US orders civilian agencies to remove DeepSeek products

US civilian agencies have been ordered to remove DeepSeek products and third-party tools built using DeepSeek implementations from their IT systems. A Department of Homeland Security notice published on 20 October also sets out the exclusion of DeepSeek and affiliated entities from civilian agency procurement.

The signed order in the notice’s appendix carries an original release date of 24 July 2026. Its requirements took effect upon issuance.

The order reaches third-party implementations

The removal requirement covers products supplied by DeepSeek, affiliated entities and third-party products or services developed using DeepSeek implementations. This makes the underlying technology relevant when agencies assess a supplier’s product, alongside the name on the supplier’s contract.

For procurement, the order includes approved-product lists, service-provider equipment lists, electronic marketplaces and similar purchasing routes. Its footnotes expressly include third-party implementations used to provide products and services to civilian agencies.

The signed scope covers Federal Civilian Executive Branch agencies and exempts national-security systems and sensitive compartmented information systems. The order operates through the Federal Acquisition Supply Chain Security Act, the government framework for excluding or removing risky technology from agency supply chains.

DHS cites hosted data collection and software risks

DHS’s stated security concerns include the potential transfer of sensitive information to China when government personnel use hosted DeepSeek services. The order discusses account information, prompts and responses, servers located in China and legal access available to Chinese authorities.

Its reasoning also refers to software vulnerabilities and published research into the DeepSeek mobile application. These are the department’s grounds for the exclusion and removal decision.

Associated Press reports that China criticised the restrictions on 20 October. The dispute adds a diplomatic response to an order whose legal starting date was in July.

Agencies have a formal exception process

Agencies can ask DHS for exceptions covering particular systems, actions or compliance timing. The signed order sets a written-request deadline of 60 days from its original issuance and calls for a justification, identification of the covered technology and proposed alternative mitigations.

CISA reviews exception requests and provides written decisions. The order also encourages agencies to monitor traffic, strengthen logging and watch for unusual activity while covered products are being removed. DHS is to review the order within a year and annually afterwards.

The practical task for an agency is to identify the technology inside its purchased services as well as its directly installed applications. That product inventory determines which systems and procurement routes fall within the order.