US Bars DeepSeek From Civilian Agencies and Their Contracts

Update, 20 October: A day after this order was filed, DeepSeek open-sourced DeepInfer, the inference framework it says powers V4.1-Flash, with Huawei Ascend 950 support, and Vals AI published an early cyber benchmark result. Read our follow-up.

The US Department of Homeland Security has ordered civilian federal agencies to exclude DeepSeek from their procurements and to remove DeepSeek products, and “third-party products and services developed using DeepSeek implementations,” from their IT systems, according to a notice of order filed for public inspection at the Federal Register on 19 October 2026. Reuters reported the notice that day, and Bloomberg wrote that the order “also bars the Chinese firm from participating in federal government contracts.”

The signed order, Exclusion and Removal Order #2026-01, carries an “Original Release Date: July 24, 2026” and is from Homeland Security Secretary Markwayne Mullin, with Office of Management and Budget Director Russell Vought copied. It is issued under the Federal Acquisition Supply Chain Security Act of 2018, and the notice is scheduled for publication in the Federal Register on 20 October.

Business Pill · OPEN WEIGHTS

A short explainer on open-weight models: renting a model versus running it yourself. It teaches the general idea only and says nothing about any company in this story.

What the Order Requires

The order’s required actions say all civilian agencies must “Exclude DeepSeek, DeepSeek-affiliated entities, and their products from civilian agency procurements, effective immediately after issuance of this Order, to include agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions that facilitate the procurement of information technology hardware, software, and services.”

They must also “Remove products provided by DeepSeek, DeepSeek-affiliated entities, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems immediately after the issuance of the Order, or seek an Exception.” A footnote in the order adds “To include third party implementations of DeepSeek used to provide products and services to civilian agencies.”

Agencies that want out can ask. The order says requests for exceptions “must be submitted in writing within 60 days of the issuance of this order,” and that CISA “will review requests for exceptions and provide a written approval or disapproval.” Until removal is complete, agencies are “encouraged” to monitor traffic, add logging and controls on data exfiltration, and flag anomalous activity.

What Was Posted on X

Walter Bloomberg (@DeItaone) posted the headline at 13:14 UTC on 19 October 2026, before Reuters’ story at 13:29 UTC: the administration removing DeepSeek from civilian government agency IT systems and barring the purchase of DeepSeek-related products by government agencies. The order itself also names third-party products and services developed using DeepSeek implementations.

First Squawk (@FirstSquawk) posted at 13:20 UTC: “US EXCLUDES DEEPSEEK PRODUCTS FROM CIVILIAN GOVT AGENCY SYSTEMS”. The order says it applies to civilian agencies except their national security systems and secure compartmented information systems.

Evan (@StockMKTNewz) posted at 13:23 UTC on 19 October that the administration is reportedly banning DeepSeek’s models from civilian government agency IT systems, and that DeepSeek is reportedly planning to go public in China in Q4 or Q1 of 2027. The post quotes an 8 October post by KraneShares, an ETF issuer, about a potential STAR Market listing at a potential $75 billion valuation. The listing timing is the post’s own; Bloomberg’s 6 October report, cited in the update below, says early 2027.

Andrew Curran (@AndrewCurran_) posted at 18:33 UTC on 19 October that the Department of Homeland Security is requiring civilian federal agencies to remove DeepSeek products and “any third-party services developed using DeepSeek implementations,” and to stop buying them. The order’s own wording, quoted above, is “third-party products and services developed using DeepSeek implementations”: his version adds “any” and leaves out “products”.

First Squawk (@FirstSquawk) posted at 07:11 UTC on 20 October that China’s foreign ministry, on US agencies removing AI tools with DeepSeek, said China “always opposes overgeneralising national security concept” and “will firmly safeguard legitimate interests of Chinese firms”. The update above quotes this headline; we have not read the ministry’s own transcript.

Why DHS Says DeepSeek Is a Risk

The order states that “DeepSeek’s models present multiple threat vectors” and that “DeepSeek servers are located in the PRC.” It says the company’s most widely used applications work through a prompt-and-response process “which may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors.”

It adds that, for DeepSeek-hosted instances of its models, the account process “collects personally identifiable information (PII) and may also track and digitally fingerprint users,” and that “The models themselves may contain malware or other security vulnerabilities.” It cites open-source security research that found the DeepSeek iOS app “contains multiple critical vulnerabilities.”

Who It Covers, and Who It Does Not

The order says it applies to “Federal Civilian Executive Branch Agencies except for their national security systems and secure compartmented information systems.” The Secretary of Homeland Security can issue these orders for civilian agency systems, it says, “except those under the Department of War and the Office of the Director of National Intelligence.”

Bloomberg reported the news as the Trump administration barring civilian agencies from using DeepSeek products or services, and described DeepSeek’s models as more affordable open-weight models that challenge Silicon Valley developers. The order’s reach to “third-party products and services developed using DeepSeek implementations” is the part that goes beyond DeepSeek’s own apps.

Dated July, Public in October

The order’s original release date is 24 July 2026, and the Federal Register stamp shows the notice filed on 19 October 2026 at 8:45 a.m. That is 87 days between the order’s release date and its public filing, by our arithmetic. The documents we read do not explain the gap.

Four months earlier, a CNBC headline of 16 June 2026 read: “U.S. holds off blacklisting China’s DeepSeek, more than 100 firms deemed security risks.”

