Federal civilian agencies must remove DeepSeek products from their information technology systems and exclude them from future purchases, according to CyberScoop’s reporting on the DHS order. The restriction reaches beyond the company’s chatbot and API to affiliates and third-party products and services developed using DeepSeek implementations.
For agencies and suppliers, that scope calls for a software supply-chain review. A product’s branding alone will not establish whether it falls outside the restriction.
October 20, 2026, is the Federal Register public-notice date. CyberScoop reports that DHS signed the underlying order on June 26. Its account also details an exception process requiring advance notice and security controls encouraged while removal is pending.
Removing the DeepSeek App Is Not Enough
The action imposes two obligations: stop acquiring covered technology and remove covered technology already installed or deployed. Completing one does not satisfy the other.
DHS acted under the Federal Acquisition Supply Chain Security Act following a Federal Acquisition Security Council recommendation and review of supporting evidence, according to the reporting. The resulting exclusion and removal action applies to federal civilian executive-branch IT. Individual agencies cannot simply disregard it as advice.
The reported coverage has three layers:
- DeepSeek information technology products and services.
- Products and services from DeepSeek affiliates.
- Third-party products and services developed using DeepSeek implementations.
Reporting on the notice’s scope identifies third-party offerings as covered, extending the restriction beyond products sold under DeepSeek’s own name.
Procurement teams therefore need to ask, “Does this product use a covered DeepSeek implementation?” Asking only “Are we buying DeepSeek?” is insufficient. A vendor’s own interface, support contract, or hosting arrangement does not, by itself, answer the coverage question.
Consider an illustrative case: an agency buys an assistant from another software company, but the assistant uses a DeepSeek implementation behind the interface. That dependency is relevant to the coverage assessment even if employees never see DeepSeek branding.
The available reporting leaves some boundaries unresolved, including heavily modified derivatives and products with optional model backends. Agencies and vendors should consult the signed order’s definitions before assuming that customization, rebranding, or disabling one feature establishes an exemption.
