The U.S. government just kicked DeepSeek out of every federal civilian agency — and it didn't stop there. Any third-party product built on top of DeepSeek's models has to go too.
On October 19, 2026 at 14:48 (UTC), the Department of Homeland Security published Exclusion and Removal Order #2026-01, invoking the Federal Acquisition Supply Chain Security Act (FASCSA) for the first time against an artificial intelligence company. The order, signed by DHS Secretary Markwayne Mullin and originally dated July 24, 2026 (UTC), bars all federal civilian executive branch agencies from procuring DeepSeek products and services, and orders the immediate removal of anything running on DeepSeek — including third-party applications that embed DeepSeek models.
It is effective immediately.
What the order actually says
The document, filed under Docket No. DHS-2026-0628, covers two actions. First, exclusion: DeepSeek and its affiliated entities are removed from federal procurement channels — agency-approved product lists, service provider equipment lists, e-commerce markets, the works. Second, removal: every DeepSeek product, and every third-party product or service "developed using DeepSeek implementations," must be stripped from civilian agency IT systems right away.
The scope is unusually broad. It isn't just the DeepSeek chat app or API. If a contractor built an internal tool that calls DeepSeek under the hood, that tool is now contraband on federal networks. Agencies can request exceptions in writing within 60 days, but they need a "compelling justification" — mission-critical function, national security interest — and CISA has to sign off.
DHS laid out its reasoning in blunt terms. DeepSeek's servers are in China. China's legal system gives government intelligence functions broad access to private company infrastructure. DeepSeek's account registration collects personally identifiable information and may fingerprint users. The prompt-and-response model means any sensitive data a federal employee types in could end up in China. And, the order notes, "the models themselves may contain malware or other security vulnerabilities" — open-source researchers found multiple critical vulnerabilities in the DeepSeek iOS app.
Why this matters — and why the third-party clause is the real story
A plain reading makes this sound like another entry in the long-running U.S.–China tech decoupling playlist. It is that, but it's also something more structural.
FASCSA was passed in 2018 to give the federal government a lever for pulling risky supply-chain vendors out of procurement. It has been used against telecom gear (Huawei, ZTE) and surveillance equipment. It has never been used against an AI model company until now. That precedent matters because it creates a template: if DHS can designate DeepSeek a supply-chain risk on data-sovereignty grounds, the same logic applies to any model hosted in a jurisdiction the U.S. considers adversarial.
The third-party removal clause is where the order punches above its weight. Most enterprise AI adoption doesn't happen through direct API calls to DeepSeek. It happens through layers — a startup wraps DeepSeek in a productivity tool, a systems integrator embeds it in a custom workflow, a SaaS platform offers it as one model among many. The DHS order reaches through all of those layers. If you're a vendor selling to the U.S. government and your stack touches DeepSeek anywhere, you now have a compliance problem regardless of whether your own product is "Chinese."
That creates a chilling effect that extends well beyond federal procurement. Enterprise buyers who don't have to comply with the order will still ask their vendors the same question: does anything in your pipeline call a model that DHS just designated a supply-chain risk? For startups that built on DeepSeek because it was cheap and capable, the answer could cost them customers.
The timing is not accidental
The order was signed in July but sat until October 19 before publication. That gap is worth noticing. In the intervening months, DeepSeek released V4.1-Flash, a model that has been punching above its weight on coding benchmarks at a fraction of the price of frontier alternatives. DeepSeek's cost structure — built on aggressive inference optimization and Chinese compute — is precisely what makes it attractive to budget-conscious enterprise buyers, and precisely what makes it a competitive threat to U.S. labs.
Publishing the order now, right as DeepSeek's adoption curve steepens, sends a signal that goes beyond security. It tells the market: the U.S. government will not let a Chinese model become a default infrastructure layer in American enterprise software, even if the price is unbeatable.
China's response was predictable. Foreign Ministry spokesperson Mao Ning told a regular briefing on October 20 (UTC+8, Beijing time) that China "opposes the generalization of national security concepts and the politicization of tech and trade issues," and vowed to defend Chinese companies' legal rights. The statement was standard, but the underlying tension is real: DeepSeek is one of the few Chinese AI products with genuine global traction, and restricting it is as much economic policy as security policy.
The bigger picture
This doesn't happen in isolation. The FCC votes on October 29 on whether to bar all Chinese labs from testing electronics for the U.S. market — a move that would disrupt a supply chain where 82% of U.S. electronics were certified in China last year. In December, the FCC banned imports of new Chinese drones and consumer routers. In July, it barred devices containing key hardware from Chinese companies deemed national security risks. The DeepSeek order is the AI-specific entry in that same playbook.
What's different about AI is the supply chain is harder to seal. Hardware has physical choke points — ports, chips, certification labs. Models are weights and API calls, replicable and reroutable. A federal agency can block DeepSeek's domain. It can't easily stop an employee from pasting classified-adjacent text into a browser tab pointed at a proxy. The order acknowledges this indirectly, telling agencies to monitor "the flow of traffic in and out" and detect anomalous activity during the removal period. That's an admission that technical controls alone won't solve it.
What to watch next
The 60-day exception window will tell us how deeply DeepSeek had penetrated federal workflows. If multiple agencies file for exceptions — especially defense-adjacent civilian agencies — that reveals a dependency the government didn't want to admit. If no one files, the adoption was always shallow.
Watch also whether other Five Eyes allies (UK, Canada, Australia) follow with similar designations. FASCSA is U.S.-only, but the "data transfers to China" rationale translates easily to allied procurement frameworks. A coordinated ban would turn DeepSeek from a pricing disruptor into a geopolitically untouchable asset in Western enterprise markets.
And watch DeepSeek's response. The company has been quiet so far. If it responds by offering a U.S.-hosted or U.S.-sovereign deployment option — as some Chinese hardware companies have done to skirt procurement bans — that would be the most interesting outcome of all, because it would mean the order achieved its economic goal without DeepSeek ever admitting it.
No comments yet