DHS Order Excludes DeepSeek From Civilian Agency Procurement

The Department of Homeland Security (DHS) issued Exclusion and Removal Order #2026-01 on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). Made public on October 20, the order excludes DeepSeek, its defined affiliates, and covered products or services from federal civilian-agency procurement. Its scope also reaches certain third-party implementations built using DeepSeek technology. The removal directive took effect October 16, requiring covered deployments to be identified and removed from agency IT systems. The order is therefore relevant not only to direct purchases of DeepSeek applications, but also to software, hosted services, and offerings that embed or otherwise rely on covered implementations.

The stated rationale centers on supply-chain and national security concerns. In the July order, DHS warned that DeepSeek servers are located in China, where authorities have broad powers to access private-company information. The department said information submitted by U.S. government employees or contractors could be transferred to China and potentially used to gather intelligence about federal personnel and operations. DHS also cited concerns involving personal-information collection, user tracking, and cybersecurity weaknesses. These are the government’s stated risk assessments; contractors should distinguish them from independently established findings when documenting compliance decisions.

Reporting on the order describes a broad operational prohibition: a **Cybersecurity and Infrastructure Security Agency (CISA)** spokesperson said FASCSA orders prohibit executive agencies from “installing, accessing, or running” a DeepSeek application and require agencies to identify and remove existing installations. The federal contracting database **SAM.gov** reportedly lists DeepSeek under an active exclusion effective October 16, with no scheduled expiration. The measure applies to federal civilian agency work and procurement; it is not a general restriction on private or consumer use. National security systems are governed separately, so civilian procurement teams should avoid treating the order as a universal government-wide rule for every system category.

For contractors, the immediate task is supply-chain discovery and contract-specific assessment. Inventory direct applications, model APIs, hosted services, subcontractor tools, and embedded models; then determine whether any covered deployment supports civilian-agency work or appears in an agency environment. Organizations should preserve model provenance, vendor attestations, architecture records, and data-flow documentation, and assess replacement, removal, remediation, and cybersecurity support needs. The order describes a formal exception process for mission-critical needs, but the stated 60-day request window ran from July 24 and had elapsed by October 20. Procurement teams should not assume that the initial request period remains open; they should consult the applicable agency and order procedures before relying on an exception.

• Order and authority: DHS issued Exclusion and Removal Order #2026-01 on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018.
• Covered supplier and scope: The order names DeepSeek, defined affiliates, and covered products or services, including certain third-party implementations.
• Effective removal date: The directive to remove covered deployments from agency IT systems took effect October 16, 2026.
• Procurement impact: Covered DeepSeek technology is excluded from federal civilian-agency procurement and cannot be treated as an eligible solution for affected civilian work.
• Operational prohibition: CISA said executive agencies are prohibited from installing, accessing, or running covered applications and must identify and remove existing installations.
• Exclusion status: Reporting says SAM.gov lists DeepSeek under an active exclusion effective October 16, with no scheduled expiration.
• Risk rationale: DHS cited potential transfer of government-submitted information to China, personal-data collection and tracking concerns, and cybersecurity weaknesses.
• Exception timing: The formal exception process is described in the order, but the 60-day request period measured from July 24 had elapsed by October 20.
• Contractor action: Inventory software, hosted services, subcontractor offerings, and embedded models; document model provenance and data flows, then plan replacements or remediation where needed.
• Scope boundary: The order concerns federal civilian procurement and deployments; it is not a general ban on private or consumer use, and national security systems are governed separately.