Washington orders every civilian agency to rip out DeepSeek, and anything built on it

If you work at the EPA and some contractor's clever document tool quietly runs on a DeepSeek model under the hood, it has to go. So does anything else like it, across the federal civilian government.

On October 20 the Department of Homeland Security published a notice in the Federal Register announcing an order from Homeland Security Secretary Markwayne Mullin. It does two things. It bars civilian agencies from buying IT products and services made by Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates. And it orders agencies to remove "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations" from their systems.

That last clause is the one with teeth. DeepSeek publishes open-weight models. Anyone can download them, fine-tune them, wrap them in a nicer interface and sell the result under a different name. A ban that only covered DeepSeek's own chatbot would have missed most of where the models actually end up. This one reaches the whole supply chain, at least on paper.

A summer order, an autumn announcement

The timing is odd. According to CyberScoop, Mullin signed the exclusion on June 26, which means agencies have been living under it for months. The public notice landed only this week, a couple of days after DeepSeek shipped V4.1 Flash 1017, a model it calls "smarter, faster, more efficient," as Engadget pointed out.

The legal tool is the Federal Acquisition Supply Chain Security Act of 2018, a law that lets the government cut vendors out of federal IT when they are judged a supply chain risk. It has rarely been used in public. The first published order under it, according to law firm Morgan Lewis, came in September 2025 and targeted Acronis, a Swiss backup software company. DHS says it acted after reviewing a recommendation from the Federal Acquisition Security Council, an interagency body chaired out of the Office of Management and Budget.

DHS's reasoning, as reported by CyberScoop and Engadget, will sound familiar to anyone who followed the TikTok fight. DeepSeek's data sits on servers in China, where the government can compel domestic companies to hand it over. The company collects personal information and tracks users' online "digital fingerprints." Mullin said the models present "multiple threat vectors" to federal systems. Engadget quotes DHS warning about a possible "transfer of sensitive data" of government employees and vendors to the Chinese government, and about models that could "contain malware or other security vulnerabilities."

The data argument makes sense for DeepSeek's hosted app. If a federal employee pastes a draft memo into a chatbot running in Hangzhou, the memo is in Hangzhou. The argument gets shakier for open weights running on a server the agency controls, where nothing goes back to China unless someone builds it to. The malware line is the one DHS seems to be leaning on there. Model files can carry hostile code, and a model can be trained to behave badly under specific conditions. Whether DHS found evidence of either in DeepSeek's releases, the public notice doesn't say. The signed order itself is filed in docket DHS-2026-0628, and the published notice contains it only as scanned images.

There is an escape hatch. Agencies can ask for exceptions, but they have to file 60 days ahead and show a "compelling justification," such as being unable to carry out a mission-critical function without the tool. Agencies are also encouraged to step up monitoring and logging while they pull DeepSeek out.

The order has limits. It covers federal civilian agencies only. Private companies, state governments and ordinary users can keep using DeepSeek as they like. National security systems are carved out too. Those answer to the Pentagon and the intelligence community.

DeepSeek is also the only Chinese AI company named. CyberScoop notes that other Chinese open-weight models, including Moonshot AI's Kimi and Alibaba's Qwen, have drawn their own national security worries and accusations of distilling American models. US AI companies and the federal government have made the same distillation accusation against DeepSeek. For now, Kimi and Qwen are fine on a federal laptop. DeepSeek is not.

Congress has circled this before. Two members proposed a bill last year to ban DeepSeek's chatbot from government devices, Engadget notes. DHS just did a broader version of it without a vote.

The practical question is enforcement. Finding a chatbot icon on a laptop is easy. Finding which of a contractor's AI features call a fine-tuned DeepSeek model buried three vendors deep is much harder, and the order now makes that every agency CIO's problem. Expect a lot of procurement questionnaires asking vendors what model is inside the box.

Sources: Federal Register: DHS notice of order (2026-21447), CyberScoop, Engadget, Morgan Lewis on the first FASCSA order.