AI & Work
The Department of Homeland Security has ordered federal civilian agencies to pull DeepSeek artificial intelligence products out of their information technology systems and to stop buying them, a move that also reaches software from other vendors built on the Chinese company’s models. DHS filed public notice of the order with the Federal Register on Monday, Oct. 19, and the notice is scheduled for publication on Oct. 20.
The order has two parts. It excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., including affiliated entities, from federal civilian agency procurements. And it requires removal of all DeepSeek and DeepSeek-affiliate products, along with “third-party products and services developed using DeepSeek implementations,” from civilian agency IT.
A supply-chain order, signed in July
The Secretary of Homeland Security issued the order under the Federal Acquisition Supply Chain Security Act of 2018 after reviewing a recommendation from the Federal Acquisition Security Council, according to the notice, which is signed by DHS General Counsel James H. Percival II. The signed order itself is posted in docket DHS-2026-0628.
MeriTalk reported that Secretary Markwayne Mullin signed the order on July 24 and that its restrictions took effect in late July, before Monday’s public notice. Monday’s filing is therefore the public disclosure of an action already in force, not a new announcement of intent. The order applies to civilian executive branch agencies; MeriTalk reported that procurements by the Department of Defense and the intelligence community, and national security systems, are outside its scope. Under the 2018 law, the defense secretary and the director of national intelligence hold similar authority over military and intelligence networks, GovInfoSecurity reported.
Why DHS acted
According to MeriTalk’s account of the order, DHS cited DeepSeek’s collection and storage of user data in China, the transmission of user prompts and AI-generated responses to servers in the People’s Republic of China, and security and privacy weaknesses identified through forensic analysis. The order states that “DeepSeek presents multiple threat vectors that pose significant risk to the cybersecurity of U.S. government systems,” MeriTalk reported. GovInfoSecurity reported that DHS also warned the models “may contain malware or other security vulnerabilities.”
While covered technology is being removed, agencies are told to monitor network traffic, increase logging and apply data-loss-prevention controls, MeriTalk reported. The Cybersecurity and Infrastructure Security Agency’s FASCSA Order Implementation Team handles implementation. Agencies have 60 days from issuance to request exceptions, which CISA approves or denies in writing, and a targeted company has 60 days after notice to challenge an order in the U.S. Court of Appeals for the D.C. Circuit, according to GovInfoSecurity.
What it means for agency and contractor IT work
The practical work lands on agency IT and security staff and on contractors. The third-party clause means teams must identify not only DeepSeek’s own chatbot or app but also tools and services that embed its models.
For contractors, the Federal Acquisition Regulation already spells out the process. Clause 52.204-30, dated December 2023, bars contractors from providing or using covered articles under an applicable FASCSA order in contract performance. Contractors must check SAM.gov for FASCSA orders at least once every three months, report any covered product they find within three business days, follow up within 10 business days with mitigation steps, and pass the clause down to subcontracts.
The order does not mention staffing, and no source reviewed gives an estimate of the hours or positions the removal work requires. What it does create is a defined compliance task: inventorying AI models in use, tracing where third-party software comes from and documenting removal.
DHS is not the first government body to restrict DeepSeek. GovInfoSecurity noted that the Navy, NASA and other agencies had already blocked its chatbot, and that Texas banned it from state-issued devices in January 2025, with New York and Virginia following within weeks.
Sources
- U.S. Department of Homeland Security (Federal Register public inspection), “Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements,” October 19, 2026. https://public-inspection.federalregister.gov/2026-21447.pdf
- MeriTalk, “DHS Orders Civilian Agencies to Remove DeepSeek AI Products,” October 19, 2026. https://www.meritalk.com/articles/dhs-orders-civilian-agencies-to-remove-deepseek-ai-products/
- BankInfoSecurity/GovInfoSecurity, “DHS Bans DeepSeek From Federal Civilian Agencies,” October 19, 2026. https://www.bankinfosecurity.com/dhs-bans-deepseek-from-federal-civilian-agencies-a-33146
- Acquisition.gov, “52.204-30 Federal Acquisition Supply Chain Security Act Orders—Prohibition,” December 2023. https://www.acquisition.gov/far/52.204-30
Featured photo: The Douglas A. Munro Coast Guard Headquarters Building on the St. Elizabeths west campus in southeast Washington, the first stage of the Department of Homeland Security headquarters consolidation, seen from a Coast Guard helicopter Aug. 21, 2015. Representative image; not a depiction of the DeepSeek order. Photo: Senior Chief Petty Officer Michael Hvozda, U.S. Coast Guard, via Wikimedia Commons (Public domain). Cropped from the original.
