DeepSeek federal ban covers civilian agencies, not the public
DHS signed the order in July and made it public Monday; it reaches tools built on DeepSeek but never mentions open-weight models.
The Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove them, plus third-party tools "developed using DeepSeek implementations," from their IT systems, according to a Federal Register notice published Tuesday (Oct. 20).
Homeland Security Secretary Markwayne Mullin signed Exclusion and Removal Order #2026-01, which carries a July 24 release date, and it took effect "immediately after issuance," according to the signed order. It wasn't public until the notice was filed for public inspection at 8:45 a.m. ET Monday (Oct. 19).
"DeepSeek's models present multiple threat vectors," the order said. It cites DeepSeek's servers in China, where "the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure."
The order doesn't define "DeepSeek implementations" or say whether it covers DeepSeek's open-weight models run on agency hardware. DHS hasn't said why the July order took nearly three months to become public, or whether any agency asked to be exempted.
DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA, 41 U.S.C. 1321–1328), which lets the Homeland Security secretary issue exclusion or removal orders for federal civilian agency systems, the order said. DHS said it acted after reviewing a recommendation from the Federal Acquisition Security Council, which hasn't been made public.
Is DeepSeek banned in the US?
Not for most people. Every required action in the order is addressed to "civilian agencies." Nothing in it covers consumers, app stores, private companies, or state and local governments.
Even inside the government, it's narrower than "federal ban" suggests. It applies to "Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems."
The Defense Department, which the order calls the "Department of War," and the Office of the Director of National Intelligence are outside DHS's authority here. Congress separately ordered DeepSeek removed from intelligence community national security systems in a law signed Dec. 18, 2025.
For civilian agencies, the exclusion covers buying channels as well as contracts, including "agency-approved products lists, service provider equipment lists, e-commerce markets." It also covers DeepSeek's affiliates, meaning companies that control it, that it controls, or that share an owner with it.
What the DeepSeek federal ban leaves unclear
The biggest open question is the third-party clause. Agencies must remove "third-party products and services developed using DeepSeek implementations," the order said, but it never says whether that includes products that run, fine-tune or distill a DeepSeek model.
The order separates "DeepSeek-hosted instances of their models" from a broader warning that "the models themselves may contain malware or other security vulnerabilities." In EngineerPal's reading, that suggests self-hosted DeepSeek weights on agency systems may be meant to be covered. The order doesn't say so.
The order binds agencies, not vendors, and doesn't mention federal contract clauses or contractor reporting. In EngineerPal's view, vendors selling to civilian agencies should check whether any feature calls DeepSeek's API or embeds its weights. Developers using DeepSeek's models elsewhere face no new restriction from this order.
The exception process is also oddly timed. Only agencies, not vendors, could ask DHS, through the Cybersecurity and Infrastructure Security Agency (CISA), for an exception, and the order said requests "must be submitted in writing within 60 days of the issuance of this order."
By EngineerPal's count, 60 days from July 24 ended around Sept. 22, weeks before the public saw the order. The order doesn't say whether agencies were told privately in July, and no exceptions have been made public.
DHS's case rests on older sources. The newest one the order cites dates from August 2025, and the only specific vulnerability it names is in DeepSeek's iOS app, not its models. Its malware warning says only that the models "may" contain it.
The order requires DHS to review it within one year "and annually thereafter." CISA is taking questions at [email protected], the order said.
