DHS Orders DeepSeek Out of Federal Civilian Agency Systems

The US Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products from their IT systems and to stop buying them, according to a notice filed with the Federal Register on October 19, 2026. The notice is scheduled to publish on October 20.

What the order does

The appended Exclusion and Removal Order #2026-01, signed by Homeland Security Secretary Markwayne Mullin, was issued under the Federal Acquisition Supply Chain Security Act of 2018 after a review of a Federal Acquisition Security Council recommendation. It directs civilian agencies to:

• Exclude DeepSeek, its affiliated entities, and their products from agency procurements, including approved product lists and e-commerce markets.
• Remove products provided by DeepSeek and its affiliates, plus third-party products and services developed using DeepSeek implementations, from civilian agency IT systems.

The order lists an original release date of July 24, 2026. It applies to federal civilian executive branch agencies, except their national security systems and sensitive compartmented information systems. The Defense Department and the intelligence community fall under separate authorities.

Why DHS says it acted

The order’s risk summary says DeepSeek’s servers are located in China, where the legal system gives the government broad access to private company infrastructure. It says DeepSeek-hosted models collect personal information at sign-up and may track and digitally fingerprint users, and that the prompt-and-response process may transfer sensitive data to the PRC if used by government employees or vendors.

It also warns that the models themselves may contain malware or other security vulnerabilities, and cites outside security research finding multiple critical vulnerabilities in DeepSeek’s iOS app.

Exceptions and next steps

Agencies can ask for an exception, but requests must be in writing, come within 60 days of the order’s issuance, and include a compelling justification such as the impact on mission-critical work. CISA reviews the requests. Until removal is complete, agencies are encouraged to monitor traffic, tighten logging and data-exfiltration controls, and flag anomalous activity. The Secretary must review the order within a year and annually after that.