DHS DeepSeek ban reaches vendors' products built on its models

Why the government moved against DeepSeek

The Federal Acquisition Security Council concluded that DeepSeek's models, code and services present unacceptable supply-chain vulnerabilities, data-exfiltration risks and integrity hazards inside federal computing environments. The order's risk summary, as described by the law firm Haynes Boone, says DeepSeek's servers are in China, whose legal system gives government cyber and intelligence functions extensive authority to access private company infrastructure.

The summary lists several concrete risks. Account sign-up on DeepSeek-hosted models collects personally identifiable information and may track and fingerprint users. Prompts typed into DeepSeek's most widely used apps may send sensitive data to China. The models themselves may contain malware or other vulnerabilities, and the order cites research that found multiple critical flaws in DeepSeek's iOS app.

What the FASCSA order requires

Exclusion and Removal Order #2026-01, signed by Homeland Security Secretary Markwayne Mullin under the Federal Acquisition Supply Chain Security Act of 2018, has two parts. It bars DeepSeek and its affiliates from federal civilian procurements, and it requires civilian agencies to remove all DeepSeek products from their information technology, including third-party products and services developed using DeepSeek implementations.

Both parts are effective immediately. The Department of Energy, for example, told its contracting staff in a policy flash dated October 27, 2026 to remove all DeepSeek products from their networks and to sign no contracts that include them. Matching orders from the Department of War and the Director of National Intelligence cover defense agencies and the intelligence community.

How the order reaches companies that sell to agencies

The order is addressed to agencies, but contractors are bound through a contract clause, FAR 52.204-30. Absent a waiver, it bars contractors from providing or using covered articles in contract performance. It also sets a routine: contractors must check SAM.gov for new FASCSA orders at least every three months and make a reasonable inquiry into their supply chains.

If a contractor finds a covered article, it must report to the contracting officer within three business days and follow up within 10 business days with its mitigation steps. The clause must be flowed down to all subcontracts, including those for commercial products and services.

"Ownership and control, not branding, decide whether a supplier’s products are covered." — Haynes Boone, on which DeepSeek affiliates the order reaches

What the dates and scope show

The timeline matters as much as the text. The order's stated release date was July 24, 2026; it was filed for public inspection on October 19 and appeared in the Federal Register on October 20, 2026, nearly three months later. Agencies had 60 days from issuance to request an exception, so the window closed on September 22, 28 days before the public could read the order, Haynes Boone notes.

The scope is wider than the other two orders. Crowell & Moring reports that the defense and intelligence orders cover software that implements a DeepSeek model, wherever it is hosted. The civilian order adds products developed using DeepSeek implementations, which the firm says suggests that software written with DeepSeek's coding assistant could be covered. The order does not define "DeepSeek implementation".

What the DHS DeepSeek ban means for federal contractors

For any company selling software or services to civilian agencies, a model's origin is now a diligence item. Haynes Boone advises vendors to map where DeepSeek models, or fine-tuned versions of them, sit in their products, including self-hosted open-weight deployments, and to document the result. Because DeepSeek's models are open-weight, they can run on a vendor's own hardware without touching DeepSeek's servers, and the removal text does not separate those deployments from DeepSeek-hosted ones.

The practical tasks are an inventory of every AI model in a product, a record of where each came from, and a reporting process that can meet a three-business-day deadline. The secretary will review the order within a year and every year after.

Questions and answers

Does the order cover DeepSeek models a vendor runs on its own servers?

The text does not say so directly. The removal language neither separates DeepSeek-hosted from self-hosted deployments nor addresses fine-tuned versions, so law firms advise vendors to map and document every such use.

What must a contractor do if it finds DeepSeek in its product?

Under FAR 52.204-30, it must report to the contracting officer within three business days of identifying a covered article and update the report with mitigation actions within 10 business days.

When did the DeepSeek order take effect?

Exclusion took effect immediately on issuance. The order's stated release date was July 24, 2026, and it was published in the Federal Register on October 20, 2026.