U.S. federal civilian agencies can now check their technology procurement and supply chains after the Department of Homeland Security ordered them to remove DeepSeek products and stop buying from the Chinese AI developer. The order also covers third-party products or services developed with DeepSeek implementations, although the notice does not define that phrase.
What happened
The Record reported that Homeland Security Secretary Markwayne Mullin issued the order on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018. DHS published it in the Federal Register on October 20, after filing it for public inspection on October 19.
The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., which develops the R1 and V3 models, and its affiliates as defined in federal acquisition rules. It applies to products and services purchased and used by federal civilian agencies, and it reaches contractors through contracts that include FAR clause 52.204-30.
Are you affected?
The order applies directly to federal civilian agencies, but private companies and members of the public are not restricted by it. A company may still be affected if it holds a federal contract carrying FAR clause 52.204-30 and provides or uses a product or service covered by the order.
The notice does not explain what qualifies as a “DeepSeek implementation.” DHS has not listed affected model versions, services or implementation patterns in the notice, so the order gives covered organizations no specific version list to check. Agencies and contractors should review products and services used in federal work against the named company, its affiliates and any applicable third-party implementation covered by the order.
DeepSeek’s privacy policy says the company collects, processes and stores users’ personal data in the People’s Republic of China. The Federal Register notice gives no reasons for the order, and DeepSeek had not immediately responded to The Associated Press’s request for comment at the time of reporting.
What to do now
- Review contracts for FAR clause 52.204-30. The clause applies to a covered product or service unless the issuing official grants a waiver.
- Search SAM.gov for “FASCSA order” at least once every three months, as required for covered federal contractors.
- Make a reasonable inquiry into the supply chain when a new order could affect it.
- Report any covered product or service provided or used in contract performance to the contracting officer within 3 business days after identifying it, then provide mitigation information within 10 business days after that report.
- Include FAR clause 52.204-30 in subcontracts.
What does the federal law cover?
The Federal Acquisition Supply Chain Security Act of 2018 allows the Federal Acquisition Security Council to recommend exclusion and removal orders. Three officials can issue them for their respective systems: the Secretary of Homeland Security for civilian agencies, the Secretary of Defense for the Defense Department and national security systems, and the Director of National Intelligence for the intelligence community.
Executive agencies must comply with exclusion and removal orders. An agency can ask the issuing official for an exception. Under council regulations, the request must be in writing and include a compelling justification.
The DeepSeek order covers civilian agencies only. It does not restrict companies or the public. The same law was used in 2025 when the Director of National Intelligence excluded Acronis, a Swiss cybersecurity and data protection company, from intelligence community procurement and ordered its products removed from intelligence community systems.
What should contractors understand about the timing?
An order issued after a solicitation applies to an existing contract only after the contracting officer adds it through an amendment or modification. For a contract already subject to FAR clause 52.204-30, the contractor must follow the supply-chain and reporting requirements in the clause.
The Federal Register notice contains no deadline for public release of the order. The council’s regulations leave public release to the issuing official, who may provide a copy to other people. The law requires the issuing official to notify the company named in the order and the appropriate congressional committees, and to review the order at least once a year.
Why was the order issued?
The Federal Register notice does not state reasons for the order. The signed order is attached to the notice as four scanned pages and is available on regulations.gov under docket DHS-2026-0628. The order is dated July 24, 2026.
Before the DHS order, U.S. restrictions on DeepSeek on government devices had been adopted by individual bodies. By February 2025, Congress, NASA, the Navy, the Pentagon and Texas had barred DeepSeek from government devices. Bills to ban DeepSeek on government devices were introduced in the House and Senate that month and had not advanced past committee as of October 21, 2026.
China’s foreign ministry spokesperson Mao Ning said on October 20 that China consistently opposes the overstretching of the concept of national security and will “resolutely safeguard the legitimate rights and interests of Chinese companies,” according to The Associated Press.
FAQ
Does the DeepSeek order apply to private companies and the public?
No. The order covers what federal civilian agencies buy and run. It does not restrict companies or the public, although it can affect government contractors through applicable contracts.
Which DeepSeek products are covered by the federal order?
The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 models, and its affiliates as defined in federal acquisition rules. It also covers third-party products or services “developed using DeepSeek implementations,” but the notice does not define “DeepSeek implementations.”
What must a covered federal contractor do?
A contractor covered by FAR clause 52.204-30 must search SAM.gov for “FASCSA order” at least once every three months, investigate supply-chain effects, report covered products or services within 3 business days after identifying them, provide mitigation information within 10 business days after that report, and include the clause in subcontracts.