DHS Bans DeepSeek on Federal Systems Under 2018 Law [2026]

The U.S. Department of Homeland Security ordered federal civilian agencies on October 19, 2026, to remove DeepSeek technology from their IT systems and bar future acquisitions, under docket DHS-2026-0628. The notice names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and extends the prohibition to third-party products or services developed using DeepSeek implementations, closing a loophole that would have allowed indirect use through vendor backends. DHS grounded the order in the Federal Acquisition Supply Chain Security Act of 2018, the same framework previously used to exclude vendors from civilian agency acquisition rolls on national-security grounds; no compliance deadline, count of affected agencies, or signing official was published in the materials reviewed.

The U.S. Department of Homeland Security ordered federal civilian agencies on Monday, October 19, 2026, to strip DeepSeek technology out of their information-technology systems, escalating Washington’s campaign against Chinese artificial intelligence providers. The notice, filed under docket DHS-2026-0628 , targets Hangzhou DeepSeek Artificial Intelligence Co., Ltd. , the Chinese AI lab whose low-cost open-weight models have rattled Silicon Valley’s pricing assumptions since early 2025. The directive, reported by Bloomberg and Reuters, bars agencies from acquiring new DeepSeek products or services and requires the removal of anything already deployed, including third-party tools built on top of DeepSeek’s models. It is the clearest sign yet that the federal government is treating Chinese large language models as a supply-chain security problem on par with telecom hardware and antivirus software in prior years, not simply a competitive or export-control issue. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. Add now https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F What the October 19 DHS Notice Actually Requires According to the notice DHS filed Monday, federal civilian executive-branch agencies must remove covered DeepSeek products and services from their IT systems. The order also prohibits those agencies from acquiring DeepSeek products and services going forward, extending the restriction to third-party offerings built using DeepSeek implementations rather than only software branded directly by the company. That distinction matters. A growing number of U.S. software vendors route at least some inference workloads through DeepSeek’s open-weight models because they are cheaper to run than comparable offerings from OpenAI, Anthropic, or Google. By extending the ban to “third-party products or services developed using DeepSeek implementations,” DHS closed a loophole that would have let agencies keep using DeepSeek-derived capability indirectly, through a vendor’s backend, even after removing the DeepSeek-branded app itself. DHS has not published a specific compliance deadline, a count of affected agencies, or the name of the official who signed off on the order in the materials reviewed so far. Those details, along with any technical remediation guidance, are expected to follow in implementation instructions from the Office of Management and Budget or individual agency CIOs, following the pattern used in prior supply-chain exclusion orders. Who Is Hangzhou DeepSeek Artificial Intelligence Co., Ltd. Hangzhou DeepSeek Artificial Intelligence Co., Ltd. is the entity named in the DHS filing. The Chinese AI lab built its reputation on releasing open-weight large language models that match or approach the performance of leading U.S. systems at a fraction of the compute cost, a positioning that forced OpenAI, Anthropic, and Google to defend their own pricing throughout 2025 and into 2026. The company has continued shipping new model versions at a rapid clip even as scrutiny from Washington intensified. DHS’s order covers not just the parent company but its affiliated entities, a standard feature of Federal Acquisition Supply Chain Security Act exclusions designed to prevent a sanctioned firm from simply operating under a subsidiary name to continue selling into the federal market. The Legal Basis: Federal Acquisition Supply Chain Security Act of 2018 DHS grounded the order in the Federal Acquisition Supply Chain Security Act of 2018 and its implementing rules, the same statutory framework that has previously been used to exclude specific vendors from the acquisition rolls of civilian agencies on national-security grounds. The law created the Federal Acquisition Security Council, an interagency body that reviews whether a given vendor’s products pose supply-chain risk and can recommend removal or exclusion orders when it finds sufficient cause. DHS said the DeepSeek order followed a recommendation from the Federal Acquisition Security Council and a review of related evidence, rather than being a unilateral DHS determination. That procedural detail is significant: it means the decision carries the weight of an interagency security review rather than a single department’s judgment, which tends to make these orders harder to challenge or reverse through ordinary procurement disputes. Why DHS Says DeepSeek Poses a Threat Reuters and other outlets reporting on the notice described DHS characterizing DeepSeek’s models as presenting multiple threat vectors. The department’s concerns, as reported, center on three risks: that government employees or contractors using DeepSeek tools could see sensitive data transferred to the People’s Republic of China, that agency use could generate intelligence useful against U.S. citizens or government operations, and that the models themselves could contain embedded vulnerabilities or malicious code. None of those three concerns is unique to DeepSeek among Chinese-developed software products. They mirror the rationale DHS and the Commerce Department have applied to telecom equipment from Huawei and ZTE, and to antivirus