The US orders every civilian agency to rip out DeepSeek, even tools built on it

What it is

DHS Exclusion and Removal Order 2026-01 bars federal civilian executive branch agencies from buying or running products from Hangzhou DeepSeek Artificial Intelligence, its affiliates, and "third-party products and services developed using DeepSeek implementations". Secretary Markwayne Mullin signed it on 24 July 2026 under a 2018 supply chain law. It stayed non-public until DHS filed notice with the Federal Register in October 2026 (docket DHS-2026-0628, public inspection document 2026-21447). Both the purchasing exclusion and the removal duty apply "effective immediately".

Preconditions / Affected

The order covers agency product lists, e-commerce marketplaces and similar buying channels, as well as systems already deployed. It excludes national security systems and sensitive compartmented information systems, which sit under the Pentagon and the Director of National Intelligence.

The third-party clause is the hard part for vendors and integrators. DeepSeek releases open weights, so its models can sit inside other companies' tools. The order names no products. It also does not say how agencies should treat a DeepSeek model running on a US company's servers.

What to do

For a vendor selling AI to civilian agencies, the practical step is to establish which models sit inside each product, including embedded or fine-tuned DeepSeek weights. For an agency, the order sets out these steps:

• Exclude DeepSeek products from purchasing and remove them from IT systems.
• Request any exception in writing, with a "compelling justification" such as impact on mission-critical work, plus alternative safeguards. An exception can exempt the agency, exempt certain actions, or delay compliance. CISA approves or refuses in writing.
• Until removal is complete, monitor traffic in and out of networks, increase logging, add controls against data leaving systems, and flag anything unusual.
• Agencies lacking the skills to comply can ask CISA for help.

Caveats

• Exception requests are due within 60 days of the order's issue. Counted from 24 July 2026, that window closes around 22 September 2026, before public notice. The page does not say whether the clock was adjusted.
• The risk case rests on public material: DeepSeek's privacy policy, a 2020 DHS business advisory, an April 2025 House Select Committee on China report and a February 2025 NowSecure audit of the iPhone app. The order describes no case of government data reaching DeepSeek.
• The Secretary must review the order within a year and annually after that.
• DeepSeek and the Chinese embassy had not commented when the page was written.