The Department of Homeland Security has ordered federal civilian agencies to stop buying products from Chinese artificial intelligence developer DeepSeek and to remove its technology from their networks, including third-party products “developed using DeepSeek implementations,” according to a notice published Tuesday in the Federal Register. Because the order reaches tools made by other companies, software vendors and federal contractors that build AI into their products now face questions about what models sit inside them.
What Happened
The public-inspection notice, filed Monday and signed by DHS General Counsel James H. Percival II, announces a two-part order from the secretary of homeland security. The first excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates from civilian agency purchasing. The second requires agencies to remove those products, along with third-party products and services built using DeepSeek implementations, from their systems.
The signed order, attached as an appendix, is titled “Exclusion and Removal Order #2026-01.” It bears Secretary Markwayne Mullin’s signature and lists an original release date of July 24, 2026. CyberScoop, which reported the notice Monday, described the underlying Mullin letter as dated June 26. The documents do not explain the gap. Either way, the order was in force for months before it was made public.
Exclusion took effect immediately and extends to agency approved-product lists, e-commerce marketplaces and similar buying channels. Removal is also immediate unless an agency seeks an exception. Requests must be submitted in writing within 60 days of the order’s issuance, with a compelling justification, such as harm to mission-critical functions or national security considerations, and any alternative safeguards. The Cybersecurity and Infrastructure Security Agency (CISA) reviews them.
Until removal is complete, agencies are encouraged, but not required, to monitor network traffic, tighten logging and controls on data leaving their systems, and flag unusual activity. The order covers civilian executive branch agencies but not their national security systems or secure compartmented information systems, which the law leaves to the Defense Department and the director of national intelligence.
Why It Matters
Earlier limits were piecemeal. Reuters, in a report carried by BNN Bloomberg, noted the Commerce Department and the Navy had banned DeepSeek on government devices, and that New York, Tennessee and Virginia had taken similar steps. CyberScoop noted Commerce told FedScoop last year that agencies were blocking such models at their own discretion. This order turns that into a binding rule across civilian government, and it extends into suppliers’ products.
That is where contractors face uncertainty. The order does not define “developed using.” The Register asked whether it covers ongoing access to DeepSeek models through an application programming interface (API), code written with AI assistants, or AI gateways such as OpenRouter and Vercel AI Gateway, which can route requests to DeepSeek models without users noticing. Chinese open models already handle most tokens on those two gateways. Katie Moussouris, chief executive of Luta Security, told The Register that banning DeepSeek’s own app and API is workable but that the broader clause cannot practically be verified.
DHS’s rationale centers on China. The order says DeepSeek’s servers are in the People’s Republic of China, whose laws give authorities broad access to company infrastructure; that DeepSeek-hosted models collect personal information and may fingerprint users; that prompts from government employees or vendors could carry sensitive data to China; and that the models “may contain malware or other security vulnerabilities.” Several of those risks concern DeepSeek’s own hosted service, a point Moussouris made in arguing that U.S.-hosted copies avoid most of them.
Context
The order rests on the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), which, the order explains, created the Federal Acquisition Security Council to recommend excluding or removing risky products from federal systems and lets the homeland security secretary issue binding orders for civilian agencies. DHS acted on a council recommendation.
What to Watch
- Whether CISA issues guidance on what “developed using” means, especially for DeepSeek models run on U.S. servers, and whether agencies start asking vendors to certify which models their products use.
- Which agencies seek exceptions. If the order was issued on its July 24 release date, the 60-day window would already have passed.
- Whether the council moves against other Chinese models. DeepSeek is the only one named; CyberScoop pointed to Moonshot AI’s Kimi and Alibaba’s Qwen as having drawn similar concerns.
- Any response from DeepSeek, which none of the coverage reported; the Chinese Embassy did not immediately comment to Reuters.
