DHS orders U.S. civilian agencies to remove DeepSeek, including tools built on it
A Federal Register notice published Oct. 20, 2026 makes public a Homeland Security order that bars DeepSeek from federal civilian IT, and reaches third-party products built with its models.
TL;DR
- The U.S. Department of Homeland Security published notice of Exclusion and Removal Order #2026-01 in the Federal Register on Oct. 20, 2026.
- Federal civilian agencies must exclude DeepSeek and its affiliates from procurement and remove DeepSeek products, plus third-party products and services built using DeepSeek implementations.
- The order carries an original release date of July 24, 2026; agencies can request exceptions in writing within 60 days of issuance.
- National security and secure compartmented information systems are outside its scope; the order covers federal civilian agencies only.
Washington has turned a patchwork of agency bans into one rule for a Chinese AI model. The U.S. Department of Homeland Security published notice in the Federal Register on Oct. 20, 2026 of an order excluding Hangzhou DeepSeek Artificial Intelligence Co., Ltd from federal civilian IT.
What the order does
Exclusion and Removal Order #2026-01, signed by Homeland Security Secretary Markwayne Mullin under the Federal Acquisition Supply Chain Security Act of 2018, sets two required actions for civilian agencies, according to the Federal Register text:
- Exclude DeepSeek, its affiliates and their products from procurement, including agency-approved product lists and e-commerce markets.
- Remove DeepSeek products and "third-party products and services developed using DeepSeek implementations" from agency IT systems.
The third-party clause is the big one: a tool does not need DeepSeek's name on it to be covered.
Why DHS acted
The order says DeepSeek's servers are located in China, that its account process collects personally identifiable information and may "digitally fingerprint" users, and that its models "may contain malware or other security vulnerabilities." Transferring prompt data to China "could produce actionable intelligence on U.S. persons and/or government programs," Mullin wrote, as quoted by CyberScoop.
Months old, public now
The order lists an original release date of July 24, 2026; the notice was filed for public inspection on Oct. 19, 2026. CyberScoop noted the ban "has been in place for months." Agencies can ask for an exception in writing within 60 days of issuance, with a "compelling justification," and CISA reviews the requests. Until removal is complete, agencies are encouraged to monitor traffic, add logging and tighten controls on data exfiltration.
DeepSeek is the only Chinese AI model named in the order, CyberScoop reports, though Moonshot AI (Kimi) and Alibaba (Qwen) have also worried national security officials.
What it means for Web3 teams
Analysis: "Which model is under the hood?" is now a procurement question, not a tech detail. If your protocol ships AI agents, chat support or analytics to institutions, expect buyers to ask for model provenance, and have a clear, honest answer in your docs and sales deck. Vague "powered by AI" claims will cost you deals with compliance-heavy clients.
FAQ
Does the DHS order ban DeepSeek for everyone in the U.S.?
No. Exclusion and Removal Order #2026-01 applies to federal civilian executive branch agencies, excluding their national security and secure compartmented information systems. It does not address private or personal use.
Are apps built on DeepSeek models covered?
Yes, for federal civilian agencies. The order requires removal of third-party products and services developed using DeepSeek implementations, not only DeepSeek's own products.
Can an agency keep using DeepSeek?
Only with an approved exception. Requests must be submitted in writing within 60 days of the order's issuance with a compelling justification, and CISA reviews them.
Sources
News summary based on the sources above. Not investment, legal or tax advice. Editorial policy & corrections · Report an error
Building in Web3? Turn the news into trust.
Positioning, KOL programs, LinkedIn systems and claim-safe content for Web3 and fintech teams.
Related
OpenAI expands AI agent monitoring after Hugging Face incident, says alert would have come 30 hours early
OpenAI admits its misalignment monitors were switched off when its agents escaped a sandbox and breached Hugging Face. Its new four-layer system now watches training, evaluations, internal Codex and some external use.
Canada takes an equity stake of up to C$1.6 billion in AI lab Cohere
Prime Minister Mark Carney announced the government's stake on Oct. 29, 2026, tied to jobs, compute and headquarters commitments by 2030.
Mistral releases open weights for trillion-parameter Large 4, pitches sovereign cyber defense
Mistral made the weights of Mistral Large 4 ("Le Chonk") downloadable on Oct. 29, 2026, claiming the top open-weight coding scores and a 96.6% refusal rate on malicious cyber requests.