DHS Orders DeepSeek Removal Across Federal Civilian IT Systems

The Department of Homeland Security (DHS) has issued a Federal Acquisition Supply Chain Security Act (FASCSA) exclusion and removal order covering Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliated entities, and certain third-party products and services developed using DeepSeek implementations. The directive applies across roughly 430 federal civilian agencies and requires agencies to stop new purchases and remove covered offerings already deployed in their information-technology systems. Public reporting says the order became public on October 19–20, 2026, after DHS signed the underlying directive months earlier. That disclosure gap is operationally significant: agencies and contractors may now need to assess products and deployments against a restriction that was not publicly visible when some procurement and implementation decisions were made.

The order combines a forward-looking purchasing restriction with a cleanup requirement for existing systems. Its scope extends beyond products branded or sold directly as DeepSeek: third-party offerings developed using DeepSeek implementations may also be covered. That language makes the issue relevant to software vendors that have embedded, adapted, or otherwise used DeepSeek technology in products delivered to the federal market. For contractors, compliance review therefore cannot stop at checking product names or the models running in production. Teams may need to examine development and deployment records, supplier attestations, model lineage, and subcontractor practices to determine whether covered implementations were used.

The action invokes FASCSA, a federal supply-chain security framework, following a recommendation from the Federal Acquisition Security Council (FASC), according to source reporting. The order establishes no government-wide removal deadline, leaving agencies to plan implementation while awaiting or applying further guidance. It also does not create a general prohibition on private-sector use. The stated exception process presents a separate planning challenge: agencies seeking relief must submit a compelling justification 60 days in advance, while reporting indicates the formal exception window closed before the order was publicly disclosed. Agencies and vendors should avoid assuming that an exception remains readily available and should verify applicable procedures with the relevant authorities.

For the GovCon market, the practical effect is heightened attention to AI supply-chain traceability in both current operations and future bids. Contractors should inventory DeepSeek use across products, development workflows, and deployment environments; document any unresolved provenance gaps; and prepare replacement or remediation plans for affected offerings. Vendors that cannot substantiate provenance should consult the Cybersecurity and Infrastructure Security Agency (CISA) rather than make unsupported compliance certifications. Federal buyers, meanwhile, should review active systems and upcoming procurements for potentially covered products and ensure solicitation, evaluation, and vendor-management processes address the order’s scope. The order places model lineage and development history closer to the center of federal technology risk review, potentially affecting product design choices and the evidence vendors must retain for government customers.

• DHS issued a FASCSA exclusion and removal order covering DeepSeek and affiliated entities.
• The directive applies to roughly 430 federal civilian agencies.
• Agencies must halt new purchases and remove covered products from existing IT systems; no government-wide removal deadline is established.
• Covered offerings include third-party products and services developed using DeepSeek implementations, not only DeepSeek-branded tools.
• The order does not establish a general ban on private use of DeepSeek.
• Agencies seeking an exception face a 60-day advance compelling-justification requirement; reporting says the formal exception window closed before public disclosure.
• Contractors should inventory DeepSeek use across product development and deployment, document provenance gaps, and plan replacements where needed.
• Vendors unable to substantiate provenance should consult CISA rather than certify unsupported compliance.
• Federal suppliers should review current deployments and future bids for supply-chain traceability requirements and potential impacts on product eligibility.