# DHS Orders DeepSeek Off Federal Systems: What It Requires

> DHS ordered DeepSeek, its affiliates and tools built on it out of civilian agency IT on July 24. The order went public October 19. What it says.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-19
- Canonical (HTML): https://cellcog.ai/blog/dhs-deepseek-order/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- DHS Exclusion and Removal Order 2026-01, signed by Secretary Markwayne Mullin with a July 24, 2026 release date, bars DeepSeek from federal civilian agencies. DHS filed public notice of it on October 19, for Federal Register publication on October 20.
- Agencies must exclude DeepSeek, its affiliates and their products from purchasing, including approved product lists and e-commerce markets, effective immediately after issuance.
- They must also remove DeepSeek products and third-party products and services developed using DeepSeek implementations from their systems, or ask for an exception in writing within 60 days.
- The third-party clause is the reach: software built on a DeepSeek model counts, not only DeepSeek's own app. National security and compartmented systems are outside this order.
- The order stayed out of public view for 87 days. Counted from July 24, its 60-day exception window closed on September 22, four weeks before the public could read it.

## At a glance

- **What did DHS order about DeepSeek?** That federal civilian agencies stop buying DeepSeek products and remove DeepSeek, its affiliates' products and third-party products built on DeepSeek implementations from their systems. The order, numbered 2026-01, carries a release date of July 24, 2026.
- **When was it made public?** DHS filed a notice with the signed order attached at 8:45 a.m. on October 19, 2026, as Federal Register document 2026-21447, scheduled for publication on October 20.
- **Does it ban DeepSeek for the public?** No. It covers the information technology and purchasing of federal civilian executive branch agencies, and excludes their national security and compartmented systems.

**Homeland Security has ordered DeepSeek out of federal civilian agencies, and the order reaches past DeepSeek's own app.** Exclusion and Removal Order 2026-01, signed by Secretary of Homeland Security Markwayne Mullin with an original release date of July 24, 2026, bars DeepSeek and its affiliates from civilian agency purchasing. It also orders "removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology." That second clause is the one any company selling software to the government should read twice.

The order stayed out of public view for 87 days. DHS filed a notice with the Federal Register at 8:45 a.m. on October 19, 2026, as document 2026-21447, for publication on October 20, with the signed order attached as an appendix (docket DHS-2026-0628). We read the order itself. Below is what it requires, the reasons it gives, and how it fits the earlier DeepSeek restrictions.

## What the order requires

*Table: Exclusion and Removal Order 2026-01, as signed (DHS, release date July 24, 2026)*

| Item | What the order says |
|---|---|
| Issued by | Markwayne Mullin, Secretary of Homeland Security; copy to Russell Vought, OMB |
| Applies to | Federal civilian executive branch agencies, minus national security and compartmented systems |
| Exclude | DeepSeek, its affiliates and their products from purchasing, incl. approved lists and e-commerce markets |
| Remove | DeepSeek and affiliate products, plus third-party products built on DeepSeek implementations |
| When | Immediately after issuance, unless an agency seeks an exception |
| Exceptions | Requested in writing within 60 days of issuance; CISA approves or disapproves |
| Meanwhile | Watch traffic, add logging, control data exfiltration |
| Review | Within one year, then every year |

The scope line is precise. The order applies to "Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems". The Pentagon and the intelligence community sit under their own authorities, and Congress already wrote DeepSeek rules for both (see the timeline below).

![Animation: an amber Order 2026-01 stamp lands on a civilian agency building; a DeepSeek module and a Built on DeepSeek module slide out of its server rack under the word Remove; a shopping cart gate shuts beside Exclude from purchasing; a closed vault labelled National security systems stays untouched, marked Outside this order](https://cellcog.ai/blog/media/dhs-deepseek-order/dhs-two-removals.svg)
*DeepSeek and tools built on it leave the rack; buying closes; security systems stay out*

The removal instruction leaves agencies one alternative. They must remove the covered products "immediately after the issuance of the Order, or seek an Exception". An exception request has to name the order, the exception sought, the product, a compelling justification and the alternative mitigations. Until removal is done, agencies are encouraged to take steps "such as monitoring the flow of traffic in and out of the agency", plus enhanced logging and controls on data exfiltration.

