Homeland Security has ordered DeepSeek out of federal civilian agencies, and the order reaches past DeepSeek’s own app. Exclusion and Removal Order 2026-01, signed by Secretary of Homeland Security Markwayne Mullin with an original release date of July 24, 2026, bars DeepSeek and its affiliates from civilian agency purchasing. It also orders “removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” That second clause is the one any company selling software to the government should read twice.
The order stayed out of public view for 87 days. DHS filed a notice with the Federal Register at 8:45 a.m. on October 19, 2026, as document 2026-21447, for publication on October 20, with the signed order attached as an appendix (docket DHS-2026-0628). We read the order itself. Below is what it requires, the reasons it gives, and how it fits the earlier DeepSeek restrictions.
On this page · 7 sectionsOpen
DHS Exclusion and Removal Order 2026-01, signed by Secretary Markwayne Mullin with a July 24, 2026 release date, bars DeepSeek from federal civilian agencies. DHS filed public notice of it on October 19, for Federal Register publication on October 20.
Agencies must exclude DeepSeek, its affiliates and their products from purchasing, including approved product lists and e-commerce markets, effective immediately after issuance.
They must also remove DeepSeek products and third-party products and services developed using DeepSeek implementations from their systems, or ask for an exception in writing within 60 days.
The third-party clause is the reach: software built on a DeepSeek model counts, not only DeepSeek’s own app. National security and compartmented systems are outside this order.
The order stayed out of public view for 87 days. Counted from July 24, its 60-day exception window closed on September 22, four weeks before the public could read it.
§ 01What the order requires
| Item | What the order says |
|---|---|
| Issued by | Markwayne Mullin, Secretary of Homeland Security; copy to Russell Vought, OMB |
| Applies to | Federal civilian executive branch agencies, minus national security and compartmented systems |
| Exclude | DeepSeek, its affiliates and their products from purchasing, incl. approved lists and e-commerce markets |
| Remove | DeepSeek and affiliate products, plus third-party products built on DeepSeek implementations |
| When | Immediately after issuance, unless an agency seeks an exception |
| Exceptions | Requested in writing within 60 days of issuance; CISA approves or disapproves |
| Meanwhile | Watch traffic, add logging, control data exfiltration |
| Review | Within one year, then every year |
The scope line is precise. The order applies to “Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems”. The Pentagon and the intelligence community sit under their own authorities, and Congress already wrote DeepSeek rules for both (see the timeline below).
The removal instruction leaves agencies one alternative. They must remove the covered products “immediately after the issuance of the Order, or seek an Exception”. An exception request has to name the order, the exception sought, the product, a compelling justification and the alternative mitigations. Until removal is done, agencies are encouraged to take steps “such as monitoring the flow of traffic in and out of the agency”, plus enhanced logging and controls on data exfiltration.
§ 02Why DHS says DeepSeek is a risk
The order’s case rests on where data goes. “DeepSeek servers are located in the PRC”, it says, and Chinese law gives government cyber and intelligence agencies broad authority to reach company infrastructure. For DeepSeek-hosted models, account creation collects personal information and may fingerprint users, and prompts from government staff or vendors can carry sensitive data to China. It adds: “The models themselves may contain malware or other security vulnerabilities.”
The evidence the Federal Acquisition Security Council reviewed is not in the public filing. What the appendix cites is public: DeepSeek’s own privacy policy, a House Select Committee on the CCP report from April 16, 2025, and a NowSecure analysis from February 6, 2025 that found critical flaws in DeepSeek’s iOS app.
§ 03The clause that reaches vendors
Most earlier restrictions named an app on a device. This one names a supply chain. Products “developed using DeepSeek implementations” are removed too, and a footnote extends that to third-party implementations of DeepSeek used to provide products and services to civilian agencies.
The order does not define an implementation. Read plainly, it covers a vendor that runs a DeepSeek model on its own servers, not only DeepSeek’s app and API. That matters because DeepSeek publishes open weights: DeepSeek V4.1 Flash and its multimodal and agent releases are free to download and host anywhere. A product that hosts them in the United States still appears to fall inside this order when sold to a civilian agency. A vendor in that position should check its model stack before CISA asks.
