For nearly three months, one of the most consequential AI orders in years sat signed and sealed. On July 24, 2026, Homeland Security Secretary Markwayne Mullin signed Exclusion and Removal Order #2026-01 — the instrument behind the DeepSeek federal ban now rattling federal IT departments. The public only learned about it on October 19.
It is the first government-wide ban on a frontier AI model, reaching past DeepSeek’s own products into any third-party tool built on its technology. Here is exactly what it requires, who it covers — and the compliance gold rush it is about to create.
The Ban Nobody Saw Coming
So far, federal restrictions were narrow — Commerce banned it from its own devices, the Navy warned its members, and New York, Tennessee, and Virginia barred it from state networks. This is different.
Order #2026-01 was issued under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA) on the recommendation of the Federal Acquisition Security Council; the Bloomberg/Crypto Briefing coverage of the DHS order notes it also bars the Chinese firm from federal contracts. Reuters and Bloomberg both reported the notice on October 19.
The disclosure landed just days after DeepSeek released V4.1-Flash-1017 on October 17 (DeepSWE 77.0, search APIs at $0.75 per 1,000 calls) — covered in our DeepSeek V4.1 update story.
What DHS Order #2026-01 Actually Requires
The order tells every federal civilian agency to do two things — both effective immediately:
- EXCLUDE all DeepSeek and affiliate products and services from federal purchases, including approved product lists and e-commerce marketplaces.
- REMOVE DeepSeek and affiliate products from agency IT systems — plus “third-party products and services developed using DeepSeek implementations.”
That third-party clause is the one that matters. DeepSeek’s models are open weights — they live inside other vendors’ tools, not just DeepSeek’s app. The order never says which products count. That ambiguity is where the compliance money is.
Two Doors Closing: Exclude vs. Remove
One door locks DeepSeek out of future federal buying; the other forces it out of existing systems.
Step two is the hardest — and the most billable. Agencies buy software in bundles, and nobody has a clean list of which tools quietly embed DeepSeek weights.
Why DHS Pulled the Trigger
“Multiple threat vectors.” “May result in the transfer of sensitive data to the PRC.” “Themselves may contain malware or other security vulnerabilities.” Removal required “immediately.”
DHS also warned that prompts entered into DeepSeek apps could send sensitive data to China — combinable with public records to build what the order calls “actionable intelligence” on US persons.
See the full text breakdown of FR Doc. 2026-21447 and the at-a-glance table of the order’s provisions.
Who’s Covered — and the 60-Day Exception
Covered: federal civilian executive branch agencies. Excluded: national security and SCI systems, which fall under separate orders from the Department of War and the Director of National Intelligence.
- An agency may request an exception in writing within 60 days of issuance, with a “compelling justification” and proposed mitigations. CISA reviews the requests.
- Until removal is complete: monitor network traffic, strengthen logging and data-exfiltration controls, and flag anomalous activity.
- Private companies are not directly covered — unless they sell to the government. Federal contractors must pass this test through their contracts.
The Money Angle: A Compliance Gold Rush
Every federal ban creates a compliance industry. Here is where this one points:
- Sell AI-inventory audits to federal contractors. The third-party clause forces vendors to find embedded DeepSeek weights in their software bill of materials — most cannot do it alone.
- Build or resell AI-governance tooling. Model-lineage tracking, continuous monitoring, and automated SBOM generation are suddenly must-haves. Affiliate partnerships with governance vendors convert well here.
- Ride the US-model market-share shift. Federal dollars that might have gone to cheap DeepSeek API pricing now flow to American labs — OpenAI, Anthropic, and Google just got more attractive to every federal-adjacent buyer.
- Consult on the 60-day exception process. Agencies that want to keep a DeepSeek-dependent system need a written “compelling justification” plus mitigations, reviewed by CISA. That is billable specialist work.
Frequently Asked Questions
When did the DeepSeek federal ban actually start?
Signed July 24, 2026, effective immediately; filed for public inspection October 19; published October 20 — three months of silence.
Does the ban apply to private companies?
No — only to federal civilian executive branch agencies and their purchases. But federal contractors are covered through their contracts.
What about third-party tools built on DeepSeek?
Explicitly covered: “third-party products and services developed using DeepSeek implementations.”
Can an agency get an exception?
Written request within 60 days of issuance, with a “compelling justification” and proposed mitigations. CISA reviews requests.
Does it cover the military or intelligence agencies?
No. National security and SCI systems are excluded, under separate orders from the Department of War and the DNI.
Where can I read the full order?
Read the full text breakdown of FR Doc. 2026-21447 or the at-a-glance table of the order’s provisions.