The U.S. Department of Homeland Security ordered federal civilian agencies on October 19, 2026, to strip DeepSeek products out of their information-technology systems, a move that turns months of warnings about the Chinese AI startup into a binding procurement rule. The notice, published in the Federal Register, also bars agencies from buying any third-party product or service built on DeepSeek’s models, closing a loophole that let government contractors route around earlier, narrower restrictions.
DHS said the exclusion covers Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated entities, and it invoked the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA) to do it. That law gives the Federal Acquisition Security Council the power to recommend removal of specific vendors from the federal supply chain when they’re judged a security risk, and this is one of its more visible uses against a named AI company. Bloomberg reported that the action lands as DeepSeek’s cheaper, open-weight models keep applying price pressure on Silicon Valley’s frontier labs, which is part of why this particular order is getting outsized attention in both Washington and the AI industry.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the DHS Order Actually Says
The signed document is formally titled the FASCSA Exclusion and Removal Order #2026-01, filed under docket number DHS-2026-0628 on Regulations.gov. Three operative instructions sit inside it. First, federal civilian agencies must remove DeepSeek products from their IT systems. Second, that removal requirement extends to any third-party product or service that was developed using DeepSeek’s model or its underlying implementations, meaning a vendor repackaging DeepSeek under a different brand doesn’t escape the order. Third, agencies are now prohibited from acquiring DeepSeek products going forward, and from acquiring third-party offerings built on DeepSeek technology.
DHS framed the justification in blunt terms, saying DeepSeek’s models present “multiple threat vectors” and warning that use by government employees or contractors “may result in the transfer of sensitive data to the PRC.” Those are the two load-bearing claims in the notice, and they mirror language DHS and other agencies have used before against Chinese hardware and software vendors, just applied this time to a large language model rather than a router or a camera.
Reuters’ reporting, carried by Channel News Asia, notes the order is specific to civilian agency systems, not a universal ban covering state governments, private businesses, or foreign governments. That distinction matters for anyone trying to gauge the order’s real-world reach: it reshapes federal procurement, but it doesn’t, by itself, touch the commercial DeepSeek API market or consumer use of the DeepSeek app.
The Legal Mechanism: FASCSA and the Federal Acquisition Security Council
FASCSA isn’t a new law, and that’s precisely why this order carries weight. Congress passed the Federal Acquisition Supply Chain Security Act in 2018 to give the government a structured way to exclude or remove specific sources from federal supply chains when there’s a documented security concern, without having to legislate a new ban every time a risky vendor turns up. The law created the Federal Acquisition Security Council (FASC), a cross-agency body that reviews evidence and issues removal or exclusion orders that other agencies are then bound to follow.
According to the notice, DHS acted on a recommendation from the Federal Acquisition Security Council following a review of evidence related to DeepSeek. That’s a meaningful detail because it means the order isn’t a unilateral DHS judgment call. It went through the interagency review process FASCSA was designed to create, which is also why it specifically names the corporate entity, Hangzhou DeepSeek Artificial Intelligence Co., Ltd., rather than just referring loosely to “DeepSeek the product.” Naming the legal entity and its covered affiliates is standard FASCSA practice, intended to prevent the targeted company from dodging the order through a rebrand or a shell subsidiary.
This is the same legal architecture Washington previously used against Huawei, ZTE, Kaspersky Lab, and a handful of Chinese surveillance-camera makers. DeepSeek is now the most prominent AI company to be processed through that pipeline, and it sets a template other agencies could point to if they want to exclude additional Chinese AI vendors down the line.
Why DHS Says DeepSeek Poses a Risk
The notice’s core risk claim, that DeepSeek use “may result in the transfer of sensitive data to the PRC,” echoes a concern security researchers have raised about DeepSeek since its January 2025 debut: that prompts, documents, and other inputs routed through DeepSeek’s hosted infrastructure could be stored or processed in a way that’s accessible to the Chinese government under its national security and data laws. That’s a structural concern about jurisdiction and data residency rather than a claim about a specific breach or leak, and the DHS notice doesn’t cite a single incident; it cites “multiple threat vectors” in the abstract.
