The Department of Homeland Security has ordered US federal civilian agencies to remove DeepSeek products from their IT systems and has barred new purchases. The order, issued under the Federal Acquisition Supply Chain Security Act (FASCSA), was published in the Federal Register on Tuesday after appearing for public inspection on Monday.
What the DeepSeek Order Requires of Civilian Agencies
The order directs agencies to remove products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. It also covers third-party products and services “developed using DeepSeek implementations.” DHS Secretary Markwayne Mullin signed it.
The order applies to civilian agencies only. It is not a ban on companies or the public. One report says the Department of War and the Office of the Director of National Intelligence are carved out. Agencies may request exceptions within 60 days, and those requests are handled through CISA, which will provide technical help. DHS directs questions to CISA’s FASCSA implementation team.
Conflicting Signing Dates for the DeepSeek Order
Reports disagree on when Mullin signed the order. One gives June 26, another July 24 and a third July 26. The discrepancy suggests the order has been in force for months before its publication, though the sources do not explain the gap.
DHS Cites PRC Government Access and Data Collection Risks
DHS lists several threat vectors in the notice. DeepSeek’s servers are located in the People’s Republic of China, where law permits extensive government access to data. DHS also points to the collection of personally identifiable information and the digital fingerprinting of users, and to the possible transfer of sensitive prompts to the Chinese government.
The NowSecure Report on the DeepSeek iOS App
The notice cites a February 2025 NowSecure report on the DeepSeek iOS app. According to one reading of the notice, that report described unencrypted transmissions, weak encryption, insecure data storage and data sharing with ByteDance.
Ambiguity Over “Developed Using” DeepSeek
One report notes that the phrase “developed using” is not defined in the order. Agencies could therefore end up using DeepSeek models inadvertently through AI gateways such as OpenRouter or Vercel AI Gateway, which route requests to multiple model providers. All federal civilian agencies must inventory and remove DeepSeek-based tooling, and the undefined wording complicates how they determine what falls within scope.
Second FASCSA Order Ever Issued
The DeepSeek order is only the second issued under FASCSA. The first was the exclusion of Acronis, ordered by the Director of National Intelligence in 2025.
The order’s stated concerns are specific to how DeepSeek handles data. DHS cites the collection of personally identifiable information, the digital fingerprinting of users, and the possible transfer of sensitive prompts to the Chinese government, in addition to the legal environment around servers in the PRC. The notice’s scope extends past DeepSeek’s own applications to affiliates’ products and to third-party offerings built with DeepSeek implementations.
The order is short on details about enforcement. It sets a 60-day window for exception requests, handled through CISA, and it leaves the carve-outs for the Department of War and the Office of the Director of National Intelligence in place, according to one report.
Timeline and Next Steps for Agencies
DHS posted the order for public inspection on Monday and published it in the Federal Register on Tuesday. The 60-day exception window then applies, with CISA serving as the contact point for technical questions and exception requests.
The order’s publication follows an unusual path. It was posted for public inspection on Monday and appeared in the Federal Register on Tuesday, but reports on when the secretary actually signed it disagree by weeks, with dates between late June and late July. The notice spells out the exception process and the role of CISA, whose FASCSA implementation team fields questions from agencies and gives technical help to those that need it.
For agencies, the immediate work is discovery: finding where DeepSeek models appear in internal tools, vendor products and API integrations, including cases where a third-party product embeds a DeepSeek model without saying so prominently. How strictly DHS and CISA read “developed using” will determine how far that review has to reach into the software supply chain.
