TL;DR: The Department of Homeland Security has filed a Federal Register notice, scheduled for publication on October 20, 2026, of an order it already issued: Exclusion and Removal Order #2026-01, with an original release date of July 24, 2026. The order bars federal civilian agencies from buying products and services developed by DeepSeek and its affiliates, and requires them to remove DeepSeek products, including “third-party products and services developed using DeepSeek implementations,” from their systems. If you sell software or services to federal civilian agencies, check now whether anything you deliver uses DeepSeek models or APIs, including through a supplier.

Every fact about the order below comes from the DHS notice (Federal Register document 2026-21447) and the signed order in its appendix.

What happened

DHS filed the notice for public inspection on October 19, 2026, and it is scheduled for publication in the Federal Register on October 20. It isn’t a new order. The notice publishes “the Secretary of Homeland Security’s issuance of an order,” and the signed order in the appendix lists an “Original Release Date” of July 24, 2026. That order says agencies must exclude DeepSeek products “effective immediately after issuance.”

Per the notice, the order does two things:

  • Exclusion: it excludes “information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities,” from federal civilian agency procurements. (The signed order names the company as Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.)
  • Removal: it removes “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.”

The exclusion reaches beyond direct purchases. It covers “agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions that facilitate the procurement of information technology hardware, software, and services.” A footnote adds that it includes “third party implementations of DeepSeek used to provide products and services to civilian agencies.”

Who’s covered. The order applies to “Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems.” It says the Secretary’s authority applies “to the extent not covered by” the Secretary of Defense and the Director of National Intelligence, and its background section excludes systems “under the Department of War and the Office of the Director of National Intelligence.”

Legal authority. The order was issued under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), 41 U.S.C. 1321-1328, and its rules at 41 CFR part 201-1, “following review of the Federal Acquisition Security Council Recommendation and affiliated evidence.” Affiliates are defined by 48 CFR 2.101: either company “controls or can control the other,” or a third party “controls or can control both.”

Why DHS says it acted. The order states that “DeepSeek’s models present multiple threat vectors.” It says DeepSeek’s servers are in China and that its prompt-and-response apps “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors.”

Why it matters

The removal requirement isn’t limited to DeepSeek’s own apps. It covers third-party products and services “developed using DeepSeek implementations,” so an AI feature inside another vendor’s product can fall under it. The order doesn’t define “DeepSeek implementations.” It also doesn’t say whether a DeepSeek model you host yourself is treated differently from DeepSeek’s own API.

Exceptions. Executive agencies can request an exception from DHS, “such as asking that the order not apply to the agency, certain actions, or for a delay in compliance.” Requests must be “submitted in writing within 60 days of the issuance of this order.” The 60 days is a deadline for exception requests, not a removal grace period: removal is required “immediately after the issuance of the Order, or seek an Exception.”

Until removal is complete, agencies are encouraged to add “enhanced logging and controls on data exfiltration.” DHS will review the order “within one year and annually thereafter.”

What vendors and builders should check (our guidance)

This section is OneSignalDesk’s guidance, not part of the DHS order. It isn’t legal advice.

  1. Map your models. List every AI model and API your product calls, including fallbacks and model routers. Flag anything from DeepSeek.
  2. Ask your suppliers. If you use another company’s AI features, embedded agents or hosted models, ask in writing whether any of them use DeepSeek models or APIs.
  3. Don’t assume self-hosting is exempt. The order covers products and services “developed using DeepSeek implementations” and doesn’t carve out open-weight models you run yourself. If you use DeepSeek weights, or a model built on them, raise it with your contracting officer.
  4. Check how you’re listed. The exclusion covers agency-approved product lists and e-commerce markets, so check how your product is described where agencies buy it.
  5. Keep a record. Expect questions from federal customers, and write down what you checked and when.
  6. Use the official contact. Questions about the order go to CISA’s FASCSA Order Implementation Team at [email protected], the contact listed in the notice.

Sources & method

Sources

Method. Last checked October 20, 2026. Facts and quotes about the order come only from the DHS notice and the signed order in its appendix. The appendix is a scanned image, so we read it with text recognition, checked the quoted passages against the page images, and left out anything we couldn’t read clearly. The image is the heading of the signed order from the notice’s appendix. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.