That framing is consistent with how Washington has treated other Chinese-origin software, including TikTok, where the policy argument has centered on data access and foreign-government leverage rather than a documented breach. The difference with an AI model is the breadth of what flows through it: an LLM used inside a federal agency could touch anything from draft policy memos to procurement data to internal communications, depending on how deeply it’s integrated, which is why the removal order casts a wide net across “information technology systems” rather than naming a narrower category of use.
DeepSeek’s Rapid Rise and Its Newest Model
The timing is notable because DHS’s order lands just two days after DeepSeek shipped an update to its flagship efficient model. On October 17, 2026, DeepSeek released V4.1-Flash-1017, an update to V4-Flash that the company says improves benchmark performance and shortens both task runtimes and output length, all while leaving its published API pricing unchanged. DeepSeek said the update needs only one-quarter of the high-bandwidth memory for its key-value cache and one-eighth of the SSD storage that V4-Flash required, building on a separate fourfold KV-cache reduction the company announced on September 10.
Those efficiency gains are a big part of why DeepSeek keeps showing up in U.S. policy conversations. Our earlier coverage of the V4.1-Flash-1017 MIT-licensed release detailed how the company has repeatedly cut compute and memory requirements while holding prices flat, a pattern that has rattled parts of the memory-chip market and pressured rival labs to defend their own pricing. The DHS order doesn’t address any of that technical efficiency directly, but it arrives at a moment when DeepSeek’s cost advantage is precisely why its models have been finding their way into third-party products, government-adjacent vendor tools, and enterprise pilots that the new rule is now designed to block at the federal level.
Historical Context: A Pattern of Restrictions, Not a First Move
Monday’s order is the latest step in a longer sequence rather than a bolt from nowhere. DeepSeek’s January 2025 release of its R1 reasoning model triggered a sharp selloff in AI-linked stocks and immediately drew scrutiny from U.S. officials over training costs, data practices, and possible export-control implications. In the time since, various federal agencies, the U.S. Navy among them, and a number of state governments restricted employee use of the DeepSeek app on official devices, according to earlier reporting, well before Monday’s FASCSA order made exclusion a formal procurement rule rather than an internal usage policy.
The broader trade relationship has been moving in the same direction. Beijing has pushed its own tech-export restrictions covering dozens of technology categories, a policy we tracked when China’s AI export rule took effect covering roughly 40 technology categories, and again when China mirrored U.S. export bans with its own hit list. The DHS order against DeepSeek fits that same tit-for-tat rhythm: U.S. restrictions on Chinese AI and hardware access, paired with Chinese restrictions on advanced technology leaving the country, each side treating the other’s technology stack as a strategic liability rather than just a commercial product.
Competitive Landscape: DeepSeek’s Place in the US-China AI Race
DeepSeek built its reputation on being the cheapest credible option among frontier-adjacent models, consistently undercutting OpenAI, Anthropic, and Google on per-token API pricing while publishing open weights that let developers self-host rather than depend on a hosted API at all. That combination is exactly what made it attractive to budget-constrained government contractors and smaller agencies in the first place, and exactly why the removal order matters more than a symbolic gesture: it closes off a genuinely cost-competitive option, not a niche one.
On the U.S. side of the ledger, Anthropic’s Claude, OpenAI’s latest GPT line, and Google’s Gemini models remain the default choices inside federal agencies that already have FedRAMP-authorized deployments, and none of them carry the same PRC-data-transfer concern DHS cited against DeepSeek. We compared the pricing gap directly in our look at Grok 4.7 vs. Claude vs. DeepSeek, where DeepSeek’s per-token cost advantage over its closed-source rivals was stark enough to explain why procurement officers kept gravitating toward it despite the security chatter. That price gap is also the backdrop for why this order could ripple beyond Washington: any enterprise vendor that built a product on DeepSeek to stay cheap now has to explain to federal customers why their stack is suddenly out of bounds.
Federal Agencies’ AI Posture By the Numbers
The DHS order doesn’t exist in a vacuum; it lands inside a federal AI landscape that’s already expanding fast and already anxious about security. Survey data from Ernst & Young and Market Connections found that nearly three-quarters of federal government IT decision-makers intend to expand the use of AI for cybersecurity over the next one to three years, a trend documented in the EY Federal AI and Cyber Research Report. The same EY research, published in its 2025 Government Federal Trends Report, found that 46% of federal IT decision-makers say their agency already uses generative AI today, and that 68% say legacy systems pose a security risk to their agency, a backdrop that helps explain why a supply-chain exclusion order carries real operational weight rather than just a political signal.
