DHS makes public a July order barring DeepSeek from federal civilian agencies' purchases and IT systems

As of 9:39 a.m. ET, Monday, Oct. 19, 2026

The U.S. Department of Homeland Security has made public an order directing federal civilian agencies to stop buying products from the Chinese artificial intelligence company DeepSeek and to remove DeepSeek products from their information technology, in a notice placed on public inspection at the Federal Register on Monday, Oct. 19. The signed order included in the notice's appendix lists an original release date of July 24, 2026. It was not clear whether agencies had been notified before Monday.

The notice, Federal Register document 2026-21447, was filed for public inspection at 8:45 a.m. ET and is scheduled to be published in the Federal Register on Tuesday, Oct. 20, according to the Federal Register.

What the order covers

According to the notice, the Secretary of Homeland Security ordered "(1) exclusion of information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in 48 CFR 2.101, from federal civilian agency procurements; and (2) removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology."

The order applies to federal civilian agencies' purchasing and IT systems, according to the notice. The notice does not describe any restriction on businesses or the public outside the federal government.

Legal basis

The notice says the order was issued "Pursuant to the authority granted by the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328, and implementing regulations at 41 CFR 201-1, following review of the Federal Acquisition Security Council Recommendation and affiliated evidence."

The notice is signed by James H. Percival II, general counsel of the U.S. Department of Homeland Security. It lists the FASCSA Order Implementation Team in the Cybersecurity and Infrastructure Security Agency's Cybersecurity Division as the contact for further information.

The signed order

The signed order included in the notice's appendix is titled "Exclusion and Removal Order #2026-01" and lists an "Original Release Date: July 24, 2026." It is from "Markwayne Mullin, Secretary, Department of Homeland Security," and bears his signature, with a copy to "Russell Vought, Director, Office of Management and Budget," according to the appendix.

The order says it "Applies To: Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems."

It requires civilian agencies to exclude DeepSeek, its affiliated entities and their products from agency purchasing "effective immediately after issuance of this Order," and to remove DeepSeek products, affiliates' products and third-party products and services developed using DeepSeek implementations from agency IT systems "immediately after the issuance of the Order, or seek an Exception." Agency requests for exceptions "must be submitted in writing within 60 days of the issuance of this order," the order says.

In the order, DHS said, "DeepSeek servers are located in the PRC, and the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure."

DHS said that for DeepSeek-hosted instances of its models, DeepSeek's account generation process "collects personally identifiable information (PII) and may also track and digitally fingerprint users." DHS said DeepSeek's most widely used applications function through a prompt-and-response process "which may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors."

DHS also said, "The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs. The models themselves may contain malware or other security vulnerabilities." DHS cited findings by the mobile security firm NowSecure.

The notice says a copy of the signed order is in its appendix and can be found on regulations.gov under DHS Docket Number DHS-2026-0628. The signed order was not yet posted on regulations.gov as of 9:39 a.m. ET.

Reaction

DeepSeek, China's Ministry of Foreign Affairs and the White House had not commented publicly on the order as of 9:39 a.m. ET, according to their websites and X accounts.

Separately, GROKsiNEWS.com reported Sunday that DeepSeek released its V4.1-Flash-1017 update and said it beat its predecessor on every benchmark it reported.