DHS Orders DeepSeek Removed From Federal Civilian Agencies Under Supply-Chain Law

The Department of Homeland Security has ordered all federal civilian agencies to stop acquiring DeepSeek products and services and to strip out versions already deployed, per reporting from Reuters and CyberScoop published October 19. The order rests on the Federal Acquisition Supply Chain Act of 2018, following a Federal Acquisition Security Council review, and carries the mechanics of that regime: Secretary Mullin’s exclusion order was signed June 26, meaning the ban has been operating for months before this week’s Federal Register publication (docket 2026-21447) made it broadly visible. Mullin’s stated rationale: DeepSeek models present “multiple threat vectors” to civilian agency IT systems, chiefly the risk that government information reaching China, “either independently or in combination with publicly available data,” could yield intelligence on US persons or programs.

What the order actually requires

Three obligations, in procurement language that has teeth. Civilian agencies are barred from procuring IT products or services from parent company Hangzhou DeepSeek Artificial Intelligence and its affiliates. Agencies must remove any DeepSeek versions already in their systems, with interim guidance to add “enhanced logging and controls on data exfiltration for the relevant systems” while removal proceeds. And exceptions exist but are deliberately hard: a waiver request must be submitted 60 days in advance with a “compelling justification,” such as proof that no alternative can fulfill a mission-critical function. The third-party angle matters most in practice: the ban reaches services that use DeepSeek, not just DeepSeek’s own apps, which sweeps in a wide swath of AI tooling that resells Chinese open-weight models under other brands. Defense and intelligence agencies sit outside this order only because their restrictions were already stricter.

The enforcement pattern is consolidating

What makes this order a milestone rather than another headline is the mechanism. Individual agencies had been blocking DeepSeek at their own discretion since early 2025, and the January 2026 debate was about penalties targeting DeepSeek’s access to US technology. This order instead runs the problem through the Federal Acquisition Security Council, the supply-chain body built for hardware like Huawei and Kaspersky, and produces a single government-wide exclusion with a public docket. It is the first time a Chinese AI model has gone through that pipeline, and the template generalizes: the same docket format, the same 60-day exception process, and the same “affiliates” sweep could process Kimi, Qwen, or GLM if the council finds similar threat vectors. Note the irony of the timing: DeepSeek open-sourced its production inference engine with equal NVIDIA and Huawei support the same day the ban surfaced, and Washington’s distillation accusations against the company, documented in Anthropic’s September threat intelligence report, remain the unaddressed backdrop to the security rationale.

What to watch

Three threads determine whether this is a one-model action or the start of a procurement regime for AI. First, scope creep by analogy: procurement lawyers at other agencies and allied governments will read the docket as precedent, and any model with similar data-routing characteristics is now arguable under the same authority. Second, the compliance burden lands on third-party AI vendors, who must now certify their supply chains down to the weights and inference provider, a requirement nobody’s SOC 2 covers; expect a market for AI provenance attestations to appear quickly. Third, the retaliation loop: Beijing has previously responded to US AI restrictions with export-control moves of its own, and a procurement ban under supply-chain law gives China a symmetrical justification for excluding US models from its own government market. The DeepSeek brand survives fine in commercial markets; the question is whether government procurement becomes the wall that splits the global AI market in two.