DeepSeek Ban: DHS Reveals Mullin, 60-Day Window [2026]

DHS Secretary Markwayne Mullin signed a directive on June 26, 2026 ordering the removal of Hangzhou DeepSeek Artificial Intelligence Co. products from all federal civilian agency networks and barring new purchases, a move that became public 115 days later on October 19, 2026. The order also covers DeepSeek affiliates and third-party software built on DeepSeek models, closing the workaround of vendors routing inference through open-weight Chinese models. DHS has not published a government-wide compliance deadline or a count of affected agencies, with implementation guidance expected through normal supply-chain exclusion channels.

The Department of Homeland Security’s order to strip DeepSeek out of federal civilian agency networks became public on October 19, 2026, but the paperwork behind it tells a longer story. DHS Secretary Markwayne Mullin signed the underlying directive on June 26, 2026, almost four months before the notice surfaced in public reporting from Engadget https://www.engadget.com/2290535/homeland-security-bans-deepseek-use-in-federal-civilian-agencies/ and The Register https://www.theregister.com/security/2026/10/20/deepseek-deep-sixed-at-all-us-federal-civilian-agencies/5304010 . That gap, 115 days between signature and disclosure, is itself part of the news: it shows DHS spent most of the summer building out the legal and procedural scaffolding for a supply-chain exclusion before telling agencies, contractors, or the public what was coming. The order is narrow in one sense and sweeping in another. It targets a single company, Hangzhou DeepSeek Artificial Intelligence Co., and its affiliates. But it reaches every federal civilian agency, bars new purchases, forces removal of anything already deployed, and extends to third-party software built on top of DeepSeek’s models. For a company that spent 2025 and 2026 undercutting U.S. frontier labs on price, the DHS order is the clearest signal yet that Washington now treats Chinese AI model access as a supply-chain security question, not just a competitive one. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. Add now https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F What the DHS Order Actually Requires The directive instructs federal civilian agencies to remove DeepSeek products and services from their information-technology systems and to stop procuring them going forward. That two-part structure, removal plus a forward procurement bar, mirrors how DHS has handled other supply-chain exclusions: it treats existing deployments as a cleanup problem and future purchases as a policy problem, and it solves both in the same notice rather than phasing them separately. The order covers Hangzhou DeepSeek Artificial Intelligence Co. and its affiliated entities by name. It also reaches third-party products and services developed using DeepSeek implementations, meaning a vendor that quietly routes inference traffic through a DeepSeek model, rather than selling DeepSeek’s branded chatbot directly, falls under the same restriction. That detail matters more than it might first appear. A wave of software vendors across the federal contracting ecosystem built features on open-weight Chinese models over the past year because they were cheaper to run than comparable options from Anthropic https://shattered.io/anthropic-ai-safety-bar-sparks-pushback-2026/ , OpenAI, or Google. DHS’s language closes the obvious workaround before agencies or vendors could exploit it. DHS has not published a government-wide compliance deadline or a count of affected agencies in the materials reviewed so far. Implementation guidance, including how agency chief information officers are expected to inventory and verify removal, is expected to follow through the normal channels used for prior supply-chain exclusion orders. DHS Names the Signer: Secretary Markwayne Mullin The single newest detail in this round of reporting is the identity of the official who signed off on the restriction. DHS Secretary Markwayne Mullin signed the directive on June 26, 2026, and the signed letter accompanied the later public notice. Previous reporting on the DeepSeek removal order https://shattered.io/dhs-bans-deepseek-federal-systems-2018-law-2026/ had left that detail unconfirmed, noting only that DHS had not disclosed who authorized the action. The June 26 date, now attached to Mullin’s signature, reframes the timeline: the decision to exclude DeepSeek from civilian agency networks was locked in during early summer, well before the public notice, the exception window, or the legal citation reached anyone outside the department. That four-month lag between signature and disclosure is consistent with how the Federal Acquisition Security Council and DHS have handled other supply-chain reviews: legal and technical