The Department of Homeland Security has ordered U.S. federal civilian agencies to remove DeepSeek technology from their information-technology systems and stop purchasing products and services developed by the Chinese artificial-intelligence company. The directive also reaches DeepSeek affiliates and third-party products or services developed using DeepSeek implementations, making it a software-supply-chain restriction rather than a ban limited to DeepSeek’s own applications. The Federal Register notice identifies the company as Hangzhou DeepSeek Artificial Intelligence Co., Ltd. [1]
Homeland Security Secretary Markwayne Mullin signed the exclusion and removal order on July 24 under the Federal Acquisition Supply Chain Security Act of 2018. DHS published the notice on October 20, documenting the order as Exclusion and Removal Order #2026-01 and assigning it to docket DHS-2026-0628. The procurement prohibition applies to civilian executive-branch agencies, while national-security systems and Department of Defense systems are outside the order’s scope.
Agencies must exclude covered DeepSeek products from procurement channels, including approved-product lists, service-provider equipment lists and electronic marketplaces. The removal requirement covers technology already deployed in agency environments, as well as outside software or services that were developed using DeepSeek implementations. The restriction does not apply to private companies, consumers, state and local governments or the general public.
The order is a supply-chain security action, not a response to a publicly identified software vulnerability. The Federal Register notice does not cite a CVE, CVSS score, public proof of concept or confirmed exploitation in the wild, and it does not attribute the activity to a named threat actor. Instead, DHS says the order followed a review and recommendation by the Federal Acquisition Security Council under the federal supply-chain security framework. As a result, defenders should not interpret the directive as evidence that every DeepSeek deployment is exploitable; its practical concern is the technology’s provenance and presence in government systems.
Agencies seeking relief were required to submit written exception requests to the CISA FASCSA Order Implementation Team within 60 days of the order’s issuance, with a compelling justification such as an effect on mission-critical functions or a national-security consideration. Requests must identify the affected technology and proposed risk mitigations, while CISA may provide technical assistance to agencies facing implementation difficulties. Federal IT and procurement teams should therefore inventory direct DeepSeek deployments and third-party services with embedded or derived DeepSeek components, remove them where required, and preserve records showing how replacement technologies were evaluated.
