DHS orders DeepSeek removed from US federal civilian agency IT systems

The US Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove them from their IT systems, according to a notice scheduled for the Federal Register on 20 October 2026 [1]. The signed order attached to the notice lists 24 July 2026 as its original release date [1][2].

What does the DeepSeek order require?

The Department of Homeland Security ordered civilian federal agencies to exclude and remove DeepSeek products. The order covers Hangzhou DeepSeek Artificial Intelligence and its affiliated entities, plus third-party products and services developed using DeepSeek implementations [1].

The procurement ban applies immediately after issuance and extends to agency-approved product lists and e-commerce markets, according to the order [1]. National security systems and secure compartmented information systems are outside its scope; defence and intelligence systems fall under separate authorities [1].

The legal basis is the Federal Acquisition Supply Chain Security Act of 2018, following a review of a Federal Acquisition Security Council recommendation [1]. The document is titled Exclusion and Removal Order #2026-01 and is issued by Homeland Security Secretary Markwayne Mullin [1].

Why does DHS call DeepSeek a risk?

The order says DeepSeek's servers are located in China, whose legal system it says gives government cyber and intelligence functions extensive access to private company infrastructure [1]. It also says DeepSeek-hosted models collect personally identifiable information and may track and digitally fingerprint users [1].

The order adds that the models themselves may contain malware or other security vulnerabilities, and cites outside research on critical flaws in DeepSeek's iOS app [1]. It does not describe any specific incident at a federal agency [1].

When was the order actually issued?

The DHS order lists 24 July 2026 as its original release date, nearly three months before the public notice. The notice was filed for public inspection on 19 October at 8:45 a.m. Eastern time and is scheduled for publication on 20 October, 88 days after the listed release date [1].

CyberScoop reported that the attached letter ordered the exclusion on 26 June [2]. The AI Pin found 24 July on the order's cover page and no 26 June date in the six-page document, so we use 24 July [1].

What happens next for agencies?

CISA reviews exception requests, which agencies must file in writing within 60 days of the order's issuance. Requests need a compelling justification, such as the impact on mission-critical functions or national security considerations [1].

Counted from 24 July, that window would have closed on 22 September, before the public notice appeared. The notice does not say whether agencies were informed earlier [1].

Until removal is complete, the order encourages agencies to monitor traffic, add logging and controls on data exfiltration, and flag anomalous activity [1]. The Secretary must review the order within one year and annually after that [1].

CyberScoop noted that DeepSeek is the only Chinese AI model named in the order [2]. The AI Pin recently covered DeepSeek's V4.1 Flash update and new search API (theaipin.com/trends/deepseek-updates-v4-1-flash-and-opens-search-api).

Our read

Opinion: Taking a China-hosted chatbot off government networks is a defensible baseline. The hard part is the order's reach into third-party products built on DeepSeek implementations, because open-weight models run on many vendors' servers, and agencies will need clear guidance on what counts.

What we could not verify

• Why the order was made public only on 20 October, almost three months after its listed release date; DHS has not explained the gap.
• CyberScoop's 26 June date; it does not appear in the PDF we reviewed, which shows 24 July.
• Whether any agency asked for or received an exception, and how many agencies used DeepSeek products.
• Whether DeepSeek has responded; we found no statement as of 03:00 CEST on 20 October.
• The Federal Acquisition Security Council recommendation and evidence behind the order are not public.
• The order's appendix is a scanned image; our quote comes from our own transcription of the page.