TL;DR
A DHS notice filed for public inspection on October 19 describes an order excluding DeepSeek and defined affiliates from federal civilian agency procurements and requiring removal of their products and covered third-party implementations from civilian agency IT. The appended order lists July 24 as its original release date; formal Federal Register publication is scheduled for October 20. Its scope excludes specified national-security systems and includes an exception process. DHS attributes the restrictions to security risks, including possible transfer of sensitive government data to the PRC.
What DHS ordered
The notice (FR Doc. 2026-21447, docket DHS-2026-0628) was filed for public inspection on October 19 at 8:45 a.m., with formal Federal Register publication scheduled for October 20. It describes two requirements: exclusion of DeepSeek, defined affiliates, and their covered products from federal civilian agency procurements, and removal of covered products from civilian agency IT.
The removal requirement also covers third-party products and services developed using DeepSeek implementations. The order applies to federal civilian executive-branch agencies, except their national-security and sensitive compartmented information systems. It rests on the Federal Acquisition Supply Chain Security Act of 2018 and a Federal Acquisition Security Council recommendation.
Released in July, filed publicly in October
The signed appendix identifies Exclusion and Removal Order #2026-01, names Homeland Security Secretary Markwayne Mullin, and lists an original release date of July 24, 2026. Its requirements take effect immediately after issuance. The October 19 filing date establishes when this notice entered public inspection; it does not establish when each agency received the order, whether exceptions were granted, or whether removal is complete.
The public filing comes two days after DeepSeek's October 17 V4.1-Flash-1017 release, covered in an earlier briefing, but the order's July date predates that model update. DHS used existing supply-chain authority; Engadget also notes that lawmakers proposed a government-device ban last year.
What DHS says the danger is
DHS describes several security risks in the order, including potential government access to company infrastructure in the PRC, collection of user information by DeepSeek-hosted services, possible transfer of sensitive data, and possible malware or vulnerabilities. These are DHS's stated risk findings and rationale for the restrictions; this briefing has not independently established that a particular deployment transferred government data or contained malware.
The order combines procurement exclusion with removal from covered systems. Agencies may request exceptions, including for certain actions or a delay in compliance; the text calls for written requests within 60 days of issuance. It also describes interim monitoring and controls while removal is underway. The notice does not report agency-by-agency implementation status.
Why it matters beyond the government
For suppliers serving covered civilian agencies, the practical question is where DeepSeek implementations appear in products delivered to those agencies. The third-party clause reaches beyond a branded chatbot, so vendors should examine covered integrations and the order's exception process. This is not a general prohibition on private-sector use or a finding that every supplier using DeepSeek is barred from every federal contract.
Our view: the order is another sign that AI procurement is becoming a supply-chain policy issue. Its immediate significance is the combination of exclusion and removal for covered civilian systems. Its defined scope and exception process matter when assessing the impact; the notice does not establish a universal ban across the entire federal market.