DHS Ordered Every Federal Agency to Purge DeepSeek. The Exclusion Follows the Model Into Anything Built On It.

The Department of Homeland Security issued Exclusion and Removal Order #2026-01, signed by Secretary Markwayne Mullin on July 24, 2026 and published in the Federal Register on October 20, 2026 (91 FR 66346, FR Doc 2026-21447, Docket DHS-2026-0628), requiring federal civilian agencies to remove DeepSeek products and any third-party products and services developed using DeepSeek implementations from their IT systems and procurements. Issued under the Federal Acquisition Supply Chain Security Act of 2018, the order gives agencies a 60-day window to request exceptions from the CISA FASCSA Order Implementation Team, which require compelling justification such as mission-critical impact and CISA approval. DHS cited DeepSeek servers located in the PRC, PII collection during account generation, sensitive data transfer during prompt-and-response, and security vulnerabilities including those in the DeepSeek iOS app, following an earlier 2025 restriction on government devices.

The most significant aspect of DHS Exclusion and Removal Order 2026-01 is not the ban itself, but the reach of its derivative clause. By mandating the removal of not just DeepSeek products, but also any third-party offerings developed using DeepSeek implementations, the Department of Homeland Security has fundamentally altered the risk profile for software supply chains. This structural move ensures that the exclusion follows the model into anything built on it, effectively turning a targeted prohibition into a broad, cascading compliance requirement for federal contractors. Signed by Secretary of Homeland Security Markwayne Mullin on July 24, 2026, with a courtesy copy to OMB Director Russell Vought, the order was formally published in the Federal Register on October 20, 2026 https://www.federalregister.gov/documents/2026/10/20/2026-21447/notice-of-order-regarding-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive 91 FR 66346, FR Doc 2026-21447, Docket DHS-2026-0628 . Issued under the authority of the Federal Acquisition Supply Chain Security Act of 2018, the signed order https://www.govinfo.gov/content/pkg/FR-2026-10-20/pdf/2026-21447.pdf is explicit in its operative scope. It requires agencies to “Remove products provided by DeepSeek and DeepSeek-affiliated entities, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems.” The procurement implications are equally absolute. The order mandates that agencies “Exclude DeepSeek, DeepSeek-affiliated entities, and their products from civilian agency procurements, effective immediately after issuance of this Order, to include agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions that facilitate the procurement of information technology hardware, software, and services.” While the order provides a 60-day window for agencies to submit written requests for exceptions to the CISA FASCSA Order Implementation Team, these require compelling justification, such as mission-critical impacts, and are subject to CISA approval. The justification for this sweeping action rests on specific risk findings. The order highlights that DeepSeek servers are located in the PRC, where the legal system permits extensive government access to private infrastructure. Furthermore, the order cites concerns regarding PII collection during account generation, the potential for sensitive data transfer during the prompt-and-response process, and identified security vulnerabilities, including those found in the DeepSeek iOS app. These findings serve as the foundation for the current mandate, which follows an earlier 2025 restriction on government devices. The human stake in this policy shift is carried by the integrators. Companies that embedded DeepSeek models or open-weight https://forkast.news/glossary/open-weights-models/ implementations into products sold to federal civilian agencies without a procurement-exclusion clause now face the immediate burden of removal. The bill lands on them, not on the model provider. They must audit their stacks to identify any reliance on the prohibited technology, a task complicated by the rapid adoption of retrieval monetization https://forkast.news/deepseek-monetizes-the-agent-retrieval-layer-at-0-75-per-1000-calls-every-competitor-charges-at-least-5/ and the shift toward per-call pricing https://forkast.news/per-call-pricing-just-entered-the-agent-stack-every-frontier-lab-still-charges-by-the-token/ in the agent stack. This creates a bidirectional squeeze for builders. While the US federal perimeter now treats DeepSeek derivatives as removable, the export-control proposal https://www.mofcom.gov.cn/zwgk/zcfb/art/2026/art 0a31a3c9ac404f7a9b0e917ce3412997.html from China’s MoFCOM and MOST Announcement No. 48 keeps API and SaaS access unregulated, even as it restricts other forms of technology transfer. Builders are caught between a US regime that demands total excision of the model and a Chinese regime that keeps the cloud-based model access open. Moving forward, builders and vendors must price in the provenance of model implementations as a core component of their federal go-to-market strategy. The days of treating model selection as a purely technical decision are over; it is now a primary compliance variable. Future procurement cycles will require rigorous documentation of model lineage to ensure that no prohibited implementations are embedded within the stack.