## Why DHS says DeepSeek is a risk

The order's case rests on where data goes. "DeepSeek servers are located in the PRC", it says, and Chinese law gives government cyber and intelligence agencies broad authority to reach company infrastructure. For DeepSeek-hosted models, account creation collects personal information and may fingerprint users, and prompts from government staff or vendors can carry sensitive data to China. It adds: "The models themselves may contain malware or other security vulnerabilities."

The evidence the Federal Acquisition Security Council reviewed is not in the public filing. What the appendix cites is public: DeepSeek's own privacy policy, a House Select Committee on the CCP report from April 16, 2025, and a NowSecure analysis from February 6, 2025 that found critical flaws in DeepSeek's iOS app.

## The clause that reaches vendors

Most earlier restrictions named an app on a device. This one names a supply chain. Products "developed using DeepSeek implementations" are removed too, and a footnote extends that to third-party implementations of DeepSeek used to provide products and services to civilian agencies.

The order does not define an implementation. Read plainly, it covers a vendor that runs a DeepSeek model on its own servers, not only DeepSeek's app and API. That matters because DeepSeek publishes open weights: [DeepSeek V4.1 Flash](https://cellcog.ai/blog/deepseek-v4-1-flash-release-date/) and its multimodal and agent releases are free to download and host anywhere. A product that hosts them in the United States still appears to fall inside this order when sold to a civilian agency. A vendor in that position should check its model stack before CISA asks.

## How it fits the earlier DeepSeek restrictions

*Table: DeepSeek restrictions in the US government, dated*

| Date | Step | Source |
|---|---|---|
| Jan 31, 2025 | NASA blocks DeepSeek on agency devices and networks | CNBC |
| Feb 7, 2025 | No DeepSeek on Government Devices Act introduced; referred to committee | H.R. 1121 |
| Jul 11, 2025 | First supply chain exclusion and removal order, against Acronis, intelligence community | ODNI |
| Dec 18, 2025 | Defense bill defines DeepSeek AI as covered; section 6604 bars it on intelligence systems | Public Law 119-60 |
| Jul 24, 2026 | Order 2026-01 released for civilian agencies | DHS |
| Sep 22, 2026 | 60-day exception window closes, counted from July 24 | Our arithmetic |
| Oct 19, 2026 | Notice and signed order filed for public inspection, 8:45 a.m. | Federal Register |
| Oct 20, 2026 | Notice published | Federal Register |

The House bill never passed; the defense bill did, but it covers the Pentagon and the intelligence community only. Civilian agencies were the gap, and this order closes it through the 2018 supply chain law rather than new legislation. The order also commits DHS to review it "within one year and annually thereafter".

The timing is the odd part. The order counts its 60 days from issuance. If issuance is the July 24 release date, the exception window closed on September 22, four weeks before anyone outside government could read the order. The October filing is notice of a rule already in force.

![Animation: a timeline from Jul 24 (Signed) to Sep 22 (Window closes) under a teal bracket labelled 60-day exception window, then a grey bracket to Oct 19 labelled 87 days out of public view, ending at an amber document labelled Order made public](https://cellcog.ai/blog/media/dhs-deepseek-order/dhs-87-days.svg)
*Signed July 24, exception window closed September 22, public October 19: 87 days*

## Where CellCog stands

Every CellCog agent tier runs on Claude Opus 5.5, and our routing configuration, read on October 19, 2026, sends no tier to a DeepSeek model. We wrote about DeepSeek's models as news, [V4.1 Flash](https://cellcog.ai/blog/deepseek-v4-1-flash-release-date/) and the [open agent harness](https://cellcog.ai/blog/what-is-deepseek-harness/) among them; none of them runs inside the product.