That anxiety isn’t confined to government. CDW’s Artificial Intelligence Research Report, cited by FedTech Magazine, found that 55% of IT leaders and decision-makers across industries say their organization is currently using AI to improve cybersecurity, meaning the removal of one widely adopted, low-cost model doesn’t just affect agencies directly, it affects the broader vendor ecosystem that sells AI-enabled security and productivity tools into those agencies.
Market Impact: Who Actually Gets Hit
The most immediate effect falls on federal systems integrators and software vendors who quietly built DeepSeek into backend pipelines to keep inference costs down. Those vendors now have to re-architect or swap models for any government-facing product, a nontrivial engineering lift when a tool has been tuned around a specific model’s behavior and pricing. Expect a scramble among federal contractors in the coming weeks to audit their own supply chains for any DeepSeek dependency, not because DHS is actively hunting individual contracts yet, but because the order’s third-party language means liability now sits with whoever sold the product, not just whoever bought it.
DeepSeek itself loses access to a government market it likely never expected to win outright, given export-control sensitivities, but the commercial fallout is probably limited. Most of DeepSeek’s actual usage volume runs through enterprise API calls and self-hosted open-weight deployments outside the federal government, areas this order doesn’t touch. The bigger question is reputational: a formal FASCSA exclusion gives every risk-averse enterprise buyer, not just federal ones, a new data point to cite when a security team wants to veto a DeepSeek integration.
Timeline: From DeepSeek’s Debut to the Federal Ban
| Date | Event | Significance |
|---|---|---|
| January 2025 | DeepSeek releases R1 reasoning model, triggering a selloff in AI-linked stocks | First time DeepSeek became a mainstream US policy concern |
| 2025 (various) | Some federal agencies and state governments restrict employee use of the DeepSeek app on official devices | Informal usage restrictions precede any procurement-wide rule |
| September 10, 2026 | DeepSeek announces a fourfold reduction in KV-cache memory requirements | Deepens the company’s cost and efficiency lead over rivals |
| October 17, 2026 | DeepSeek ships V4.1-Flash-1017, cutting HBM and SSD requirements further | Reinforces DeepSeek’s low-cost positioning days before the ban |
| October 19, 2026 | DHS issues FASCSA Exclusion and Removal Order #2026-01 (docket DHS-2026-0628) | First binding procurement-wide removal order against DeepSeek |
Federal AI Adoption and Security Sentiment
| Metric | Figure | Source |
|---|---|---|
| Federal IT leaders planning to expand AI use for cybersecurity (1-3 years) | ~75% | EY / Market Connections, Federal AI and Cyber Research Report |
| Federal IT decision-makers whose agency already uses generative AI | 46% | EY, 2025 Government Federal Trends Report |
| Federal IT decision-makers who say legacy systems pose a security risk | 68% | EY, 2025 Government Federal Trends Report |
| Federal IT decision-makers concerned AI threats evolve faster than defenses | 78% | EY, 2025 Government Federal Trends Report |
| Cross-industry IT leaders using AI to improve cybersecurity | 55% | CDW Artificial Intelligence Research Report, via FedTech Magazine |
Industry and Analyst Reaction
Reaction so far splits along predictable lines. National-security hawks in Congress have pushed for exactly this kind of formal exclusion since DeepSeek’s 2025 debut, and they’re treating Monday’s order as overdue rather than surprising. AI-market commentators, meanwhile, are more focused on what the order does and doesn’t change for DeepSeek’s broader trajectory. Commentary cited by MarketScreener’s coverage of the Reuters report frames the action as targeted specifically at civilian-agency systems and procurement, not a sweeping commercial ban, a distinction that’s shaping how analysts are modeling the limited direct revenue impact on DeepSeek itself.