§ 04How it fits the earlier DeepSeek restrictions
| Date | Step | Source |
|---|---|---|
| Jan 31, 2025 | NASA blocks DeepSeek on agency devices and networks | CNBC |
| Feb 7, 2025 | No DeepSeek on Government Devices Act introduced; referred to committee | H.R. 1121 |
| Jul 11, 2025 | First supply chain exclusion and removal order, against Acronis, intelligence community | ODNI |
| Dec 18, 2025 | Defense bill defines DeepSeek AI as covered; section 6604 bars it on intelligence systems | Public Law 119-60 |
| Jul 24, 2026 | Order 2026-01 released for civilian agencies | DHS |
| Sep 22, 2026 | 60-day exception window closes, counted from July 24 | Our arithmetic |
| Oct 19, 2026 | Notice and signed order filed for public inspection, 8:45 a.m. | Federal Register |
| Oct 20, 2026 | Notice published | Federal Register |
The House bill never passed; the defense bill did, but it covers the Pentagon and the intelligence community only. Civilian agencies were the gap, and this order closes it through the 2018 supply chain law rather than new legislation. The order also commits DHS to review it “within one year and annually thereafter”.
The timing is the odd part. The order counts its 60 days from issuance. If issuance is the July 24 release date, the exception window closed on September 22, four weeks before anyone outside government could read the order. The October filing is notice of a rule already in force.
§ 05Where CellCog stands
Every CellCog agent tier runs on Claude Opus 5.5, and our routing configuration, read on October 19, 2026, sends no tier to a DeepSeek model. We wrote about DeepSeek’s models as news, V4.1 Flash and the open agent harness among them; none of them runs inside the product.
§ 06What we are watching for
- The docket on regulations.gov and any CISA guidance on what counts as a DeepSeek implementation.
- Whether the order appears on SAM.gov, where the Acronis order was posted.
- A response from DeepSeek or China’s foreign ministry; none had appeared by 19:20 UTC on October 19.
- Whether other model makers or their affiliates draw a similar order.
§ 07Sources
- Department of Homeland Security, Notice of Order Regarding Exclusion and Removal of DeepSeek Products, FR Doc. 2026-21447, filed October 19, 2026, 8:45 a.m., publication October 20, 2026; signed order in the appendix. Read directly.
- Federal Register document 2026-21447 and docket DHS-2026-0628.
- Congress, H.R. 1121, introduced February 7, 2025.
- Public Law 119-60, approved December 18, 2025, section 6604 and the covered artificial intelligence definition.
- Mayer Brown, DNI issues first FASCSA exclusion and removal order against Acronis AG, October 2025.
- CNBC, NASA becomes latest federal agency to block China’s DeepSeek, January 31, 2025.
Q1Does the DHS order cover tools built on DeepSeek models?
Yes. It orders removal of third-party products and services developed using DeepSeek implementations, and a footnote extends that to third-party implementations used to provide products and services to civilian agencies. The order does not define implementations, so a vendor running a DeepSeek model inside its product should assume it is in scope until CISA says otherwise.
Q2When does the DeepSeek order take effect?
Immediately after issuance. The order’s original release date is July 24, 2026; the public notice was filed on October 19 and published in the Federal Register on October 20. The public filing is notice of an order already in force.
Q3Can an agency get an exception?
It can ask. Requests go to the DHS issuing official in writing within 60 days of issuance and must identify the order, the exception sought, the product, a compelling justification and alternative mitigations. CISA reviews them and approves or disapproves in writing.
Q4Why did DHS order DeepSeek removed?
The order cites DeepSeek’s servers in China, Chinese law giving government agencies broad access to company infrastructure, personal data collected at account creation, prompts that can carry sensitive data, possible malware in the models and critical flaws found in DeepSeek’s iOS app.
Q5What law lets DHS issue this order?
The Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328, and its regulations at 41 CFR part 201-1. It lets the Secretary of Homeland Security issue exclusion and removal orders for civilian agencies after a Federal Acquisition Security Council recommendation.
Q6Does CellCog use DeepSeek?
No. Every CellCog agent tier runs on Claude Opus 5.5, and our routing configuration, read on October 19, 2026, sends no tier to a DeepSeek model.