Exclusion and Removal Order 2026-01, signed July 24, 2026; published in the Federal Register on October 20, 2026
DHS Orders DeepSeek Out of Federal Civilian Systems, Including Third-Party Products Built With It
The Department of Homeland Security published Exclusion and Removal Order 2026-01 under the Federal Acquisition Supply Chain Security Act, the first FASCSA order DHS has issued and the first covering all federal civilian executive branch agencies. It directs agencies to stop procuring products and services from Hangzhou DeepSeek Artificial Intelligence and its affiliates, and to remove those products, together with third-party products and services developed using DeepSeek implementations, from agency information technology. The order's stated rationale is that DeepSeek's servers are in the People's Republic of China, that prompts from federal employees or vendors could transfer sensitive data there, and that the models may contain vulnerabilities. The hard problem, as the Cloud Security Alliance's analysis sets out, is that the order never defines DeepSeek implementations: the phrase plausibly reaches self-hosted DeepSeek open weights, fine-tunes and quantizations of those weights, and possibly models distilled from DeepSeek outputs, while few organizations keep records that could prove a negative. The timeline compounds it: the order was signed July 24, agency exception requests were due within 60 days of issuance, and that deadline passed about four weeks before the order appeared in the Federal Register. The order does not cover the Department of Defense, and it does not restrict private companies or the public.
Executives
If you sell to federal civilian agencies, expect customers to ask whether your products were developed using DeepSeek, and expect some to ask for broader attestations than the regulation requires. The order is precautionary; it does not establish that any given product sent data to China or contains malicious code. What it changes is the questions your contracts will carry.
CIO / CISO
Build the inventory before the questionnaire arrives: an AI bill of materials for every product and internal system that names base models, fine-tune lineage, distillation sources, and hosted endpoints. Runtime use of DeepSeek is detectable today; development-time use, synthetic data and distillation lineage, usually is not recorded at all. That record gap is now a compliance exposure under the NIST AI RMF Govern function.
Engineers
Start with what tooling can answer: scan egress for DeepSeek endpoints and API keys, inventory deployed model weights and their base_model metadata, and log which models generate training or evaluation data going forward. Document your interpretive choices on scope now, because clarifying guidance has not yet been published and your reasoning will be the record.
Everyone (non-IT)
The U.S. government has told its civilian agencies to remove a Chinese AI company's products, and even other companies' products built using its models, from government systems over data security concerns. It does not ban the app for the general public, but it is the clearest sign yet that where an AI model comes from is becoming a formal security question.