DHS Orders Civilian Agencies to Remove DeepSeek and Block Future Purchases

The U.S. Department of Homeland Security (DHS) issued a supply-chain security order under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA) covering artificial intelligence products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek). Signed by DHS Secretary Markwayne Mullin on July 24, 2026, the order took effect in late July and was made public on October 19 through a Federal Register notice reported as scheduled for publication on October 20. The timing matters to contractors: the restrictions are not simply a prospective policy announcement, but an active acquisition and remediation requirement for covered federal civilian systems and purchases.

The order applies to federal civilian executive-branch agencies and covers DeepSeek products and services, offerings from its affiliates, and third-party products or services built using DeepSeek implementations. Agencies are directed to remove covered technology and are barred from future purchases, subject to any applicable exception. The source reporting describes a 60-day period for agencies to remove covered technology, while other supplied signals indicate that the removal timing is not consistent across accounts. A separate 60-day process is described for exception requests. Suppliers should therefore avoid assuming a single uniform deadline and should verify implementation instructions directly with their federal customers.

DHS cited several risk concerns in its order. It said DeepSeek presents “multiple threat vectors that pose significant risk to the cybersecurity of U.S. government systems,” pointing to collection and storage of user data in China, transmission of prompts and AI-generated responses to servers in the People’s Republic of China, and security and privacy vulnerabilities identified through forensic analyses. DHS also warned that models could produce inaccurate, biased, or harmful content. These concerns create practical obligations beyond a direct software inventory: agencies and contractors may need to trace embedded models, hosted services, subcontractor tools, reseller offerings, and other dependencies to establish whether a covered implementation is present.

For GovCon firms, the order creates near-term compliance and services work as well as potential acquisition constraints. Contractors and systems integrators supporting civilian agencies should identify AI components and document model provenance throughout their product and service supply chains. They may also be positioned to assist customers with removal, replacement planning, configuration changes, security monitoring, and data-protection controls. The Cybersecurity and Infrastructure Security Agency (CISA) is identified as overseeing implementation through its FASCSA Order Implementation Team, reviewing exception requests, and providing technical assistance. The Department of Defense, the U.S. Intelligence Community, and national security systems are identified as outside the order’s scope in the supplied reporting; firms working across agency segments should distinguish covered civilian deployments from excluded environments rather than treating the restriction as government-wide.

• Scope: The order covers federal civilian executive-branch agencies and reaches DeepSeek products, affiliate offerings, and third-party products or services built using DeepSeek implementations.
• Acquisition impact: Agencies must stop future purchases of covered technology unless an applicable exception is granted; contractors should screen new bids, renewals, and proposed solutions for covered components.
• Removal timing: One source describes a 60-day removal period, but reporting on timing differs. Confirm deadlines and implementation directions with each affected federal customer.
• Exceptions: A 60-day process for exception requests is reported. CISA is identified as reviewing requests and providing technical assistance through its implementation team.
• Risk rationale: DHS cited data collection and storage in China, transmission of prompts and AI-generated responses to servers in the People’s Republic of China, and security and privacy vulnerabilities found through forensic analyses.
• Interim safeguards: Secretary Mullin said agencies are encouraged to monitor network traffic, enhance logging, strengthen controls on data exfiltration, and detect and flag anomalous activity while removal is underway.
• Contractor action: Inventory AI components, model provenance, hosted services, subcontractors, resellers, and embedded or third-party implementations; retain evidence of screening and remediation decisions.
• Contract administration: Where applicable, review reporting obligations under FAR 52.204-30 and coordinate promptly with contracting officers and agency security teams.
• Exclusions: The supplied reporting identifies DoD, the U.S. Intelligence Community, and national security systems as outside the order’s scope; verify applicability for mixed civilian and national security programs.