software from Kaspersky Lab, in earlier supply-chain exclusion actions. What is new here is applying that framework to a generative AI model rather than a piece of network hardware or endpoint security software, a precedent that other agencies watching this order will likely draw on if they decide to act against other Chinese AI vendors. Docket DHS-2026-0628: What Comes Next in the Filing Process The order was filed under docket DHS-2026-0628, the formal administrative record that will carry any public comments, implementation guidance, or legal challenges tied to the action. Exclusion orders issued under the Federal Acquisition Supply Chain Security Act typically move through a structured process: an initial determination, an opportunity for the affected vendor to respond, and a final order that agencies are bound to follow. Where the DeepSeek order sits in that sequence as of October 19 has not been detailed in reporting so far, though the notice’s language, ordering removal and barring future acquisition, reads as a final rather than preliminary action. How the Order Fits Into Broader US-China AI Tech Restrictions Monday’s order did not emerge in isolation. It lands against a backdrop of tightening technology restrictions between Washington and Beijing that has touched chips, cloud access, and now AI software directly. Export controls on advanced GPUs to Chinese buyers have been a fixture of U.S. policy since 2022, and the Trump administration has layered additional scrutiny onto AI labs and data firms with China ties throughout 2026. Lawmakers have pushed parallel measures aimed at the same target. Search interest in bill names such as the No DeepSeek on Government Devices Act shows that congressional action predates Monday’s administrative order, with members of both parties introducing legislation to formalize a government-wide prohibition rather than leaving it to agency-level procurement rules. DHS’s action under the 2018 supply-chain law effectively delivers through executive authority what some of that proposed legislation sought through statute, at least for civilian agencies. The administration’s broader posture toward AI governance has also been evolving. A separate review process covering AI systems more generally has been underway for much of the fall, and this DeepSeek-specific order can be read as one concrete output of that wider push to formalize how the federal government screens AI vendors for national-security risk, a process our earlier coverage of Trump’s de facto AI licensing system https://shattered.io/trump-de-facto-ai-licensing-system-2026/ tracked as it took shape over the preceding month. Historical Context: From Kaspersky to Huawei to DeepSeek The Federal Acquisition Supply Chain Security Act has a track record. It and related national-security procurement authorities have previously been used to bar Kaspersky Lab’s security software from federal networks and to restrict Huawei and ZTE telecom equipment from agency systems, both framed around the same core worry: that a vendor subject to a foreign government’s jurisdiction could be compelled to hand over data or degrade a product’s security on command. DeepSeek’s exclusion extends that logic from hardware and endpoint security tools to a new category, generative AI models that process and can retain fragments of whatever data federal employees feed into them. That is a meaningful expansion. Network equipment and antivirus software operate largely outside the content of an employee’s day-to-day work. An AI assistant, by contrast, is often fed the exact sensitive material, draft memos, internal data, policy analysis, that a security review would most want to protect. DHS’s stated worry about sensitive data transfer to China reflects that difference directly, and it is likely the reason this order treats DeepSeek with the same procedural seriousness previously reserved for critical infrastructure vendors rather than ordinary software. DeepSeek’s Rise Made It a Target DeepSeek’s path to this moment began with a pricing shock. Its open-weight models, released starting in early 2025, offered performance competitive with leading U.S. systems while costing a fraction as much to run, a combination that pulled significant developer and enterprise attention toward the company and forced incumbents to respond on price. That popularity is precisely what made the company’s federal exclusion consequential: unlike a niche vendor nobody in government used anyway, DeepSeek’s models had already found their way into third-party tools and workflows that touched federal environments, which is why Monday’s order explicitly reaches “third-party products or services developed using DeepSeek implementations” rather than DeepSeek’s own branded app alone. Within the AI industry, DeepSeek’s trajectory has been a recurring storyline all year, from successive model releases to pricing cuts that squeezed rivals such as those detailed in our coverage of DeepSeek’s Flash-1017 release and its search API expansion https://shattered.io/deepseek-v4-1-flash-1017-deepswe-77-search-api-2026/ . The federal ban does not affect DeepSeek’s consumer or international business, but it does close off one of the largest and most security-conscious buyer segments in the U.S. market. Market and Industry Reaction The order’s immediate practical effect on DeepSeek’s business is limited in dollar terms. Federal civilian agencies were never a major direct customer base for the company given existing hesitancy around foreign AI tools in sensitive environments. The bigger impact is reputational and precedential: a formal DHS exclusion gives state governments, critical infrastructure operators, and private-sector risk officers a federal benchmark to point to when justifying their own restrictions on DeepSeek, much as earlier Kaspersky and Huawei actions rippled outward into state-level procurement bans well beyond the federal government itself. For U.S. AI