vetting happens first, internally, and the public notice follows once the Federal Register process and agency coordination catch up. It also means agencies may have already been working toward compliance behind the scenes well before October’s headlines, even if the scale of removal work still underway is not yet public. The Legal Mechanism: a 2018 Supply-Chain Law DHS grounded the order in the Federal Acquisition Supply Chain Security Act of 2018, a law passed specifically to let agencies exclude vendors and products judged to pose supply-chain risk, independent of ordinary procurement rules. The action followed a review by the Federal Acquisition Security Council, the interagency body created under that same 2018 law to evaluate exactly this kind of threat. Using the 2018 law rather than a narrower IT security directive is a deliberate choice. It puts DeepSeek in the same legal category as the hardware and telecom equipment exclusions DHS and other agencies have issued since the law took effect, treating an AI model the same way the government has previously treated network switches or video surveillance equipment flagged for supply-chain risk. That is a meaningfully different posture than, say, an agency simply updating its acceptable-use policy to forbid employees from visiting a chatbot website. It is a procurement-and-deployment ban enforced through the government’s formal supply-chain security apparatus, with the legal weight that implies for contractors who ignore it. Why DHS Calls DeepSeek “Multiple Threat Vectors” DHS’s stated rationale centers on three concerns. The department wrote that DeepSeek’s products “present multiple threat vectors,” a description that ties the order to the same class of risk DHS has assigned to other foreign-sourced technology. More specifically, DHS warned that using DeepSeek services “may result in the transfer of sensitive data to the People’s Republic of China if used by U.S. government employees or vendors.” The department also said the models could “contain malware or other security vulnerabilities,” language that extends the concern beyond data exposure into the software supply chain itself, meaning the risk isn’t only about what a government employee might type into a chatbot, but what code or dependencies might ship inside a DeepSeek-based product. That three-part framing, data transfer, embedded vulnerabilities, and model-level risk, is broader than the rationale typically used for consumer-app bans like the one applied to TikTok on government devices. It treats an AI model less like a single application and more like a category of infrastructure that needs vetting at every point it touches a federal network, whether that’s a chatbot interface, an API call buried inside third-party software, or a fine-tuned derivative model running on a contractor’s servers. Closing the Third-Party Loophole The order’s reach into “third-party products or services developed using DeepSeek implementations” is arguably its most consequential clause for the broader AI industry, because it does not just ban a DeepSeek-branded app. It bans anything built on top of DeepSeek’s weights or APIs, regardless of whose logo is on the front end. That distinction matters because open-weight Chinese models, including DeepSeek’s own lineup, became attractive to software vendors precisely because they were cheap to run relative to comparable Western alternatives. A contracting officer evaluating a vendor’s AI-powered document search tool, for example, now has to ask not just “does this product say DeepSeek on it,” but “does this product’s backend call a DeepSeek model at any point.” That is a much harder compliance question, and it shifts real due-diligence burden onto agencies and their vendors rather than resting on a simple brand-name blocklist. The 60-Day Exception Process, Explained DHS built in a narrow release valve. Agencies that believe they have a legitimate operational need to keep using a DeepSeek-linked product can request an exception, but the request must be submitted 60 days in advance and backed by a “compelling justification.” That lead time effectively rules out emergency carve-outs. An agency cannot discover mid-project that a vendor’s tool depends on a DeepSeek model and request a same-week waiver; it has to plan two months ahead, which in practice pushes most agencies toward simply removing the dependency rather than fighting for an exception. The 60-day window also signals how DHS expects compliance to actually unfold. Rather than a flood of exception requests, the structure is built to make removal the default path and exceptions the rare, heavily justified outlier. For agencies that have already quietly embedded DeepSeek-derived capability through a vendor’s backend, the clock to either document a compelling case or rip out the dependency