DHS bars DeepSeek from federal civilian IT systems

By VK

Published 21 Oct 2026, 10:58 UTC

Reporting from TechCrunch

A Homeland Security order bars civilian agencies from buying DeepSeek products and requires removal of third-party tools built on its technology.

What it means for founders

Map your model supply chain now. If you sell to civilian agencies, or to contractors that serve them, the removal duty reaches products built on DeepSeek, not only its app. Keep a written record of which model powers each feature, including open-weight models you host yourself, because procurement teams may ask.
Self-hosting is an open question. The order covers third-party products developed using DeepSeek implementations, but it does not say whether a DeepSeek model running on US infrastructure counts. Its listed risks include data sent to servers in China and possible flaws in the models themselves. Keep a tested fallback model so a swap does not mean a rebuild.
Watch for the rule to spread. The signals to track are CISA's exception decisions, any state or enterprise buyer that adds similar language to vendor security questionnaires, and the first annual review. Separately, DeepSeek is reported to be nearing a $12 billion round from CATL and Tencent.

The story

The Department of Homeland Security has told federal civilian agencies to stop buying from Chinese AI developer DeepSeek and to strip its technology out of their IT systems. Notice of the order appeared in the Federal Register on Tuesday, October 20, as TechCrunch reported. Software from other vendors built with DeepSeek technology is covered too.

What the order requires

The signed document, numbered 2026-01, uses powers from a 2018 federal law on supply chain security in government purchasing. Homeland Security Secretary Markwayne Mullin signed it, with budget director Russell Vought copied, and its header lists an original release date of July 24, 2026. It works in two parts:

No new purchases: DeepSeek and its affiliates are barred from civilian procurement, including approved product lists and the online marketplaces agencies use to buy software.
Removal: agencies must pull DeepSeek products, plus third-party products built on DeepSeek, out of their systems or apply for an exception.

Agencies seeking an exception have 60 days from issuance to file a written request with CISA, which needs a strong justification, such as damage to mission-critical work, along with any alternative safeguards. National security and compartmented systems sit outside the order because they fall to the Pentagon and the intelligence community. DHS must revisit the order within a year and every year after that.

Why DHS acted

DeepSeek's servers are in China, and the order argues Chinese law gives state cyber and intelligence services broad reach into private company infrastructure. It says sign-up collects personal data and may fingerprint users, that prompts typed by officials or contractors could carry sensitive material to China, and that the models may contain malware or other weaknesses.

The step extends earlier limits. TechCrunch notes a December 2025 law aimed at DeepSeek in intelligence systems, and a September CISA advisory that named DeepSeek among six Chinese firms it accused of distilling American models at scale. At a Tuesday briefing, Mao Ning, speaking for China's foreign ministry, said Beijing would defend the rights of Chinese companies.

What we don't know yet

How agencies will decide whether a vendor's product counts as built on DeepSeek, for example a model fine-tuned from its open weights and hosted in the US.
Whether the 60-day exception clock started on the July date in the order's header or runs from publication.
How many agencies were running DeepSeek-based tools, and how many exceptions CISA will grant.