The US orders every civilian agency to rip out DeepSeek, even tools built on it

What it claims

DHS Exclusion and Removal Order #2026-01 is issued under a 2018 supply chain law that lets DHS bar risky technology from federal systems. Its public notice was filed with the Federal Register on Monday, 19 October 2026, and is due to publish on 20 October 2026 under docket DHS-2026-0628 (public inspection document 2026-21447). The order was dated 24 July 2026 and was kept out of public view until October. It names Hangzhou DeepSeek Artificial Intelligence and its affiliates.

How the order works

The procurement exclusion is "effective immediately". It covers agency-approved product lists, e-commerce marketplaces and similar buying channels. Removal from agency IT systems is also immediate, and it reaches "third-party products and services developed using DeepSeek implementations". Because DeepSeek releases open weights, this clause can catch other vendors' tools. The article argues that this puts the burden on every vendor selling AI to federal agencies to know which models sit inside their products.

Until DeepSeek products are removed, agencies must:

1. Monitor traffic into and out of their networks.
2. Increase logging.
3. Add controls against data leaving their systems.
4. Flag unusual activity.

CISA can help agencies that lack the skills to comply. Exception requests must be in writing, within 60 days of the order's issue. They need a "compelling justification", such as impact on mission-critical work, plus any alternative safeguards. CISA approves or refuses each request in writing. An exception can exempt an agency, exempt specific actions, or grant a delay. The Secretary must review the order within one year and every year after.

Stated rationale

The order cites four risks:

• DeepSeek's servers are in China.
• Chinese law gives government cyber and intelligence functions broad access to company infrastructure.
• Sign-up collects personal data and may "track and digitally fingerprint users".
• Typed prompts could send sensitive data from staff or contractors to China.

It also says the models "may contain malware or other security vulnerabilities". As support it cites a February 2025 NowSecure audit that found critical flaws in the DeepSeek iPhone app.

All of its evidence is public material: DeepSeek's privacy policy, a 2020 DHS business advisory on Chinese data risks, and an April 2025 House Select Committee on China report. The order describes no case of government data reaching DeepSeek.

Limits

The order lists no affected products. It does not define "DeepSeek implementations". It says nothing about DeepSeek models hosted on a US company's servers.

The page counts the 60-day exception window from the order's issue, and the order is dated 24 July 2026. The page does not say whether that window has already closed or runs from the October notice.

National security systems and secure compartmented information systems are outside the order's scope. Those systems fall under the Pentagon and the Director of National Intelligence.

Earlier, narrower blocks already existed. The Commerce Department, the Navy, and New York, Tennessee and Virginia blocked DeepSeek on their own devices, as reported by Reuters. Abroad, Italy blocked the app, and Taiwan, South Korea and Australia barred it from government devices.