cites research into vulnerabilities in DeepSeek’s iOS application and raises the possibility of malware or other vulnerabilities in the models. These are DHS’s stated grounds for the procurement action, rather than proof that every DeepSeek deployment has leaked data.
The 60-Day Window Is for Exceptions
The order requires exclusion and removal immediately after issuance. Agencies may request exceptions, including a delay in compliance, by identifying the affected products, providing justification and describing alternative risk mitigations.
Written requests must be submitted within 60 days of issuance. That provision is not a general grace period for continued purchasing or use, and the October publication does not restart it.
Pending removal, DHS encourages stronger traffic monitoring, logging and controls against data exfiltration. CISA may provide technical assistance where agencies lack sufficient internal capability.
For AI vendors seeking federal business, the implication is straightforward: buyers need to know not just whose name is on the product, but whose model is underneath it.