DHS orders DeepSeek removed from federal civilian systems

The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products from their information technology and bar them from new purchases, according to a Federal Register notice publishing Tuesday.

What the order says

The order has two parts. Agencies must exclude products and services from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates from procurements. They must also remove DeepSeek and affiliate products from their IT systems.

The removal reaches beyond DeepSeek itself. It covers “third-party products and services developed using DeepSeek implementations.”

The exclusion applies to agency-approved product lists, e-commerce markets and other purchasing channels, the order says.

Who wrote it

Homeland Security Secretary Markwayne Mullin signed Exclusion and Removal Order #2026-01. It was issued under the Federal Acquisition Supply Chain Security Act of 2018 after a recommendation from the Federal Acquisition Security Council. The signed order lists an original release date of July 24.

The order cites the risk of data reaching China. DeepSeek’s servers are in the People’s Republic of China, it says, and Chinese law gives government cyber and intelligence functions broad access to private company infrastructure. Using its apps “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors,” the order says.

Who it binds and who it exempts

The order binds federal civilian executive branch agencies. It does not cover their national security systems or secure compartmented information systems. Systems under the secretary of defense and the director of national intelligence are also outside the DHS secretary’s authority, the order says.

What agencies must do

The exclusion took effect immediately after the order was issued. Removal is also required immediately, unless an agency seeks an exception.

Agencies may ask that the order not apply to them, to certain actions, or for a delay in compliance. Requests must be submitted in writing within 60 days of the order and include a “compelling justification.” CISA will review them.

Until removal is complete, agencies are encouraged to monitor traffic, tighten logging and controls on data exfiltration and flag anomalous activity.

What’s next

CISA may give technical help to agencies that lack it. The secretary must review the order within one year and every year after that. The signed order is also posted on Regulations.gov under docket DHS-2026-0628.