## What we are watching for

- The docket on regulations.gov and any CISA guidance on what counts as a DeepSeek implementation.
- Whether the order appears on SAM.gov, where the Acronis order was posted.
- A response from DeepSeek or China's foreign ministry; none had appeared by 19:20 UTC on October 19.
- Whether other model makers or their affiliates draw a similar order.

## Sources

- Department of Homeland Security, [Notice of Order Regarding Exclusion and Removal of DeepSeek Products](https://public-inspection.federalregister.gov/2026-21447.pdf), FR Doc. 2026-21447, filed October 19, 2026, 8:45 a.m., publication October 20, 2026; signed order in the appendix. Read directly.
- [Federal Register document 2026-21447](https://www.federalregister.gov/d/2026-21447) and [docket DHS-2026-0628](https://www.regulations.gov/docket/DHS-2026-0628).
- Congress, [H.R. 1121](https://www.congress.gov/bill/119th-congress/house-bill/1121), introduced February 7, 2025.
- [Public Law 119-60](https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm), approved December 18, 2025, section 6604 and the covered artificial intelligence definition.
- Mayer Brown, [DNI issues first FASCSA exclusion and removal order against Acronis AG](https://www.mayerbrown.com/en/insights/publications/2025/10/dni-issues-first-fascsa-exclusion-and-removal-order-against-acronis-ag), October 2025.
- CNBC, [NASA becomes latest federal agency to block China's DeepSeek](https://www.cnbc.com/2025/01/31/nasa-becomes-latest-federal-agency-to-block-chinas-deepseek.html), January 31, 2025.

## FAQ

**Does the DHS order cover tools built on DeepSeek models?**

Yes. It orders removal of third-party products and services developed using DeepSeek implementations, and a footnote extends that to third-party implementations used to provide products and services to civilian agencies. The order does not define implementations, so a vendor running a DeepSeek model inside its product should assume it is in scope until CISA says otherwise.

**When does the DeepSeek order take effect?**

Immediately after issuance. The order's original release date is July 24, 2026; the public notice was filed on October 19 and published in the Federal Register on October 20. The public filing is notice of an order already in force.

**Can an agency get an exception?**

It can ask. Requests go to the DHS issuing official in writing within 60 days of issuance and must identify the order, the exception sought, the product, a compelling justification and alternative mitigations. CISA reviews them and approves or disapproves in writing.

**Why did DHS order DeepSeek removed?**

The order cites DeepSeek's servers in China, Chinese law giving government agencies broad access to company infrastructure, personal data collected at account creation, prompts that can carry sensitive data, possible malware in the models and critical flaws found in DeepSeek's iOS app.

**What law lets DHS issue this order?**

The Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328, and its regulations at 41 CFR part 201-1. It lets the Secretary of Homeland Security issue exclusion and removal orders for civilian agencies after a Federal Acquisition Security Council recommendation.

**Does CellCog use DeepSeek?**

No. Every CellCog agent tier runs on Claude Opus 5.5, and our routing configuration, read on October 19, 2026, sends no tier to a DeepSeek model.

## Related

- [DeepSeek V4.1 Flash: Price, Specs, and the Rumor Scorecard](https://cellcog.ai/blog/deepseek-v4-1-flash-release-date/index.md)
- [What Is DeepSeek Harness? The Open Agent, Explained](https://cellcog.ai/blog/what-is-deepseek-harness/index.md)
- [DeepSeek V5 Release Date: The Leak vs the Record](https://cellcog.ai/blog/deepseek-v5-release-date/index.md)

## The AI employee for this read

[AI Legal Assistant](https://cellcog.ai/ai-employees/ai-legal-assistant): I built this page. For what it covers, hire a legal assistant: it tracks the contracts, drafts the first pass and routes what needs a lawyer.

---

Markdown alternate of https://cellcog.ai/blog/dhs-deepseek-order/. Try CellCog free, no credit card needed: https://cellcog.ai/signup