Some financial commentary has pushed back on reading too much into DeepSeek’s efficiency claims as a verdict on the broader AI memory-chip trade, arguing the KV-cache reduction numbers are being overinterpreted by markets that are already skittish about AI infrastructure spending. That skepticism, paired with the federal ban, creates a strange split-screen moment for DeepSeek: a company simultaneously shipping genuinely efficient new models and getting formally locked out of a major government market in the same week, covered by Quartz’s reporting on the exclusion order.
What Happens Next for Federal Contractors
Federal contractors now face a compliance deadline problem even though the order itself doesn’t specify one publicly. FASCSA removal orders typically require agencies to inventory affected systems and report remediation progress to the Federal Acquisition Security Council, which means the real-world timeline will likely be set by follow-up guidance from the General Services Administration and individual agency CIOs rather than the order’s text alone. Contracting officers reviewing active task orders will need to confirm, case by case, whether any subcontracted AI service touches a DeepSeek model, directly or through a reseller.
That audit burden is likely to be uneven across agencies. Larger departments with mature AI governance programs, the kind reflected in that 46% generative-AI adoption figure from EY’s federal survey, probably already maintain a model-level inventory and can comply quickly. Smaller agencies and components that adopted AI tools more informally face a harder scramble, and some of that friction could show up as delayed modernization projects over the next two to three fiscal quarters rather than an immediate, visible disruption.
The China Response and What It Signals
Beijing hasn’t issued a direct, confirmed response to this specific order as of this writing, but the broader pattern of reciprocal technology restrictions suggests one is plausible. China’s government has already shown it will mirror U.S. export and procurement restrictions rather than simply absorb them, a dynamic visible in its own rare-earth and technology export rules. If that pattern holds, a formal, named exclusion of a flagship Chinese AI company from the U.S. federal market gives Beijing fresh justification to tighten its own restrictions on American AI firms operating in or selling into China, continuing a cycle that has defined the broader US-China tech relationship since well before this specific order.
Predictions: Where This Goes From Here
- Expect at least one additional Chinese AI or cloud vendor to face a similar FASCSA exclusion review within the next two quarters, now that the legal template has been used successfully against a named AI company.
- State and local governments that haven’t already restricted DeepSeek will likely face renewed pressure to adopt parallel rules, citing the federal order as precedent even though it doesn’t bind them directly.
- Federal systems integrators will quietly accelerate migration of any DeepSeek-dependent tools toward FedRAMP-authorized alternatives from Anthropic, OpenAI, and Google, treating this order as a compliance wake-up call rather than waiting for enforcement action.
- DeepSeek’s enterprise and developer-facing business outside government is unlikely to see a comparable near-term disruption, since the order is scoped to federal procurement rather than commercial API access.
- Watch for Beijing to respond with its own named exclusion of a U.S. AI vendor from Chinese state procurement, continuing the reciprocal pattern already visible in export-control policy on both sides.
Frequently Asked Questions
What did DHS actually order on October 19, 2026?
DHS ordered U.S. federal civilian agencies to remove DeepSeek products from their information-technology systems and barred agencies from acquiring DeepSeek products or third-party products and services built using DeepSeek models.
What law gives DHS the authority to issue this order?
The order was issued under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), following a recommendation from the Federal Acquisition Security Council.
Which company is named in the order?
The order identifies Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and covered affiliated entities.
Does this ban affect private companies or individual consumers using DeepSeek?
No. The order is specific to U.S. federal civilian agency IT systems and procurement; reporting on the order notes it does not establish a ban covering state governments, private companies, or foreign governments.
Why does DHS say DeepSeek is a risk?
DHS said DeepSeek’s models present “multiple threat vectors” and warned that use by government employees or contractors may result in sensitive data being transferred to the People’s Republic of China.
What is DeepSeek’s newest model as of this order?
DeepSeek released V4.1-Flash-1017 on October 17, 2026, an update that the company says improves benchmark performance and reduces memory and storage requirements compared with the earlier V4-Flash model.
Where can I find the official order?
The order was published in the Federal Register and is identified as the FASCSA Exclusion and Removal Order #2026-01, filed under docket number DHS-2026-0628 on Regulations.gov.
Has this kind of order been used against other companies before?
Yes. FASCSA-based exclusion and removal authority has previously been applied to other companies deemed security risks, including Chinese telecom and surveillance-hardware vendors, though this is among the most prominent uses of that authority against a named AI company.
