US orders DeepSeek removed from federal civilian IT systems

DHS Exclusion and Removal Order 2026-01, dated 24 July 2026, was filed for public inspection on 19 October and formally published on 20 October. It bars civilian federal agencies from buying IT products and services developed by Hangzhou DeepSeek and its affiliates, and orders existing ones removed.

The order also covers third-party products built using DeepSeek. Because DeepSeek's models are open-weight, many vendors embedded them, so a tool not branded DeepSeek can fall under the ban. It is reportedly the first use of the 2018 Federal Acquisition Supply Chain Security Act against an AI company.

DHS cites "multiple threat vectors", the risk that sensitive data is transferred to the PRC, and outputs that could produce "actionable intelligence" on US persons or agencies. China defended DeepSeek.

A Pentagon IT agency blocked the chatbot in January 2025, and Commerce and the Navy banned it on work devices. The new order extends this across civilian agencies and into the supply chain.

Agencies first have to find DeepSeek-based components in their own systems, which means software inventories at the model level. Many do not know which model runs behind a given service. Contractors may have to certify they do not use DeepSeek, which is hard to verify; grey areas such as models trained on another model's outputs will be contested. Exception requests were reportedly due 60 days in advance, a window that had already closed before the public filing. The order may also become a template: large private buyers are already adding "which model, hosted where" questions to procurement forms, and other governments are watching how the US applies the 2018 law.

• Document which AI models your product uses and where they run.
• Ask your SaaS vendors what models sit behind their features.
• Avoid lock-in to a single model so you can switch if needed.