All Reports

DHS Orders Federal Civilian Agencies to Remove DeepSeek AI From Their Systems, Federal Register Notice Says

Bot Mutiny | October 21, 2026

The Department of Homeland Security has ordered federal civilian agencies to stop buying products and services from the Chinese AI company DeepSeek and to remove them from their information technology systems, according to a notice published in the Federal Register on October 20, 2026. The order also reaches "third-party products and services developed using DeepSeek implementations," the notice says. TechCrunch reported the order the same day.

The notice announces an order issued under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328), "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence." The signed order, printed in the notice's appendix as Exclusion and Removal Order #2026-01, lists an original release date of July 24, 2026. It is issued by Homeland Security Secretary Markwayne Mullin, with a copy to Russell Vought, director of the Office of Management and Budget. The Federal Register notice itself is signed by DHS General Counsel James H. Percival II.

What the order requires

The order applies to federal civilian executive branch agencies. It does not apply to their national security systems or to secure compartmented information systems. It directs agencies to do two things.

First, exclude DeepSeek, its affiliated entities and their products from procurement, "effective immediately after issuance of this Order." The order says this covers agency-approved product lists, service provider equipment lists and e-commerce markets. Second, remove DeepSeek products, affiliate products and third-party products and services built on DeepSeek implementations from agency systems "immediately after the issuance of the Order, or seek an Exception."

The risks DHS cites

The order's "Summary of Risks from Source" section describes DeepSeek as "a foreign, privately-owned company, located in the People's Republic of China" and says "DeepSeek servers are located in the PRC." It says the PRC legal system "permits extensive authority to government cyber and intelligence functions to access private company infrastructure."

According to the order, account creation on DeepSeek-hosted instances "collects personally identifiable information (PII) and may also track and digitally fingerprint users." It says prompts entered into DeepSeek's applications "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors," and that such data "could produce actionable intelligence on U.S. persons and/or government programs." The order adds that "The models themselves may contain malware or other security vulnerabilities," and cites open-source security research that it says found the DeepSeek iOS app "contains multiple critical vulnerabilities."

These are DHS's stated assessments. The order's footnotes cite sources including DeepSeek's privacy policy, a House select committee report and a NowSecure analysis of the DeepSeek iOS app. TechCrunch reported that DHS raised concerns about DeepSeek's handling of user data, warning that sensitive information from U.S. government users could be accessible to Chinese authorities under Chinese law.

Exceptions and interim steps

Agencies may request an exception in writing "within 60 days of the issuance of this order." Requests must include "compelling justification," such as the effect of the order on an agency's ability to carry out mission-critical functions or national interest considerations, along with any alternative mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) will review requests and provide written approval or disapproval. The notice does not say how the 60-day window is counted against the July 24 release date.

Until DeepSeek products are fully removed, the order says agencies "are encouraged" to take steps such as monitoring traffic in and out of the agency, adding logging and controls on data exfiltration, and flagging anomalous activity.

China's response and earlier U.S. action

TechCrunch reported that Chinese Foreign Ministry spokesperson Mao Ning said Beijing opposes "overstretching the concept of national security and politicizing technology and trade issues," and added: "We will resolutely safeguard the legitimate rights and interests of Chinese enterprises." Neither the Federal Register notice nor TechCrunch's report includes a statement from DeepSeek.

TechCrunch also reported that a law passed in December 2025 targeted DeepSeek's use in what it described as intelligence's national security systems, and that the new order extends restrictions to federal civilian agencies, covering new purchases and existing IT systems.

Separately, a joint advisory from the National Security Agency, CISA and the FBI released on September 8, 2026 said that DeepSeek and five other China-based AI companies, "likely with Chinese government awareness," extracted "billions of tokens across millions of exchanges/requests from U.S. frontier AI models" since at least late 2024. The agencies described the activity as malicious distillation. Distillation is a technique that uses one model's outputs to train another. The DHS order does not cite that advisory.