DHS Formally Adds DeepSeek to Federal Procurement Ban; Civilian Agencies Must Remove It Immediately

On October 20, 2026, the U.S. Department of Homeland Security published a ban notice, File No. 2026-21447, in the Federal Register, requiring all federal civilian executive agencies to immediately remove DeepSeek and all third-party products built on the model, and barring future procurement.

Factual Background

The order was issued by DHS Secretary Markwayne Mullin on October 19, 2026, on the Federal Register public inspection website and formally published the next day. The document invokes the Federal Acquisition Supply Chain Security Act of 2018, allowing DHS to manage supply chain risk through exclusion or removal. DeepSeek is described as a private enterprise located within the People's Republic of China, and its model is said to present three threat vectors: Chinese law allows government access to private enterprise infrastructure; the account creation process collects personally identifiable information (PII); and the prompting and response process requires users to submit information to the model. After such information is transferred to China, it may be combined with public data to produce actionable intelligence about U.S. individuals or government programs. The model itself may contain malware or security vulnerabilities, and public security research has found multiple critical vulnerabilities in the DeepSeek iOS mobile app.

Previously, Australia, Taiwan and Italy had taken banning or investigative actions against DeepSeek. Texas became the first U.S. state to ban DeepSeek on government devices. In March 2025, the U.S. Department of Commerce had already banned the use of the DeepSeek AI model on government-issued devices.

Mechanism Breakdown

This order brings DeepSeek into the enforcement framework of the Federal Acquisition Supply Chain Security Act, with the core issue being the combination of data flows and access permissions. The account creation and prompt-response stages directly require users to submit information, which differs from the models federal agencies use in daily operations. The order explicitly states that the possibility of access under PRC law and the PII collection process together constitute an intelligence risk pathway, rather than a single technical vulnerability. The mention of iOS app vulnerabilities further incorporates software supply chain security into consideration, pointing to potential code-level implantation risks.

Industry Impact

The ban covers all federal civilian executive agencies but explicitly excludes national security and isolated systems. This means some isolated environments may still retain limited room for use. Previous restrictions by Texas and the Department of Commerce had already created a progression at the state and federal levels; the current order covers civilian agencies fully, forcing third-party product suppliers that rely on DeepSeek to adjust their federal contracting strategies. Earlier bans by other countries indicate that similar supply chain reviews may produce chain reactions internationally.

Strategic Assessment

[Analysis] Including a Chinese large model in the 2018 supply chain security law framework for the first time marks a shift in the U.S. government's review of AI model origins from individual cases to a systemic policy tool. This move may change federal agencies' sourcing preferences for AI procurement and increase the share of domestic or allied models in civilian systems, but the performance and cost comparison of specific alternatives still requires further observation. Historical precedents show that supply chain exclusion orders are usually accompanied by rising long-term compliance costs, and affected companies need to reassess their cross-border data architectures.