started well before most of them realized it. How This Fits Washington’s Broader China-Tech Playbook The DeepSeek order did not emerge from nowhere. The federal government has a documented pattern of excluding Chinese-origin technology from government networks once a supply-chain or national-security review flags it, a pattern that stretches back to network hardware and video equipment restrictions and, more recently, device-level app bans. What makes the DeepSeek case distinct is the category of product. Previous actions targeted physical infrastructure or a single consumer app. This one targets a family of AI models and anything downstream of them, a much larger and fuzzier surface area to police. That historical pattern also explains why DHS reached for the Federal Acquisition Supply Chain Security Act rather than a narrower cybersecurity bulletin. The 2018 law exists specifically to give agencies a durable, legally defensible mechanism for exactly this kind of exclusion, and DHS appears to be applying a well-worn legal tool to a genuinely new category of technology risk. Washington’s scrutiny of Chinese AI has not been limited to one company or one agency, either; Chinese regulators have separately had to clear AI models from companies like Alibaba for use in Apple’s China-market devices https://shattered.io/china-approves-2-alibaba-ai-models-iphone-duo-2026/ , a reminder that the scrutiny runs in both directions depending on which government is doing the vetting. DeepSeek Keeps Shipping Models Despite the Pressure None of this has slowed DeepSeek’s release cadence. The company’s official change log records the release of DeepSeek V4.1-Flash on September 10, 2026, with the page still being updated as recently as October 17, days before the federal order became public. DeepSeek has continued to position its models, including the V4.1-Flash-1017 release that posted a 42.6 score on the Humanity’s Last Exam benchmark https://shattered.io/deepseek-v4-1-flash-1017-hle-score-42-6-2026/ and the version that opened a public search API alongside a DeepSWE score of 77.0 https://shattered.io/deepseek-v4-1-flash-1017-deepswe-77-search-api-2026/ , as low-cost, open-weight alternatives to U.S. frontier models. That continued shipping cadence is part of why the federal ban matters beyond government IT. DeepSeek’s business model depends on broad adoption through APIs, integrations, and open-weight downloads rather than direct enterprise sales contracts with the U.S. government, which was never DeepSeek’s core market. The real exposure is reputational and ecosystem-wide: if the federal government treats DeepSeek-derived capability as a supply-chain risk serious enough to justify a Federal Acquisition Supply Chain Security Act exclusion, that framing gives ammunition to state governments, regulated industries, and risk-averse enterprise buyers who were already watching Washington’s posture toward Chinese AI providers before making their own procurement decisions. Market Impact: Who Gains From the DHS Clampdown The most direct beneficiaries of a federal DeepSeek exclusion are the U.S. frontier labs that DeepSeek’s pricing had been pressuring throughout 2025 and 2026. OpenAI, Anthropic, and Google all faced competitive pressure to defend their own per-token pricing as DeepSeek and other open-weight Chinese models offered comparable capability at a fraction of the compute cost. A federal procurement ban does not change that pricing math for the private sector, but it removes DeepSeek entirely from one lucrative buyer category, federal civilian agencies, and it pushes any vendor serving that category to standardize on an approved model provider rather than maintaining a DeepSeek-compatible option just for cost savings. There is a second-order effect worth watching too. Systems integrators and AI infrastructure vendors who serve both commercial and federal clients now have a strong incentive to avoid DeepSeek dependencies across their entire product line, not just the federal-facing version, because maintaining two separate model backends, one DeepSeek-based for commercial customers and one compliant backend for government customers, adds real engineering and compliance overhead. That dynamic could push DeepSeek out of parts of the private-sector supply chain that were never directly targeted by the DHS order, simply because it is cheaper for vendors to standardize on one backend than to maintain two. DeepSeek vs. U.S. Frontier Labs on Federal Access The table below lays out how DeepSeek’s federal access now compares with the three U.S.