Core Requirements of the Order
The U.S. Department of Homeland Security (DHS) has published notice of Exclusion and Removal Order #2026-01, an order concerning DeepSeek products in federal civilian executive branch information technology and procurement.
The notice describes two required actions for covered agencies:
- Exclude information-technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek), including affiliated entities as defined by the applicable regulations, from federal civilian agency procurements.
- Remove DeepSeek and DeepSeek-affiliate products, as well as third-party products and services developed using DeepSeek implementations, from civilian agency information technology.
The Federal Register notice was published on October 20, 2026. Its appendix identifies July 24, 2026 as the order’s original release date. That timing matters: the October notice publicizes an existing order; it should not be treated as a newly created rule that starts all compliance clocks on the publication date. Federal Register document 2026-21447
Covered Agencies and Systems
The order applies to Federal Civilian Executive Branch Agencies, except for their national security systems and secure compartmented information systems. The notice cites the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), 41 U.S.C. 1321–1328, and its implementing regulations as the authority for the action.
This scope creates important boundaries. The notice does not itself announce a prohibition for every U.S. government entity, every private company, or every user of an open-weight model. It addresses covered federal civilian procurement and civilian-agency IT systems. Other obligations can arise from different laws, contracts, agency policies, or jurisdictions, but they should not be inferred from this order alone.
| Question | What the order establishes | What it does not establish |
|---|---|---|
| Who must act? | Covered federal civilian executive branch agencies | A universal rule for all public and private organizations |
| What environment is addressed? | Civilian-agency procurement and information technology | Every use of DeepSeek-related technology everywhere |
| What systems are outside this order’s stated scope? | Covered agencies’ national security and secure compartmented information systems | That those systems are free from other, separate restrictions |
Procurement Exclusion and IT Removal
The order is both forward-looking and corrective. Those functions require different evidence and different owners.
| Requirement | What the order says | Where teams should look |
|---|---|---|
| Exclude | Keep DeepSeek, affiliated entities, and their products out of civilian-agency procurement, effective immediately after issuance; the order references approved product lists, service-provider equipment lists, e-commerce markets, and similar procurement functions | Supplier qualification, catalogs, marketplaces, purchasing controls, renewals, and subcontractor terms |
| Remove | Remove DeepSeek and affiliate products, plus third-party products and services developed using DeepSeek implementations, from civilian-agency IT systems, or seek an exception | Deployed software, managed services, integrations, AI features, component inventories, and delivered environments |
In other words, an organization cannot address the order only by blocking a future purchase. It also needs a way to identify what is already running or embedded in the relevant technology environment.
Scope for Third-Party Software Providers
The third-party language is the operationally important part for many vendors. The removal requirement explicitly reaches “third-party products and services developed using DeepSeek implementations.” A procurement footnote also states that procurement coverage includes third-party DeepSeek implementations used to provide products and services to civilian agencies. Signed order appendix
That does not mean DHS has named every third-party product that might fall within the phrase. The notice does not provide a public vendor list, nor does it define every technical arrangement that counts as a “DeepSeek implementation.” It would be inaccurate to say that any product with a speculative or incidental connection has already been individually designated.
For suppliers, however, the practical diligence question expands beyond a brand-name scan. A meaningful inventory may need to cover:
- Direct model API calls and managed-inference relationships
- Model weights or packaged model components
- SDKs, libraries, and feature modules supplied by another vendor
- Outsourced AI functions and subcontractor deliverables
- Product documentation and contractual statements about underlying model dependencies
Whether a particular architecture falls within the order must be assessed against the actual implementation, contract, and applicable agency guidance—not guessed from marketing language.
Effective Date and Exceptions
The order states that exclusion from procurement takes effect immediately after issuance. It also calls for covered products to be removed from civilian-agency IT immediately after issuance, unless an agency seeks an exception.
The exception process described in the order permits an executive agency to request that the order not apply to the agency, to particular actions, or to delay compliance. Requests must be submitted in writing within 60 days of issuance and include the relevant covered item, the exception sought, a compelling justification, and proposed alternative risk mitigations. The order says CISA will review requests and provide a written approval or disapproval.
Because the appendix dates the original release to July 24, while the notice appeared publicly in October, publication should not automatically be treated as a fresh 60-day request window. Questions about a specific agency’s status, an existing contract, or the availability of late relief belong with the order’s designated implementation process and counsel—not a general news analysis.
DHS’s Stated Risk Rationale
DHS says it issued the order after reviewing a recommendation from the Federal Acquisition Security Council and associated evidence. In the attached order, DHS cites several risk factors, including the location of DeepSeek servers in the People’s Republic of China, the authority of PRC government cybersecurity and intelligence functions to access private-company infrastructure under its legal system, and potential malware or other security vulnerabilities.
These are the department’s stated grounds for its supply-chain action. They should be reported as DHS’s risk assessment, not transformed into a public finding about every model deployment, every provider, or every third-party product.
Initial Vendor Inventory Priorities
For a company that sells software, cloud services, or integrations to a covered federal civilian agency, the first useful output is a defensible dependency record—not an unsupported assurance that a product is unaffected.
- Where does DeepSeek appear, if at all? Review direct calls, hosted inference, weights, embedded components, AI features, and provider-supplied services.
- Which deliverables enter a covered environment? Separate commercial deployments from the specific versions, tenants, and services delivered to covered civilian agencies.
- Which business processes could reintroduce the dependency? Include product catalogs, purchasing approvals, renewals, subcontractors, and managed-service changes.
- What evidence supports each conclusion? Preserve architecture records, configurations, dependency manifests, vendor attestations, versions, review dates, and accountable owners.
This is a supply-chain governance checklist, not a substitute for a legal interpretation or an agency-specific instruction.
What the Order Does Not Establish
Several overbroad conclusions would go beyond the document:
- It does not create a worldwide ban on DeepSeek.
- It does not, on its face, apply to all U.S. government bodies or all private-sector uses.
- It does not publish a complete third-party vendor list.
- It does not fully define every technical configuration covered by “DeepSeek implementations.”
- It does not provide a universal technical migration plan for vendors or agencies.
The omission of a public taxonomy matters. Whether an API integration, hosted model, open-weight deployment, fine-tuned derivative, or software component is covered may turn on facts and subsequent implementation guidance. Teams should resist both extremes: assuming any possible link is harmless, or declaring an entire class of products prohibited without an official basis.
Official Developments to Watch
The next useful information is likely to be implementation-specific, not rumor-driven. Teams should watch for:
- Updates, corrections, or supplementary material for Federal Register document 2026-21447
- Materials in DHS docket DHS-2026-0628 and implementation communications from CISA
- Agency procurement notices, product-list updates, contract communications, and supplier questionnaires
- Official clarification of the phrase “developed using DeepSeek implementations”
For affected suppliers, a documented dependency inventory and a clear escalation path are more useful than a blanket claim of compliance. The order makes model provenance and component visibility a procurement issue as well as an engineering issue.