providers, the order removes a low-cost competitor from one procurement channel without touching the much larger commercial and international markets where DeepSeek’s pricing pressure has mattered most. OpenAI, Anthropic, and Google have all continued to compete aggressively on both capability and price throughout 2026 regardless of what happens in federal procurement specifically, and that competitive dynamic is unlikely to change because of a civilian-agency exclusion order. DeepSeek Federal Ban Compared With Other National Restrictions DeepSeek has faced scrutiny from multiple governments since its emergence as a major AI player, though the scope and legal basis of those actions vary. The table below summarizes what is publicly confirmed about the U.S. federal action alongside other well-documented restriction categories used against foreign technology vendors in the past, for comparison. | Action | Vendor Targeted | Scope | Legal/Policy Basis | |---|---|---|---| | DHS DeepSeek order Oct. 19, 2026 | Hangzhou DeepSeek Artificial Intelligence Co., Ltd. | Federal civilian executive-branch agencies | Federal Acquisition Supply Chain Security Act of 2018 | | Federal Kaspersky restriction | Kaspersky Lab | Federal civilian systems | Supply-chain/national-security procurement authority | | Huawei/ZTE equipment restrictions | Huawei, ZTE | Federal networks and FCC “covered list” | National-security telecom authority | | Proposed No DeepSeek on Government Devices Act | DeepSeek | Government-issued devices as proposed | Congressional legislation not yet enacted as of this order | The pattern across these actions is consistent: when Washington has decided a foreign vendor’s products pose supply-chain or data-security risk, it has reached for the same toolkit, removal from existing systems plus a forward-looking procurement bar, rather than inventing a new mechanism each time. DeepSeek’s case is notable mainly for being the first time that toolkit has been applied squarely to a generative AI model rather than a hardware or traditional software product. Timeline: DeepSeek’s Path From Breakout Model to Federal Exclusion | Period | Development | |---|---| | Early 2025 | DeepSeek’s open-weight models gain rapid global attention for matching leading U.S. systems at much lower compute cost. | | Throughout 2025 | U.S. AI labs respond with aggressive pricing moves; lawmakers begin introducing bills targeting DeepSeek’s presence on government devices. | | 2026 | DeepSeek continues shipping new model versions and expanding its API and search capabilities even as U.S. scrutiny builds. | | Fall 2026 | The administration formalizes a broader AI vendor review process covering national-security risk across the AI sector. | | October 19, 2026 | DHS files docket DHS-2026-0628, ordering DeepSeek’s removal from federal civilian IT systems and barring future procurement. | What Federal Agencies and Contractors Need to Do Now For federal IT and procurement teams, the order creates immediate practical work even without a published deadline. Agencies will need to inventory where DeepSeek-branded tools are deployed, and, more challenging, identify third-party products and services that rely on DeepSeek models in their backend even when the vendor-facing brand is different. That second category is harder to audit because it depends on vendor disclosure about which model providers power a given product, something not every federal contract currently requires in detail. Contracting officers should also expect updated guidance from the General Services Administration or individual agency CIOs clarifying how the exclusion interacts with existing contract vehicles, since removing a vendor mid-contract can trigger its own set of procurement and termination procedures. Agencies with research arms that have experimented with open-weight models for cost reasons, similar to the dynamics covered in our look at the broader open-source AI bet playing out across the industry https://shattered.io/ai-open-source-bet-86-percent-beam-mistral-2026/ , will likely face the most disruption, since those teams are statistically more likely to have adopted low-cost open-weight options like DeepSeek’s for internal tooling. Auditing Indirect DeepSeek Exposure The hardest compliance task is not removing an app labeled “DeepSeek.” It is finding every SaaS tool, chatbot plugin, or internal automation script that quietly calls a DeepSeek API endpoint behind the scenes because it was the cheapest inference option available when a vendor built the integration. Agencies without a formal AI model inventory process, a gap flagged repeatedly across federal IT modernization reviews, will likely need to request model-provenance disclosures from every SaaS vendor on their current contract list to come into full compliance. Competitive Landscape: Who Gains in Federal AI Procurement With DeepSeek closed off, federal agencies evaluating generative AI tools are left choosing among providers that have already built out FedRAMP-authorized or government-specific offerings. Anthropic, OpenAI, Google, and Microsoft’s Azure OpenAI Service have all pursued dedicated federal and public-sector tracks over the past two years, positioning them as the practical beneficiaries of any procurement dollars that might otherwise have gone to a DeepSeek-powered alternative. Anthropic in particular has leaned into federal and national-security positioning, an emphasis visible in its continued push for AI-specific legislative frameworks covered in our report on Anthropic’s $1B AI safety bill pitch to Congress https://shattered.io/anthropic-ai-safety-bill-congress-2026/ . That said, the practical pool of federal dollars DeepSeek stood to capture was never large to begin with, given the caution federal buyers have shown toward unauthorized foreign AI tools generally. The more consequential competitive effect may be on the handful of U.S.