-based labs most often cited as its competitive targets. | AI Lab | Headquarters | Federal Civilian Procurement Status | Primary Model Family | Pricing Positioning | |---|---|---|---|---| | Hangzhou DeepSeek Artificial Intelligence Co. | China | Barred under DHS order, including third-party derivatives | DeepSeek V4.1-Flash | Low-cost, open-weight | | OpenAI | United States | No equivalent restriction reported | GPT model family | Premium, closed-weight | | Anthropic | United States | No equivalent restriction reported | Claude model family | Premium, closed-weight | | | United States | No equivalent restriction reported | Gemini model family | Premium, closed-weight, tiered | The asymmetry in that table is the story: DeepSeek is the only name on it facing a formal federal acquisition exclusion, and the order reaches not just DeepSeek’s own branded products but anything built on its models. For a federal procurement officer, that makes the compliance calculus simple in one sense, avoid DeepSeek entirely, and complicated in another, verifying that no vendor’s backend secretly depends on it. Timeline: How the DHS DeepSeek Order Came Together | Date | Event | |---|---| | September 10, 2026 | DeepSeek releases V4.1-Flash, according to the company’s official change log | | June 26, 2026 | DHS Secretary Markwayne Mullin signs the directive excluding DeepSeek from federal civilian IT systems | | October 17, 2026 | DeepSeek’s change log page is last updated, days before the order becomes public | | October 19, 2026 | DHS files the public notice; the order becomes widely reported | | October 20, 2026 | Additional outlets, including The Register and CyberScoop, detail the order’s scope and the Federal Acquisition Security Council review behind it | Reading the timeline this way reframes the story. The order was not a snap decision made public the same week it was signed. It was a four-month internal process, reviewed through the Federal Acquisition Security Council and finalized in June, that only became visible to the public, and to the agencies and vendors who now have to act on it, in mid-October. What Private-Sector Vendors Working With Agencies Should Watch Any company that sells software, consulting, or AI-adjacent tooling to federal civilian agencies now has a concrete reason to audit its own model dependencies, not just its product branding. The order’s third-party clause means a vendor cannot rely on the absence of “DeepSeek” from its marketing materials to stay compliant. If any inference call in a product’s pipeline routes through a DeepSeek model or a fine-tuned derivative of one, that product falls inside the restriction. That creates real near-term work for contracting officers and vendor compliance teams alike: inventorying which AI features in deployed software actually call which model, documenting that inventory in a way that survives an audit, and building a replacement plan for any dependency that traces back to DeepSeek. Vendors who can show that documentation proactively are likely to have an easier renewal conversation than those who wait for an agency to ask. How Outlets Are Covering the Order CyberScoop https://cyberscoop.com/dhs-bans-deepseek-federal-agencies/ focused its reporting on the Federal Acquisition Security Council process and the 60-day exception procedure, framing the order as a formal supply-chain determination rather than an ad hoc policy memo. The Hill https://thehill.com/policy/technology/6159116-dhs-bans-chinese-deepseek-ai described the action as both an IT-removal order and a broader ban on government contracting tied to DeepSeek, detailing DHS’s warning about potential Chinese-government access to data that touches private infrastructure. SiliconANGLE https://siliconangle.com/2026/10/19/trump-administration-orders-ban-on-deepseek-in-federal-agencies/ placed the order in the context of the current administration’s wider posture on Chinese AI providers. Engadget and The Register, the two outlets that first brought the order to wide public attention on October 19 and 20, both emphasized how the order’s scope extends past DeepSeek’s own branded applications into affiliated and third-party products built on its models, the same provision singled out above as the order’s most consequential clause for the broader software supply chain. A Practical Compliance Checklist for IT Teams Federal IT and procurement teams facing this order are effectively running an unplanned software audit. A basic version of that audit looks something like this, adapted from standard supply-chain inventory practice rather than any specific DHS implementation document, since DHS has not yet published detailed technical guidance: 1. Inventory every third-party AI feature in deployed software 2. For each feature, identify which model or API it calls at runtime 3. Flag any call path that resolves to a DeepSeek model or a fine-tuned derivative of one 4. For flagged dependencies, document removal timeline OR draft an exception request 60+ days before any deadline 5. Require vendors to disclose model dependencies in future contract renewals