DHS Order Pulling DeepSeek From Agency Systems Dates to July

The Department of Homeland Security has told every federal civilian agency to remove not only DeepSeek's own products but any third-party software built on them. The order appeared in the Federal Register on 20 October 2026, at Volume 91, Number 201, pages 66346 to 66350, under docket DHS-2026-0628. The document reproduced there, Exclusion and Removal Order #2026-01, carries an original release date of 24 July 2026.

It requires two things. Agencies must exclude products and services developed by Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd and its affiliates from procurement, including from agency-approved product lists and e-commerce markets. They must also take out what is already installed. Secretary of Homeland Security Markwayne Mullin signed the order and copied it to Russell Vought, director of the Office of Management and Budget. It covers federal civilian agencies apart from their national security systems and sensitive compartmented information systems, which fall to the Secretary of Defense and the Director of National Intelligence.

The phrase that decides the scope

"Third-party products and services developed using DeepSeek implementations" is the clause that does the work, and the order does not define it. DeepSeek publishes open model weights, and other developers fine-tune and redistribute them, so the removal requirement reaches code that never touches a server in China. Nothing in the four pages says whether a fine-tuned open-weight derivative running inside a federal data centre is covered, or how an agency is meant to establish the lineage of a model shipped inside a commercial product. The honest reading is that agencies cannot resolve their own inventories without asking CISA first. A footnote defining affiliates refers to "DeepSeek AG", a name matching neither the company in the order's heading nor the slightly different one in the Federal Register summary.

What the risk case rests on

The order lists DeepSeek servers located in China, a legal system that permits government access to private company infrastructure, account creation that collects personally identifiable information and can digitally fingerprint users, a prompt-and-response design that can move sensitive material to China, and the possibility that the models themselves carry malware or vulnerabilities. For the last point it cites research by NowSecure published on 6 February 2025, which found multiple critical vulnerabilities in the DeepSeek iOS application. Other footnotes point to an April 2025 report by the House Select Committee on the Chinese Communist Party, a Stanford Cyber Policy Center piece from 5 February 2025 and a DHS advisory from 22 December 2020. The most recent item cited is from August 2025.

Agencies that want to keep something have to apply in writing within 60 days of the order's issuance, under 41 CFR 201-1.304(b), with a compelling justification and any alternative mitigations. CISA reviews those requests and approves or refuses them. Until removal is finished, agencies are told to monitor the flow of traffic in and out, turn up logging, add controls on data exfiltration and flag anomalous activity. The secretary is required to review the order within one year and annually after that.

Sixty days from 24 July ran out on 22 September, four weeks before the public saw the document. DHS has not said whether it treats some later date as the issuance that starts that clock. Nor has it published the Federal Acquisition Security Council recommendation and evidence that preceded the order, said how many agencies had DeepSeek-derived code to find, or said whether any exception has been granted.

The strongest argument for the wide wording is that a narrow ban would be trivial to walk around: an agency could buy a commercial product whose vendor had quietly built on DeepSeek weights. The cost of that choice is that no agency can be certain today what it is required to rip out.