DHS DeepSeek Exclusion and Removal Order

Overview

Exclusion and Removal Order #2026-01 is a binding federal supply-chain security order issued by Secretary of Homeland Security Markwayne Mullin under the Federal Acquisition Supply Chain Security Act of 2018. Released and effective on July 24, 2026, it requires covered civilian agencies to exclude DeepSeek-related products and services from procurement and remove covered products from their information technology systems. The notice and signed order were published on October 20, 2026, as Federal Register Document 2026-21447, at 91 FR 66346–66350, under Docket No. DHS-2026-0628. The signed instrument appears in the Appendix of the official Federal Register publication.

The order applies to federal civilian executive branch agencies, except for their national security systems and the systems described in its applicability heading as secure compartmented information systems. Its obligations concern federal procurement and government systems rather than private-sector or consumer use generally. Procurement restrictions reach third-party DeepSeek implementations used to supply civilian agencies, while removal expressly covers third-party products and services developed using DeepSeek implementations. Both duties operate immediately after issuance. October publication is a separate milestone and does not establish a new effective date or restart the compliance period.

Definitions

The instrument uses several names in identifying DeepSeek. The notice names Hangzhou DeepSeek Artificial Intelligence Co., Ltd.; the risk summary names Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.; and affiliate footnotes refer to DeepSeek AG. Its operative affiliate definition references the control test in 48 C.F.R. § 2.101. An individual or business is affiliated where either directly or indirectly controls or can control the other, or a third party controls or can control both. This test extends the order's supplier coverage beyond a single named entity to qualifying controlled or commonly controlled businesses.

Legal footnotes connect system coverage to civilian information and communications technology under 41 U.S.C. § 1321(5). Third-party DeepSeek implementations are relevant both to procurement and to removal: procurement coverage includes implementations used to provide products and services to civilian agencies, and removal includes third-party products and services developed using those implementations. Agencies must examine the underlying supplier and technology relationships when determining coverage. A third-party supplier's branding is distinct from the question whether an offering incorporates a covered DeepSeek implementation.

Governance and Institutional Framework

The Federal Acquisition Security Council, or FASC, is the supply-chain risk institution established by FASCSA. The Secretary reviewed a Council recommendation and related evidence before issuing the order. The legal framework comprises 41 U.S.C. §§ 1321–1328 and 41 C.F.R. part 201-1. Section 201-1.304 requires executive agencies to comply with exclusion and removal orders issued under § 201-1.303. The Council recommends action, while the Secretary issues the binding civilian-system decision that creates the procurement and removal obligations.

The order's legal footnotes allocate other categories to the Secretary of Defense and the Director of National Intelligence. Defense authority covers the Department of Defense and national security systems other than sensitive compartmented information systems; intelligence authority covers the intelligence community and sensitive compartmented information systems within the statutory allocation. CISA provides implementation support and an operational contact through its FASCSA orders mailbox. Requests are directed to the DHS issuing official through CISA. The order assigns exception review and written approval or disapproval to DHS and describes CISA as reviewing exceptions and providing written decisions.

Security Risk Focus

The central concern is the security of federal information and communications technology supply chains. The risk summary describes DeepSeek as a privately owned company located in the People's Republic of China and states that its servers are located there. It identifies the PRC legal system's extensive authority for government cyber and intelligence access to private-company infrastructure as a risk factor. Account creation for DeepSeek-hosted model instances collects personally identifiable information and may involve tracking or digital fingerprinting. These circumstances form part of the security rationale for restricting acquisition and continued operation within covered federal systems.

Prompt-and-response applications create an additional concern when government employees or vendors submit sensitive information. Such use may transfer sensitive data to the PRC, where the information, independently or combined with public information, could produce actionable intelligence about U.S. persons or government programs. The risk summary also identifies possible malware or model security vulnerabilities and cites findings of critical vulnerabilities in the DeepSeek iOS application. The operative removal duty extends beyond hosted-account risks to covered third-party implementations; agencies must apply the coverage rules rather than limit removal to instances with a demonstrated data transfer.

Implementation and Exceptions

Covered agencies must immediately exclude DeepSeek, affiliated entities, and their products from civilian agency procurements. The order expressly reaches agency-approved product lists, service-provider equipment lists, e-commerce markets, and similar functions that facilitate procurement of information technology hardware, software, and services. Procurement footnotes include third-party DeepSeek implementations used to provide products and services to civilian agencies. The second required action is immediate removal of products provided by DeepSeek or its affiliates, together with third-party products and services developed using DeepSeek implementations, from covered civilian agency information technology systems, or seeking an exception through the stated process.