Twenty-One Months of Restrictions

A CNBC headline of 28 January 2025 read: “U.S. Navy bans use of DeepSeek due to ‘security and ethical concerns’.” Axios reported on 30 January 2025 that Congress had banned staff use, CNBC reported on 31 January 2025 that NASA had blocked it, and Bloomberg reported on 31 January 2025 that the Pentagon had blocked access.

Abroad, AP reported on 30 January 2025 that Italy had blocked access to the app, Reuters reported Taiwan’s ban for government departments on 3 February 2025, and the BBC reported Australia’s ban on government devices on 4 February 2025. NBC News reported on 10 February 2025 that New York state had banned DeepSeek from government devices. Reuters reported that new downloads were suspended in South Korea on 17 February 2025, that DeepSeek faced a ban from Apple and Google app stores in Germany on 27 June 2025, and that the Czech government banned its use in public administration on 9 July 2025.

By our count, that is 11 earlier government restrictions headlined by trusted outlets before this order; the list is ours and is not complete. From the Navy headline on 28 January 2025 to the order’s release date of 24 July 2026 is 542 days, and to its public filing 629 days, by our arithmetic.

The Law Behind It

The order says the Federal Acquisition Supply Chain Security Act of 2018 “created the Federal Acquisition Security Council (FASC) to manage supply chain risks by recommending exclusion or removal of risky products or services from federal procurement and IT systems.” The notice says the Secretary acted “following review of the Federal Acquisition Security Council Recommendation and affiliated evidence.”

A client alert from law firm Mayer Brown, dated 2 October 2025, was headlined “DNI Issues First FASCSA Exclusion and Removal Order Against Acronis AG.” The DHS order on DeepSeek is numbered 2026-01. It says the Secretary of Homeland Security will review the order “within one year and annually thereafter.”

Update, 19 October: The Ban Lands as DeepSeek Reportedly Prepares an IPO

The order arrives while DeepSeek is reported to be preparing for a stock market listing. Bloomberg reported on 6 October, citing people familiar with the matter, that DeepSeek was close to securing at least 80 billion yuan ($12 billion) in its latest funding round, “ahead of a landmark initial public offering in early 2027.” The people said Contemporary Amperex Technology Co. Ltd. (CATL) and Tencent had committed among the largest amounts, that the final tally could approach 100 billion yuan based on term sheets signed, and that once the round closes “the next step should be to restructure the company to prepare for an IPO.”

Bloomberg Intelligence analysts wrote that the round “pushes the company’s valuation to at least 500 billion yuan (about $75 billion)”. Bloomberg said details may still change in final talks, and that DeepSeek did not respond to its request for comment. Posts on X that spread Monday’s ban paired it with the listing reports; the timing given in Bloomberg’s report is early 2027.

Update, 20 October: China Responds

China’s foreign ministry responded on 20 October to the US order requiring federal agencies to remove AI tools that use DeepSeek. As headlined by the market news account FirstSquawk on X at 07:11 UTC, the ministry said China “always opposes overgeneralising national security concept” and “will firmly safeguard legitimate interests of Chinese firms.”

We have not read the ministry’s own transcript, and its full remarks were not available when this update was written; the wording above is FirstSquawk’s headline summary.

The Structural Read

As we read it, the order treats the model as part of the supply chain: it names DeepSeek, its affiliates and third-party implementations, and gives agencies 60 days to ask for an exception.

As we read it, the timing is part of the story: the order’s release date of 24 July 2026 and its public filing on 19 October 2026 are 87 days apart by our arithmetic, and the documents we read do not say when agencies received it.

As we read it, the order fits a pattern of government restrictions on DeepSeek that trusted outlets have reported since January 2025, from the US Navy to the Czech government; our list of 11 earlier actions is not complete.

Three Implications

PRODUCTS BUILT ON DEEPSEEK ARE IN SCOPE The order covers third-party products and services developed using DeepSeek implementations, not only DeepSeek’s own apps.

AGENCIES HAVE 60 DAYS TO SEEK EXCEPTIONS The order says exception requests must be submitted in writing within 60 days of its issuance, and CISA will approve or disapprove them.

DEFENSE AND INTELLIGENCE SYSTEMS SIT OUTSIDE IT The order applies to civilian agencies except their national security systems and secure compartmented information systems.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Open vs Closed Meta-Framework.

The framework puts the pattern this way: “Close the SCARCE layer (keep proprietary) + Open the ABUNDANT layer (commoditize)”.

As we read it, the DHS order adds a limit to that pattern for one buyer: open weights did not keep DeepSeek in civilian agency systems, because the order also covers products built on DeepSeek implementations. The framework was published in March 2026 and does not discuss this order.

What Is Not Established

The documents we read do not say how many agencies use DeepSeek or products built on it, which third-party products are covered, how many exception requests have been filed, or why the order was filed 87 days after its release date. Neither the Reuters nor the Bloomberg text we read reports a response from DeepSeek. Whether the Defense Department or the intelligence community will issue matching orders is not stated.

The Bottom Line

A DHS order filed for public inspection on 19 October 2026 bars DeepSeek from civilian agency procurements and requires agencies to remove DeepSeek products, and third-party products and services built on DeepSeek, from their IT systems, unless they win an exception. The order is dated 24 July 2026.