Federal civilian agencies in the United States must completely remove all DeepSeek products from their information technology systems, along with any third-party products or services built using DeepSeek technology, under a Department of Homeland Security order issued by Secretary Markwayne Mullin. The directive also prohibits these agencies from purchasing any information technology products or services from the Chinese AI developer or its affiliated companies. The order, dated July 24, 2026, was published in the Federal Register on October 20, represents the first use of the Federal Acquisition Supply Chain Security Act of 2018 against an artificial intelligence company.
The order specifically names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer behind the R1 and V3 models, and extends to all its affiliates as defined under federal acquisition regulations. DeepSeek's own privacy policy acknowledges that it collects, processes, and stores users' personal data within the People's Republic of China. The directive applies exclusively to civilian agencies—it doesn't restrict use by private companies or the general public. Federal contractors working under contracts that include FAR clause 52.204-30 are also barred from providing or using any product or service covered by the order unless they receive a waiver from the issuing official. The notice published in the Federal Register doesn't define what constitutes "DeepSeek implementations," leaving some ambiguity about the scope of prohibited third-party products.
According to the law, executive agencies "shall comply with exclusion and removal orders," though an agency can request an exception in writing if it provides compelling justification to the official who issued the order. The 2018 law grants three officials the authority to issue such orders: the Secretary of Homeland Security for civilian agencies, the Secretary of Defense for the Defense Department and national security systems, and the Director of National Intelligence for the intelligence community. This marks only the second time the 2018 law has been invoked—the first instance came in 2025 when the Director of National Intelligence excluded Acronis, a Swiss cybersecurity and data protection company, from intelligence community procurement. Federal contractors must now search SAM.gov for the phrase "FASCSA order" at least once every three months, make reasonable inquiries into their supply chain when a new order could affect them, and report any covered product or service to the contracting officer within three business days of identifying it.
The DHS order was dated July 24 but wasn't filed for public inspection at the Federal Register until October 19—87 days later—and published the following day. The council's regulations leave the timing of public release to the discretion of the issuing official, with no mandatory deadline. Before this federal-level order, restrictions on DeepSeek had been implemented piecemeal: by February 2025, Congress, NASA, the Navy, the Pentagon, and Texas had each banned DeepSeek from government devices, and bills to bar DeepSeek on government devices were introduced in both the House and Senate that month but hadn't advanced past committee as of October 21. China's foreign ministry spokesperson Mao Ning responded at an October 20 briefing that "China consistently opposes the overstretching of the concept of national security" and that Beijing will "resolutely safeguard the legitimate rights and interests of Chinese companies," the Associated Press reported. The law requires the issuing official to notify the company named in an order and the appropriate congressional committees, and to review the order at least annually.
The sweeping nature of this directive—covering not just DeepSeek's own products but anything built using its technology—signals a hardening regulatory posture that may force federal contractors to conduct extensive supply chain audits with limited technical guidance. Organizations that have embedded AI capabilities without tracking their provenance now face a compliance challenge that could reshape how government vendors approach third-party technology integration going forward.