and new procurements 6. Re-run the inventory quarterly, since vendors can swap backend models without changing their product's branding That last point is the one most likely to catch agencies off guard. A vendor’s product can look identical on the front end while its backend model changes between contract renewals, which means a one-time inventory is not enough. Agencies that treat this as a recurring compliance task rather than a one-time cleanup will be in a far better position the next time DHS or another agency issues a similar order against a different foreign AI provider. Five Predictions for What Happens Next - More agencies will follow DHS’s lead on third-party clauses. The language barring products “developed using DeepSeek implementations” is specific enough that other agencies issuing their own supply-chain exclusions are likely to copy it almost verbatim, since it closes a loophole every future order would otherwise have to solve from scratch. - State governments will face pressure to match the federal posture. Once a federal civilian exclusion exists under a formal supply-chain security law, state procurement offices that have been informally wary of Chinese AI providers gain a ready-made federal precedent to point to when drafting their own policies. - Vendors will quietly swap backend models rather than fight for exceptions. Given the 60-day lead time required for an exception request, most contractors are likely to find it cheaper and faster to simply remove any DeepSeek dependency than to build a compelling justification case. - DeepSeek will keep shipping models at its current pace. The federal order targets government procurement, not DeepSeek’s core open-weight distribution model, so expect continued releases in the V4.1-Flash lineage and beyond, aimed at the much larger commercial and developer markets the company actually depends on. - Expect a parallel debate over open-weight models generally. Because the order’s third-party clause reaches any product built on DeepSeek’s weights, it raises a harder question Washington has not fully answered: whether open-weight models from any foreign origin, not just DeepSeek’s specific family, deserve the same supply-chain scrutiny. That question is already live in AI policy circles tracking China’s growing edge in open-weight model releases https://shattered.io/import-ai-476-jack-clark-china-open-weight-models-2026/ . Frequently Asked Questions What exactly did DHS order on October 19, 2026? DHS ordered federal civilian agencies to remove DeepSeek products and services from their information-technology systems and barred those agencies from procuring DeepSeek products and services going forward. The restriction also covers third-party products developed using DeepSeek implementations. Who signed the DeepSeek exclusion order? DHS Secretary Markwayne Mullin signed the directive on June 26, 2026. The signed letter accompanied the public notice that surfaced in reporting on October 19 and 20, 2026. What legal authority does DHS cite for the ban? DHS cited the Federal Acquisition Supply Chain Security Act of 2018, following a review by the Federal Acquisition Security Council, the interagency body the law created to evaluate supply-chain risk in federal procurement. Does the order cover products that only use DeepSeek indirectly? Yes. The order explicitly extends to third-party products and services developed using DeepSeek implementations, not just applications branded directly by Hangzhou DeepSeek Artificial Intelligence Co. or its affiliates. Can an agency request an exception to keep using a DeepSeek-linked product? Agencies can request exceptions, but requests must be submitted 60 days in advance and supported by a compelling justification, according to the DHS order. Why does DHS consider DeepSeek a security risk? DHS wrote that DeepSeek’s products present multiple threat vectors, warned that use could result in the transfer of sensitive data to the People’s Republic of China if used by U.S. government employees or vendors, and said the models could contain malware or other security vulnerabilities. Does the ban affect DeepSeek’s business outside the U.S. government? Not directly. DeepSeek’s core business depends on broad API and open-weight adoption rather than U.S. federal contracts. The bigger risk is reputational: a formal federal supply-chain exclusion gives other buyers, including state governments and risk-averse enterprises, a precedent to cite when reviewing their own DeepSeek exposure. Has DHS published a compliance deadline for removing DeepSeek products? Not in the materials reviewed so far. DHS has not published a government-wide compliance deadline, a count of affected agencies, or detailed technical removal guidance; that implementation detail is expected to follow through standard agency channels.