DeepSeek Federal Ban: Who It Covers and What to Do Now

DeepSeek federal ban key facts: DHS order bars federal civilian agencies from buying DeepSeek, removal covers third-party tools built on DeepSeek, Pentagon and personal use not covered, exception requests within 60 days

DeepSeek is now banned across U.S. federal civilian agencies: a Homeland Security order bars them from buying DeepSeek products and requires them to remove DeepSeek tools, including third-party products "developed using DeepSeek implementations." It does not cover the Pentagon or your personal use of the app. If you run IT at a civilian agency or sell software to one, the 7 steps below show what to check and do now.

The order was signed in July but only made public this week. Its widest clause, the one covering third-party products, is also the vaguest: a security expert told The Register there is no practical way for vendors to prove that nothing they rely on ever touched DeepSeek.

What happened

On Monday, October 19, the Department of Homeland Security made public an order signed by Secretary Markwayne Mullin, and the Federal Register formally published it on Tuesday, October 20, 2026. The order itself, Exclusion and Removal Order #2026-01, lists an original release date of July 24, 2026, and was issued under the Federal Acquisition Supply Chain Security Act of 2018. CNBC reports that it covers agencies including the Treasury, State and Justice departments, but not the Department of Defense.

The order has two parts. Agencies must exclude DeepSeek and its affiliates from purchases, including approved-product lists and e-commerce markets, "effective immediately." They must also remove products from DeepSeek, its affiliates and third parties that were built using DeepSeek implementations, or seek an exception.

Who the DeepSeek ban covers

Here's who is in and out, based on the signed order, the federal rule it relies on and news reports.

Who	Covered by this order?	What it means
Federal civilian agencies (e.g. Treasury, State, Justice)	Yes	Stop buying DeepSeek products; remove DeepSeek and DeepSeek-based tools or seek an exception
Their national security and compartmented (SCI) systems	No	The order excludes them; they fall under the Defense Secretary or intelligence chief
Department of Defense	No	Not in this order; its IT agency began blocking DeepSeek in January 2025, CNBC reported, citing Bloomberg
Contractors serving civilian agencies	Indirectly	Exclusions apply to prime contractors and subcontractors at any tier; removal can reach systems run for an agency
Private companies and individuals	No	The order covers federal civilian agency IT and purchases, not private or personal use

The contractor row comes from the federal rule the order relies on, 41 CFR 201-1.303, which says removal can apply to systems "operated by a contractor on behalf of an agency."

What to do now: 7 steps for agencies and vendors

These steps follow the order's text. Where a step is our advice rather than DHS's, we say so.

Confirm you're in scope. The order applies to federal civilian executive branch agencies, except their national security systems and secure compartmented information systems. If you sell to those agencies, assume your products will be asked about.
List every DeepSeek touchpoint. Include the DeepSeek app and API, DeepSeek models you host yourself, and any third-party tool that runs on a DeepSeek model. Our advice: record fine-tuned or distilled versions too, since The Register notes the order doesn't define "developed using."
Check your AI gateways. The Register warns that routers such as OpenRouter and Vercel AI Gateway may serve DeepSeek models to users who never meant to pick them. Pin approved model IDs, drop DeepSeek models from fallback lists, and use the router's own controls: OpenRouter's docs describe allowed and ignored provider lists per request and account-wide.
Stop new purchases. The exclusion took effect immediately and covers approved-product lists, equipment lists, e-commerce markets and similar buying channels.
Remove it, or request an exception. Agencies can ask DHS for an exception, such as a delay. The request must be in writing, within 60 days of the order's issuance, and must name the order, the product, the exception sought, a compelling justification and any alternative mitigations. Send it to FASCSA.Orders@cisa.dhs.gov. If that clock started on July 24, it ran out around September 22 by our count, so ask CISA directly.
Lock things down until removal is done. The order encourages agencies to monitor traffic in and out, add logging and data-exfiltration controls, and flag unusual activity. CISA may provide technical help to agencies that lack the skills in-house.
Vendors: prepare a clear answer. Our advice: write down which models your product calls, where they're hosted and whether any are DeepSeek-based, so your agency customers can make their own call.

Why it matters

The order's risk summary says DeepSeek's servers are in China, its account process collects personal data and may fingerprint users, and prompts sent to its models could move sensitive government data to China. It also says the models "may contain malware or other security vulnerabilities," citing flaws researchers found in DeepSeek's iOS app.

The scope is wide and vague: Katie Moussouris, CEO of Luta Security, told The Register that banning DeepSeek's own app and API is workable, but that "There's no practical way to verify" a vendor's claim that nothing it relies on ever touched DeepSeek.
It may reach U.S.-hosted copies: Moussouris also said applying the order to DeepSeek models hosted in the U.S. goes too far, since most of the cited risks concern data flowing to servers in China.
It formalizes earlier bans: CNBC lists earlier limits at the Defense Information Systems Agency, Commerce Department bureaus and the intelligence community. Heise notes China itself recently drafted AI export controls.

China's foreign ministry said it opposes "the politicization of science, technology and trade issues," according to Reuters, as cited by CNBC.

Quick answers

Is DeepSeek banned in the US?

Not for the public. This order covers federal civilian agencies' IT systems and purchases only.

Can I still use DeepSeek's app or models?

The order doesn't address personal or private-company use. If you're comparing DeepSeek's latest model, see our DeepSeek V4.1 Flash 1017 breakdown.

What can agencies use instead?

The order doesn't name replacements. For a rival in the same price range, our MiniMax M3.1 Flash vs DeepSeek comparison covers prices and benchmarks.

What's next

The Register reported that DHS didn't immediately respond to questions, so watch for CISA guidance on what "developed using DeepSeek implementations" means and how it treats AI gateways. The Defense Department and the intelligence community would need their own orders to apply similar rules. DHS must review this order within one year and every year after that, and under federal rules a modified order can't be broader than the original.

FAQ

When was the DeepSeek federal ban issued?

The order, Exclusion and Removal Order #2026-01, lists an original release date of July 24, 2026. DHS made it public on Monday, October 19, and it was formally published in the Federal Register on Tuesday, October 20, 2026.

Does the DeepSeek ban apply to the Pentagon?

No. This order covers federal civilian executive branch agencies. Federal rules give the Defense Secretary and the Director of National Intelligence separate authority over the Defense Department, the intelligence community and national security systems.

How can an agency get an exception to the DeepSeek order?

Only executive agencies can ask. The request must be in writing, sent within 60 days of the order's issuance, and must name the order, the product and the exception sought, with a compelling justification and any alternative mitigations. Requests go to FASCSA.Orders@cisa.dhs.gov.

Why did DHS ban DeepSeek?

The order says DeepSeek's servers are in China, its account process collects personal data and may fingerprint users, and prompts could move sensitive data to China. It also says the models may contain malware or other vulnerabilities, citing flaws researchers found in DeepSeek's iOS app.

Search This Blog

The Frontier Brief