The DeepSeek ban on United States civilian federal agencies was published in the Federal Register on 20 October 2026, three months after it was signed. The order strips DeepSeek products, affiliate products and third-party tools built on DeepSeek models from civilian agency IT systems. Private and overseas users are unaffected.
What the Order Actually Requires
The notice sets out two separate instructions, not one blanket prohibition.
The first is a procurement exclusion. Federal civilian agencies may no longer buy information technology products or services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, including what the notice calls “affiliated entities as defined in 48 CFR 2.101”.
The second is a removal mandate, and it is the broader of the two. It covers “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations”, which must come out of civilian agency information technology.
The legal authority is the Federal Acquisition Supply Chain Security Act of 2018, codified at 41 U.S.C. 1321 to 1328, with implementing regulations at 41 CFR 201-1. The Secretary of Homeland Security acted after reviewing a recommendation from the Federal Acquisition Security Council, an interagency body created by that statute. The notice itself was signed by James H. Percival II, the department’s General Counsel.
The Timeline: Signed in July, Published in October
The most consequential detail is one the order’s own text does not advertise: it has been in force since the summer.
| Date | Event |
|---|---|
| 24 July 2026 | Order signed by Homeland Security Secretary Markwayne Mullin |
| Late July 2026 | Restrictions take effect for civilian agencies |
| Late September 2026 | 60-day window to request an exception expires |
| 19 October 2026, 08:45 | Notice filed for public inspection |
| 20 October 2026 | Notice published in the Federal Register |
The order allows an agency to keep a covered product only by exception, and the text requires that requests “must be submitted in writing within 60 days of the issuance of this order”. Counting 60 days from 24 July places that deadline in late September, roughly three weeks before the public learned the order existed. The Cybersecurity and Infrastructure Security Agency reviews each request and issues a written approval or disapproval, and an agency must show a compelling justification such as an inability to perform a mission-critical function.
There is a discrepancy worth noting. CyberScoop reported that the notice contains a letter from Mullin dated 26 June. Other outlets, including MeriTalk, put the signing at 24 July 2026, and one describes the document as carrying an original release date of that day. The published notice does not state the signing date in its machine-readable text, and the signed order in the appendix is a scanned image.
Reporting also differs on what the 60 days measures. Most accounts, and the order’s quoted wording, treat it as the window to request an exception. At least one outlet described it instead as a 60-day removal period. The notice sets no published completion deadline for removal itself.
Who Is Covered and Who Is Not
The order reaches a specific slice of the US government and stops there.
- Covered: Federal civilian executive branch agencies, for both future purchases and software already installed.
- Not covered: Department of Defense procurements, the intelligence community, national security systems and sensitive compartmented information systems. Those networks fall under separate authorities held by the defense secretary and the director of national intelligence.
- Not bound: State governments, private companies and foreign governments. The order creates no obligation for them.
- Indirectly affected: Federal contractors. BankInfoSecurity reports that exclusion and removal orders can reach prime contractors and subcontractors, and that a 2023 update to federal acquisition rules requires contractors to comply.
DeepSeek is also the only Chinese AI developer named. CyberScoop notes that Moonshot AI, which makes Kimi, and Alibaba, which makes Qwen, are not included, despite similar concerns being raised about them in Washington.
The Third-Party Problem
The phrase “third-party products and services developed using DeepSeek implementations” is the hardest part of the order to apply, and the notice offers no help with it.
DeepSeek publishes several models with open weights, meaning other developers can download them and build products on top without any commercial relationship with the Chinese company. The company’s V4.1 Flash model was released with open weights in September 2026. A vendor can therefore ship a tool running a DeepSeek model while presenting it under an entirely different brand.
The notice does not publish a list of affected products, so agencies have to establish for themselves which of their existing tools contain DeepSeek components. DHS has not said how many products it expects this to involve, nor whether it will issue product-level guidance later.
Why DHS Says DeepSeek Is a Risk
The stated rationale rests on where the data goes and on what the models might contain.
Mullin wrote that DeepSeek’s models present “multiple threat vectors” to civilian agency systems, and that their use “may result in the transfer of sensitive data” to the Chinese government. Information reaching Beijing, he wrote, “could produce actionable intelligence on U.S. persons and/or government programs”. The department also said the models themselves “may contain malware or other security vulnerabilities”.
Underlying that is a jurisdictional argument: DeepSeek’s servers sit in China, and DHS points to Chinese law permitting state cyber and intelligence services to reach privately held infrastructure. Beijing has been tightening its own controls in the opposite direction, and China’s AI export controls now catch any model in the global top ten.
DeepSeek has not issued a public response to the order. The company did not comment to the outlets that reported it.
What Happens Next
Three things are now in motion, on different clocks.
Agencies that have not finished removing covered software are expected to apply interim protections while they work. The order encourages monitoring network traffic for data leaving agency environments, expanding logging, applying data loss prevention controls and flagging anomalous activity.
A company named in a FASCSA order has its own route of appeal. BankInfoSecurity reports that it may challenge the order in the US Court of Appeals for the District of Columbia Circuit within 60 days of receiving notice. Whether DeepSeek has been served, and when, has not been made public.
Questions on implementation go to the FASCSA Order Implementation Team at CISA’s Cybersecurity Division. The signed order is available on regulations.gov under docket number DHS-2026-0628.
What This Does Not Change for Ordinary Users
Nothing in this order restricts the DeepSeek app or website for the general public, in the United States or anywhere else.
The order is a government procurement and IT instrument. It does not remove DeepSeek from app stores, does not block consumer access, and does not bind businesses choosing which models to use. DeepSeek’s commercial products continue to operate, and the company opened its search API to all developers on 17 October 2026, two days before this notice was filed.
Government restrictions elsewhere predate this order and are unaffected by it. Texas barred DeepSeek from state-issued devices in January 2025, with New York and Virginia following, and Australia, South Korea and Taiwan keep it off government systems. Individual US agencies including the Navy and NASA had already blocked the chatbot at their own discretion before any central order existed.
As of 20 October 2026, the order is published and in force, no removal completion deadline has been set, the exception window has closed, and DeepSeek has not responded publicly.
Frequently Asked Questions
Is DeepSeek Banned in the United States?
No. The DeepSeek ban applies only to federal civilian agency systems and purchases. Members of the public, private companies and state governments outside their own rules can still use DeepSeek’s app and models.
When Did the Order Take Effect?
It was signed on 24 July 2026 and took effect for civilian agencies shortly afterwards. The 20 October 2026 Federal Register notice made it public rather than starting it.
Does It Apply to the Department of Defense?
No. Defense procurements, the intelligence community and national security systems are outside this order. The defense secretary and the director of national intelligence hold equivalent authority over those networks.
How Do Agencies Know Which Products Are Affected?
They have to work it out. The notice names Hangzhou DeepSeek and its affiliates but publishes no list of third-party products built on DeepSeek models, and DHS has not said whether product-level guidance will follow.
Can DeepSeek Challenge the Order?
A company named in an order of this kind may petition the US Court of Appeals for the DC Circuit within 60 days of being notified, according to BankInfoSecurity. It is not public whether DeepSeek has done so.