-based SaaS vendors who built products on top of DeepSeek’s cheaper inference layer specifically to win price-sensitive federal bids; those vendors now need to migrate to a different, likely more expensive, backend model provider or risk losing federal contracts outright. International Reaction and Precedent Risk Monday’s order is likely to draw attention from allied governments weighing their own posture toward DeepSeek and other Chinese AI vendors. Washington’s willingness to apply its 2018 supply-chain security law to a generative AI model, rather than only to hardware, gives other governments a template they can point to if they want to justify similar restrictions domestically. Whether any of them follow suit, and on what timeline, will depend on each country’s own legal framework for vendor exclusions and its appetite for the diplomatic friction such a move invites with Beijing. China’s government has previously pushed back hard against U.S. claims targeting its AI sector, rejecting accusations it considered unfounded in disputes earlier in 2026 over AI model development practices. A formal response to Monday’s DHS order from Beijing is likely, following that established pattern of disputing the U.S. characterization of the underlying security concerns even as it declines to challenge Washington’s sovereign right to set its own procurement rules. Five Predictions for What Happens Next - Expect OMB or individual agency CIOs to publish implementation guidance within the coming weeks, including a compliance timeline that DHS’s initial notice did not specify. - State governments and critical infrastructure regulators will likely cite the federal order as precedent for their own DeepSeek restrictions, mirroring how Kaspersky’s federal ban rippled into state-level procurement rules. - Congressional sponsors of DeepSeek-focused legislation will probably point to the DHS order as validation and push to codify a broader, statutory version of the restriction that would survive a change in administration. - SaaS vendors with undisclosed DeepSeek dependencies in their federal product offerings face the most immediate business risk, and some will likely announce backend migrations to U.S.-based model providers in the coming months. - China’s government is likely to issue a formal objection, consistent with its past responses to U.S. actions targeting its AI sector, without materially altering DeepSeek’s continued model releases outside the U.S. federal market. Why This Matters Beyond the Federal Market The significance of Monday’s order extends well past the relatively small dollar value of DeepSeek’s direct federal footprint. It marks the first time Washington has applied its core supply-chain exclusion authority, the same one used against Kaspersky and Huawei, directly to a large language model https://shattered.io/category/ai-machine-learning/ rather than a piece of network or endpoint infrastructure. That establishes a legal and procedural template other agencies, and potentially Congress, can reuse against any AI vendor, foreign or eventually even domestic, that a future security review flags as high-risk. For the broader AI industry, it also reinforces a trend that has been building throughout 2026: AI model selection is no longer purely a cost-and-capability decision for large institutional buyers. It is increasingly a compliance decision shaped by where a model’s developer is headquartered and what data-handling guarantees that jurisdiction can realistically offer. Enterprises watching the ongoing competitive shifts among major model families this fall https://shattered.io/grok-4-7-and-the-gpt-6-family-what-changed-this-fall/ should expect vendor nationality to become a more explicit factor in procurement conversations well beyond the federal government specifically. Frequently Asked Questions What did DHS actually order on October 19, 2026? DHS ordered federal civilian executive-branch agencies to remove DeepSeek products and services, along with third-party offerings built using DeepSeek implementations, from their IT systems, and barred those agencies from acquiring DeepSeek products going forward. Does this ban apply to the U.S. military or the general public? The order as reported covers federal civilian executive-branch agencies. It does not establish a universal ban on private-sector or individual use of DeepSeek in the United States, based on currently available reporting. What is the legal basis for the DeepSeek exclusion? DHS cited the Federal Acquisition Supply Chain Security Act of 2018 and related implementing rules, following a recommendation from the Federal Acquisition Security Council. Which company does the order target? The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., along with its affiliated entities and third-party products built using its AI implementations. Has the U.S. taken similar action against other foreign tech vendors before? Yes. The federal government has previously restricted Kaspersky Lab security software and Huawei and ZTE telecom equipment from government systems under related supply-chain and national-security procurement authorities. Is there a compliance deadline for agencies to remove DeepSeek products? A specific compliance deadline was not included in the publicly reported details of the notice as of October 19, 2026. Agencies are likely to receive follow-up implementation guidance. Why did DHS say DeepSeek poses a security risk? DHS described the models as presenting multiple threat vectors, citing concerns about sensitive data potentially transferring to the People’s Republic of China, the risk of generating intelligence usable against U.S. citizens or agencies, and possible vulnerabilities embedded in the models themselves. Does the order affect DeepSeek’s business outside the U.S. federal government? No direct effect has been reported on DeepSeek’s consumer, enterprise, or international business. The order is limited to U.S. federal civilian agency procurement and systems.