The Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove them from their systems. The notice was published in the Federal Register on 20 October 2026 (91 FR 66346, docket DHS-2026-0628). It covers Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and third-party products and services built on DeepSeek technology. Agencies have 60 days to request exceptions from CISA, per BleepingComputer's report.
The order is defensible in its basic design. It is narrower than a general ban, and it runs through a statute built for this purpose. But two problems limit its value as a model for AI supply-chain policy: it does not say what it covers, and it took 87 days to become public.
The strongest case for the order
The case for acting is serious. A federal agency that puts sensitive data into a model hosted on infrastructure that a foreign government can reach has made a decision about that data. DHS cited concerns that the Chinese government could access DeepSeek infrastructure, collect personal information, track users and receive sensitive government data, according to Khaleej Times via AFP. Security researchers have also documented weaknesses in the app. NowSecure's February 2025 analysis of the iOS app found registration and device data sent without encryption, and a weak 3DES routine with a hardcoded key in one instance. Procurement offices cannot easily audit a model's hosting, logging and data-sharing practices. Excluding a vendor is a blunt tool, but for a government buyer it is a legitimate one.
Why the legal route matters
The order was issued under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), according to The Hacker News. Under 41 U.S.C. § 1323, the Federal Acquisition Security Council recommends exclusion and removal orders. The Homeland Security Secretary may then issue them for civilian agencies. The Defense Secretary and the Director of National Intelligence cover their own domains.
This is the right instrument, for three reasons:
- It binds the government as a buyer and user. It does not regulate private companies or consumers, and reporting says it is not a general ban on private or consumer use.
- It rests on a statute with a defined process, and it is not an ad hoc device ban.
- It has an exception path. Agencies can request a written exception with a justification and proposed mitigations, and CISA decides.
This fits a pro-innovation, pro-speech position. Restricting what government buys is different from restricting what citizens may read, build or run. Developers, researchers and companies remain free to use and criticise DeepSeek models. The order does not reach them.
Where the order is weak
The scope is undefined. The notice covers third-party products 'developed using DeepSeek implementations', but it does not define that phrase, according to The Hacker News. In the AI supply chain this matters a great deal. A vendor may call DeepSeek's open weights directly. It may fine-tune a derivative. It may use outputs distilled from DeepSeek models, or route requests through a reseller. Each of those is a different technical and legal situation. A chief information officer cannot tell which ones count as covered.
When scope is unclear, risk-averse agencies over-comply and drop useful tools. Vendors that would pass a proper review get swept out with the rest. Clear criteria would protect both security and procurement competition.
The order surfaced 87 days late. It is dated 24 July 2026, was filed for public inspection on 19 October and was published on 20 October, per The Hacker News. If the risk was serious enough for an immediate removal order, a nearly three-month gap before publication needs an explanation. The Federal Register entry gives no reasons for the order. The security rationale appears in press accounts, and the primary document does not state it. Reasoned orders are easier to defend, easier to challenge and easier for other governments to evaluate.
Contractors carry the cost. The FAR clause that implements FASCSA orders, 52.204-30, requires contractors to report a covered article within three business days of identifying it or being notified. A follow-up with mitigation details is due within 10 business days. Large vendors can absorb this. A small AI-services firm that embedded an open model deep in a product cannot do so easily, especially without a definition of what counts.
What good AI supply-chain policy looks like
The FASCSA process was designed for hardware and software vendors. AI models are harder to govern. Weights can be copied, modified and rehosted, and a model's origin is not always visible in a finished product. Excluding a named company is straightforward. Excluding every product with 'DeepSeek technology' inside is not.
Three changes would make this order, and later ones, more proportionate:
- Publish a definition of covered 'implementations'. It should separate hosted API use from locally run open weights and from derivative models.
- State the risk finding in the public record. Where classified detail must be withheld, publish an unclassified summary.
- Use CISA's exception process on technical criteria, such as data-flow isolation and no external calls, so that locally hosted deployments are judged by their actual risk.
The distinction between hosted and local use is the key technical point. The data-exfiltration concern applies to a service that sends prompts to servers abroad. It applies much less to an open-weight model run inside an agency's own environment with no outbound connection. Treating the two the same would give up a real security gain for the appearance of one.
Bottom line
DHS chose a lawful, narrow tool and aimed it at the government's own purchasing. That is the proportionate way to answer a foreign-controlled AI risk. Because the order leaves its central term undefined and gives no public reasoning, it invites over-reach and uneven compliance. The 60-day exception window is the first test: if CISA decides requests on technical risk and publishes its criteria, this order can serve as a template. If not, it will be read as a signal that agencies should avoid anything adjacent to the target, which would damage the open-model ecosystem more than it helps security.