DHS orders federal agencies to remove DeepSeek and stop buying it

The document is called Exclusion and Removal Order #2026-01. It was signed by Homeland Security Secretary Markwayne Mullin, with Russell Vought, director of the Office of Management and Budget, copied.

The order tells civilian agencies to do two things:

• Exclude: stop buying anything from DeepSeek or its affiliated companies, effective immediately. That includes agency-approved product lists, e-commerce marketplaces and similar buying channels for hardware, software and services.
• Remove: take DeepSeek products off agency IT systems right away, or ask for an exception.

The target is Hangzhou DeepSeek Artificial Intelligence, the Chinese company behind the DeepSeek chatbot and models. The order defines affiliates broadly: any company that controls DeepSeek, is controlled by it, or shares a controlling owner with it.

Why it matters: The removal also covers third-party products and services developed using DeepSeek implementations, so a tool from another vendor that runs on a DeepSeek model is out too.

The timeline is a little unusual, because the order is older than the news.

• July 24, 2026: the signed order's original release date.
• October 19, 2026: DHS filed a public notice of the order with the Federal Register at 8:45 a.m. Eastern.
• October 20, 2026: the notice is scheduled to be published in the Federal Register.

The public notice is signed by James H. Percival II, the department's general counsel. A copy of the full order sits in the federal docket DHS-2026-0628 on regulations.gov.

Reuters reports that a July memo, also made public on October 19, had already told federal agencies to monitor traffic in and out of government websites to address risks from DeepSeek.

The order lays out its reasons in a section called "Summary of Risks from Source." It says DeepSeek's models "present multiple threat vectors." Here is the chain of reasoning, in plain terms:

• Where the data goes: DHS says DeepSeek's servers are located in China, and that Chinese law gives government cyber and intelligence agencies extensive authority to access private company infrastructure.
• What it collects: for versions DeepSeek hosts itself, the order says account sign-up collects personally identifiable information and may also track and digitally fingerprint users.
• How prompts work: using a chatbot means typing information into it. DHS says that process "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors."
• What could be built from it: that data, alone or mixed with public data, "could produce actionable intelligence on U.S. persons and/or government programs," the order says.
• The software itself: DHS says the models "may contain malware or other security vulnerabilities."

The order also cites open-source security research from February 2025, by the mobile security firm NowSecure, that found multiple critical vulnerabilities in the DeepSeek iOS app.

The big picture: the order calls DeepSeek "a foreign, privately-owned company" that offers multiple AI applications "available widely and free of charge." Free and popular is exactly why it worries security officials: anyone at an agency could try it.

The order uses the Federal Acquisition Supply Chain Security Act of 2018. In plain words, it's a law about not buying risky parts for the government's tech.

That law created the Federal Acquisition Security Council, a group that studies supply chain threats and recommends which products or services should be kept out of federal purchases and systems. The Homeland Security Secretary reviews those recommendations and can turn them into binding orders for civilian agencies.

Think of it like a building manager banning a brand of lock. The ban covers that brand's locks, and also locks sold by other companies that use the same mechanism inside. That second part is the piece of this order that will take the most work.

The public notice says the Secretary acted "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence." The order notes that federal rules require executive agencies to comply with orders issued this way.

The order applies to federal civilian executive branch agencies. It has clear limits:

• Not the military: the Defense Department, which the order calls the Department of War, issues its own orders for its systems.
• Not spy agencies: the Director of National Intelligence covers the intelligence community.
• Not secret networks: national security systems and secure compartmented information systems are excluded.
• Not you: nothing in the order stops private people or businesses from using DeepSeek.

The people most affected outside government are vendors. Any company that sells software or services to civilian agencies now has to know whether its product uses a DeepSeek model under the hood.

In real life Say a company sells a document-summary tool to a federal agency, and that tool quietly runs on a DeepSeek model. Under this order, the agency has to remove it, even though the word "DeepSeek" never appears on the screen.

Yes, but they have to ask. An agency can request an exception from DHS, for example asking that the order not apply to it, to certain actions, or for a delay.

Requests must be in writing within 60 days of the order and include:

• Which order: the specific exclusion or removal order.
• What exception: the parts of the order the agency wants relief from.
• Which product: a name or description of the covered product or service.
• Why: a compelling reason, such as the impact on mission-critical work or national security considerations.
• What else: other steps the agency will take to reduce the risk.

CISA, the Cybersecurity and Infrastructure Security Agency, reviews the requests and answers each one in writing.

What's next: until removal is finished, the order encourages agencies to monitor traffic in and out of their networks, add stronger logging, put controls on data leaving their systems, and flag unusual activity. CISA may provide technical help to agencies that lack the in-house skills to comply. The Secretary must review the order within one year and every year after that.

This isn't DeepSeek's first ban inside the US government. Reuters reports that several agencies, including the Department of Commerce and the Navy, had already banned DeepSeek on government devices. States including New York, Tennessee and Virginia took similar steps.

The difference now is scope. Earlier bans focused on devices. This order covers the purchasing systems and IT of every civilian agency, plus products from other companies built on DeepSeek technology.

Reuters also places the order among wider US actions against Chinese technology:

• October 29: the Federal Communications Commission is set to vote on barring Chinese labs from testing electronics such as smartphones, cameras and computers for the US market. Reuters reports that 82% of US electronics were tested in China last year.
• December: the FCC banned imports of new models of Chinese drones and Chinese-made consumer routers.

According to Reuters, the Chinese Embassy in Washington did not immediately comment. DeepSeek's models remain widely used around the world; the company shipped its latest V4.1-Flash update just days ago.

• If you use DeepSeek at home: nothing changes. The order covers federal civilian agencies, not the public.
• If you work at a civilian federal agency: DeepSeek and tools built on it are being removed from agency systems, and new purchases are barred.
• If your company sells AI tools to the government: check which models power your product. A DeepSeek model under the hood now makes it ineligible for civilian agencies.