The Department of Homeland Security has ordered DeepSeek’s products out of federal civilian agencies, and the order reaches past DeepSeek’s own apps to “third-party products and services developed using DeepSeek implementations.” The notice went on public inspection Monday morning and is formally published in Tuesday’s Federal Register.
It’s issued under the Federal Acquisition Supply Chain Security Act of 2018, or FASCSA. It does two things: it excludes products and services from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates from civilian procurement, and it requires agencies to remove DeepSeek products already in their systems.
The first half is unsurprising. The second half could turn into a compliance headache for a lot of software vendors.
What FASCSA is
Congress passed FASCSA in December 2018. It created the Federal Acquisition Security Council, an interagency body that assesses technology supply-chain risk and recommends exclusions. Three officials can issue binding orders on those recommendations: the Homeland Security secretary for civilian agencies, the defense secretary for the military, and the Director of National Intelligence for spy agencies.
The law sat unused for years. According to a Cloud Security Alliance research note, the first order came in September 2025, when the intelligence community excluded the software company Acronis. In March 2026, the Pentagon, now styled the Department of War, used FASCSA authority to designate Anthropic a supply-chain risk for its contracts. A federal appeals court upheld that designation in September.
The DeepSeek order is the first FASCSA order issued by DHS, which makes it the first to cover the entire federal civilian government, CSA says.
It’s been in force since July
The order itself isn’t new. According to Haynes Boone’s analysis, Exclusion and Removal Order #2026-01 was signed by Homeland Security Secretary Markwayne Mullin with a stated release date of July 24, nearly three months before it appeared in the Federal Register.
That timing has a consequence. Agencies had 60 days from issuance to request exceptions. Counted from July 24, that window closed on September 22, 28 days before the public could read the order. Exclusion and removal both took effect immediately on issuance.
The catch: a rule that starts its own deadlines before anyone outside government can read it isn’t great for the companies expected to comply with it. Haynes Boone’s advice to practitioners is blunt: “be prepared for operative dates that precede publication.”
Defense and intelligence agencies have parallel orders. Crowell & Moring notes those are posted in SAM.gov’s spreadsheet of FASCSA orders and don’t explain their reasoning.
Why DHS says DeepSeek is a risk
The civilian order describes DeepSeek’s free open-source models as “present[ing] multiple threat vectors,” per Crowell, including the risk that information collected by its apps and models could produce “actionable intelligence” about the US government. Haynes Boone summarizes the order’s risk case:
- DeepSeek’s servers are in China, where the government has broad authority to access private company infrastructure.
- Signing up for DeepSeek-hosted services collects personal information and may track and fingerprint users.
- Prompts typed into DeepSeek’s apps could send sensitive data to China.
- The models themselves may contain malware or other vulnerabilities, and research found multiple critical flaws in DeepSeek’s iOS app.
Our read: the first three points are about data flowing to Chinese servers, and they’re strong. The fourth is weaker than it sounds. CSA points out that the cited research was about the mobile app, not the model weights, and the order cites no public evidence of malicious payloads in the weights themselves.
There is public evidence of other weaknesses. CSA cites a September 2025 evaluation by NIST’s Center for AI Standards and Innovation. It found agents built on DeepSeek’s R1-0528 model were on average 12 times more likely than US frontier models to follow malicious instructions that hijacked their tasks.
The catch: what’s a “DeepSeek implementation”?
This is where it gets messy for vendors. DeepSeek’s models are open-weight, so anyone can download them and run them on their own hardware without ever touching a Chinese server. The order doesn’t define “DeepSeek implementation,” and its removal language doesn’t distinguish DeepSeek-hosted from self-hosted deployments or address fine-tuned versions, Haynes Boone writes.
Crowell reads the civilian order’s scope as significantly broader than the defense and intelligence orders. Those cover “applications and services that implement” a DeepSeek model, wherever it’s hosted. The civilian order adds products “developed using” DeepSeek, and Crowell says that language suggests even products built with help from DeepSeek’s coding assistant could count.
CSA lays out the spectrum. Running DeepSeek’s app or API is plainly covered. Self-hosted DeepSeek weights are very likely covered, and so are fine-tunes, quantized versions and DeepSeek’s own “distilled” models built on Qwen and Llama. Murkier: a vendor’s in-house model trained partly on DeepSeek-generated data, or code written with a DeepSeek-powered assistant.
Why it matters: the footprint is big. CSA counts more than 500 community models on Hugging Face that list DeepSeek-R1 alone as their base. DeepSeek’s MIT license explicitly allows training other models on its outputs. And very few organizations keep records of which models generated their training data or code months ago.
Haynes Boone also flags an oddity: the order names the company inconsistently, using three different versions of its name. It’s also inconsistent about whether CISA or DHS reviews exception requests.
How it hits contractors
The order is addressed to agencies, but contractors get pulled in through FAR clause 52.204-30, the federal contracting rule that carries FASCSA orders into contracts. Contractors must check SAM.gov for FASCSA orders at least every three months, make a “reasonable inquiry” into their supply chains, report any covered article to the contracting officer within three business days and follow up within 10. The clause flows down to all subcontracts.
There’s a little breathing room. A “reasonable inquiry” covers information a contractor already has and doesn’t require an audit, CSA notes. A new order becomes a contractual prohibition on an existing contract only once it’s added by modification, though the reporting duties already apply.
In practice, CSA expects agency customers to ask for broader attestations than the rule strictly requires. A vendor asked to certify a product was never “developed using” DeepSeek may not be able to answer with confidence.
Who it affects
- Federal civilian agencies: must purge DeepSeek apps and anything built on its models, with the exception window already closed.
- Government software vendors: now need a model-level inventory, including fine-tunes, distilled models and coding tools, not just a vendor questionnaire.
- Everyone else: private companies are outside the order, but its “developed using” standard may become a template for future AI supply-chain rules.
The takeaway
Our read: banning a Chinese company’s hosted chatbot from government laptops is uncontroversial. Banning anything “developed using” its open-weight models, without defining the phrase, turns model provenance into a compliance problem for every software vendor that sells to the government.
What to watch: whether DHS or CISA issues guidance defining the term, whether the same language shows up in orders against other model makers, the order’s first annual review, and how many vendors quietly swap out DeepSeek-based components rather than wait to find out.
Image: Tia Duffour / Wikimedia Commons, Public domain
