DeepSeek banned in US federal agencies: what the DHS order requires, and where else DeepSeek is banned

DeepSeek is now formally banned in US federal civilian agencies. On Monday, October 19, 2026, the Department of Homeland Security filed a notice in the Federal Register of an order that excludes the Chinese AI company's products from civilian agency purchases and requires agencies to remove the ones they already have. That includes third-party tools built on DeepSeek. The notice was published October 20. It replaces a patchwork of agency-by-agency restrictions with one rule for every civilian agency, and it's the latest move in a wider fight over Chinese AI and export controls. It doesn't make DeepSeek illegal for anyone else in the US.

This story is based on the DHS notice in the Federal Register (FR Doc. 2026-21447, 91 FR 66346), which reprints the signed order, reporting by CyberScoop, the BBC, Security Magazine and SiliconANGLE, and official and wire sources for each ban in the table below, checked October 20, 2026. Reuters' own October 19 report was blocked when we checked and is not used. For what DeepSeek currently ships, see our story on DeepSeek V4.1 Flash 1017.

The short version

• What: an "exclusion and removal" order under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), issued by the Secretary of Homeland Security.
• Who it covers: federal civilian executive branch agencies, except their national security systems and secure compartmented information systems. Defense Department and intelligence community systems fall outside DHS's authority, the order says.
• What it covers: IT products and services from Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates, plus "third-party products and services developed using DeepSeek implementations."
• What agencies must do: stop buying DeepSeek products and remove existing ones "immediately after the issuance of the Order," or ask for an exception.
• When: the order's original release date is July 24, 2026. The notice was filed October 19 and published October 20, 2026. CyberScoop reported a June 26 date for the order, which the published text doesn't show.
• What it isn't: a ban on DeepSeek for companies or the public.

What does the DHS order say?

The Federal Register notice is short. It's titled "Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements" (docket DHS-2026-0628). It says the Secretary issued the order after reviewing "the Federal Acquisition Security Council Recommendation and affiliated evidence." DHS General Counsel James H. Percival II signed the notice. The signed order is printed as the notice's appendix and, the notice says, posted on regulations.gov. It names a CISA team (fascsa.orders@cisa.dhs.gov) to handle exception requests and implementation.

The order is titled "Exclusion and Removal Order #2026-01." It comes from Secretary Markwayne Mullin, is copied to Office of Management and Budget Director Russell Vought, and gives an "Original Release Date" of July 24, 2026. CyberScoop's Derek B. Johnson reported on October 19 that Mullin ordered the exclusion on June 26, 2026; that date doesn't appear in the published order. The order says:

• DeepSeek's models "present multiple threat vectors," and its servers are in China.
• For DeepSeek-hosted models, account sign-up collects personal information, and DeepSeek "may also track and digitally fingerprint users."
• Prompts "may result in the transfer of sensitive data" to China, which "could produce actionable intelligence on U.S. persons and/or government programs."
• Agencies must exclude DeepSeek from procurement "effective immediately" and remove covered products "immediately after the issuance of the Order, or seek an Exception."
• Exception requests must be "submitted in writing within 60 days" of the order, with a "compelling justification," such as the effect on mission-critical functions. CISA approves or rejects them.
• Until removal is complete, agencies are "encouraged" to monitor traffic, turn on enhanced logging and data-exfiltration controls, and flag anomalous activity.

DHS must review the order within one year and every year after that. The BBC's report on the order, republished by Ghana's Citi Newsroom, said the ban took effect at the end of July, which fits the July 24 release date, and covers departments such as Treasury, State and Justice.

How the DHS DeepSeek order became public

1. June 26, 2026Date CyberScoop gives for Mullin's orderCyberScoopReported
2. July 24, 2026Order #2026-01 released, per the order itselfFederal RegisterConfirmed
3. Oct. 19, 2026DHS files the notice in the Federal RegisterFederal RegisterConfirmed
4. Oct. 20, 2026The notice is published (FR Doc. 2026-21447)Federal RegisterConfirmed

• Confirmed
• Reported

Does it cover DeepSeek's open-weight models?

Possibly, and that's the order's most-discussed feature. The phrase "third-party products and services developed using DeepSeek implementations" reaches beyond DeepSeek's own app and API. Gabrielle Hempel of Exabeam told Security Magazine that "the breadth of its language" raises questions about software provenance, and argued that a locally run model with controls carries a different risk than a foreign-hosted service. The order's footnotes say the exclusion includes "third party implementations of DeepSeek used to provide products and services to civilian agencies," and the order warns that "the models themselves may contain malware or other security vulnerabilities." But neither the order nor the notice mentions open weights, or says how agencies should treat copies of DeepSeek's MIT-licensed weights, such as V4.1-Flash, that they run themselves. Agencies that buy AI services from vendors may need to know whether a DeepSeek model sits underneath.

Where else is DeepSeek banned?

Most bans apply to government devices and networks, not to the public. The exceptions were app-store actions by privacy regulators in Italy, South Korea and Germany.

Last verified: October 20, 2026

This list includes only actions we could trace to an official source or a named wire or news outlet. Current status isn't confirmed for every row; Italy's and Germany's app-store actions, in particular, may have changed since. A Reuters factbox dated January 6, 2026 also says South Korea's industry ministry blocked employee access in early February 2025.

Is DeepSeek banned in the UK or India?

No national ban exists in either country. A UK Department for Science, Innovation and Technology spokesperson said on February 17, 2025 that "the use of DeepSeek is a personal choice for members of the public," PA reported. India's step was an internal Finance Ministry note, dated January 29, 2025, that also covered ChatGPT. Reuters couldn't confirm whether other ministries issued similar directives.

How does this fit the bigger picture?

The order uses a procurement law, not export controls. But it lands as Washington tightens controls in both directions: on what Chinese firms can buy, and on US models such as Claude Fable 5, which Commerce restricted in June. DeepSeek is also growing. It is reportedly raising about 100 billion yuan (our funding story), and Taiwan is weighing criminal penalties for smuggling AI chips to China (our report). A separate House bill, the No DeepSeek on Government Devices Act (H.R. 1121), was introduced on February 7, 2025.

DeepSeek and the Chinese embassy in Washington had not commented in the coverage we reviewed, and the BBC said it had contacted both.

What's confirmed, reported and uncertain

• Confirmed (Federal Register, notice and order): the order exists, its legal basis, Mullin as its author, the July 24 release date, its scope (DeepSeek, affiliates and third-party products built on DeepSeek implementations), the civilian-agency coverage and its exclusions, immediate removal or an exception request within 60 days, the rationale quotes, the interim monitoring advice, and the October 19 filing and October 20 publication.
• Reported (CyberScoop): the June 26 date.
• Reported (BBC): the end-of-July effective date and the Treasury, State and Justice examples.
• Uncertain: how "DeepSeek implementations" applies to self-hosted open weights, whether any agency has an exception, and how many agencies were using DeepSeek.