An executive agency may request relief from application of the order to the agency, from specified actions, or through a proposed delay in compliance. Under 41 C.F.R. § 201-1.304(b), requests must be written and submitted within 60 days of issuance. They must identify the order; describe the requested exception and affected provisions; identify the covered article or source-provided product or service; provide a compelling justification; and explain alternative mitigations. Possible justifications include mission-critical impacts and national-interest considerations involving national security reviews, investigations, or agreements. Requests go to CISA's FASCSA orders mailbox for the DHS process. Agencies must distinguish submission of a request from written approval of the requested relief.

Monitoring and Evaluation

Between issuance and full removal, agencies are encouraged to address residual cybersecurity risks. Examples include monitoring traffic entering and leaving the agency, enhanced logging, controls on data exfiltration for relevant systems, and detecting and flagging anomalous activity. These measures are recommendations rather than the mandatory exclusion and removal duties. Their purpose is to reduce exposure while implementation proceeds or an agency pursues the exception process. Recommended interim controls should be treated separately from an approved exception authorizing particular relief.

CISA may provide technical assistance when agencies lack sufficient internal capabilities to comply. The order provides a contact channel for information, assistance, and reporting. Agencies can support implementation through technology inventories, removal records, and procurement checks as administrative practices. The Secretary must review the order within one year of issuance and annually thereafter. This recurring review provides continuing reassessment of the supply-chain decision; the review milestone is distinct from an expiry date or an agency compliance deadline.

Compliance Consequences and Relief

The direct legal obligation is agency compliance with a binding exclusion and removal order under the FASCSA framework. Its operative consequences are exclusion from covered federal procurement channels and removal from covered federal information technology systems. Compliance therefore requires attention both to acquisition pathways and to deployed products and services. A procurement restriction addresses future acquisition, while removal addresses covered technology already present in agency systems. The inclusion of affiliates and third-party implementations makes supplier and dependency identification central to both tasks.

The express relief mechanism is an executive-agency exception request to the DHS issuing official through CISA, followed by written approval or disapproval through the DHS/CISA process. A request must present a compelling justification and alternative mitigations, with the specified description of the affected article, service, provisions, and requested relief. Mission-critical and national-interest considerations are relevant examples. Agencies should use the designated contact channel for procedural assistance and distinguish a pending request from an approved exception. Any approved relief must be applied to the agency, actions, or compliance timing covered by that decision.

Relationship to Other Instruments

The order implements the Federal Acquisition Supply Chain Security Act of 2018, codified at 41 U.S.C. §§ 1321–1328, through the institutional and compliance rules in 41 C.F.R. part 201-1. It relies on the Secretary's authority in 41 U.S.C. § 1323(c)(5)(A), the compliance provisions of 41 C.F.R. § 201-1.304, and the exception pathway in § 201-1.304(b). Its affiliate test references 48 C.F.R. § 2.101. These authorities supply the legal architecture for a source-specific security decision. The Federal Register notice publishes the binding signed order in its Appendix.

The Department of Energy issued Policy Flash PF 2027-01 on October 27, 2026. It informs DOE and NNSA contracting personnel of the DHS order and directs immediate removal and procurement restrictions within its implementation context. This agency implementation communication is separate from the DHS order's July 24 issuance, original scope, and 60-day exception window. Contractor inquiry practices, subcontract requirements, and contractual reporting obligations must be addressed under the applicable procurement rules and contract terms, separately from the order's express agency duties.

International Dimension

The international dimension concerns a technology provider located in the PRC and the potential exposure of federal information through an international technology supply chain. The stated rationale connects foreign server location, governmental access authority, collection of personal information, potential transfer of prompt data, and software vulnerabilities to risks for U.S. federal operations. Foreign location informs the risk assessment, while the operative procurement and removal obligations are directed to covered U.S. civilian executive agencies.

The order is a source-specific federal acquisition and systems-security measure, rather than a nationwide prohibition on private use or a general rule for all PRC-origin artificial intelligence systems. Affiliate and third-party implementation provisions can affect products supplied through international commercial chains because of their covered relationship to DeepSeek. Agencies assessing those products must examine the relevant control relationships and implementations and use the established exception process when requesting relief from the order.

Implementation Timeline

Sources and References