US Bans DeepSeek AI Across Federal Agencies Under 2018 Law

The Department of Homeland Security has ordered every federal civilian agency to stop buying DeepSeek products and to strip out those already running, including third-party software built on DeepSeek's models. The notice of order, published in the Federal Register on October 20, turns the Federal Acquisition Supply Chain Security Act of 2018, a law written to keep risky suppliers out of government technology, against a Chinese AI model developer and the software ecosystem built around its models.

DHS uses a 2018 supply chain law to remove DeepSeek from federal IT

The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates, as defined in federal acquisition rules. It has two parts: an exclusion that blocks agencies from procuring DeepSeek technology, and a removal requirement that applies to DeepSeek products already inside civilian agency systems. The Secretary of Homeland Security issued it after reviewing a recommendation from the Federal Acquisition Security Council, the interagency body Congress created to police risky suppliers in government technology.

“(1) exclusion of information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in 48 CFR 2.101, from federal civilian agency procurements; and (2) removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.”

U.S. Department of Homeland Security, Notice of Order, Federal Register 2026-21447, October 20, 2026

DHS describes DeepSeek's models as a source of several threat vectors, pointing to servers located in China, the personal data collected at sign-up, and the risk that sensitive information typed in by federal staff or contractors could reach the Chinese government. A July DHS memo, made public alongside the notice, had already told agencies to monitor traffic flowing in and out of government systems for DeepSeek activity. CISA's Cybersecurity Division runs the implementation team that agencies now report to.

The third-party clause turns DeepSeek's open weights into a procurement risk

The most consequential phrase in the order is the one about third-party products. DeepSeek publishes many of its models as open weights under permissive licenses, most recently the V4.1-Flash-1017 model released on October 17, and American cloud providers and software vendors have built products on top of those weights. Read literally, the order reaches any such product sold to a civilian agency, regardless of where the model is hosted. The notice does not list which vendor products are covered, so contractors will need to show which foundation models sit inside the tools they sell.

The legal route matters as much as the target. Under the 2018 statute, DHS orders cover civilian agencies, while the Defense Department and the intelligence community issue their own orders for national security and intelligence systems. A FASCSA order also carries more weight than the device bans that individual agencies and states adopted in 2025, because it binds procurement across the whole civilian government.

Source: DHS Federal Register notice, October 20, 2026; earlier actions from official government announcements. Table: Santage.

The order makes model provenance a condition of selling to the US government. Agencies can no longer treat an AI tool as a black box from a trusted American vendor, because the weights underneath now decide whether the product is lawful to run, and every contractor selling AI into civilian agencies will be expected to prove which models their software is built on.