US orders civilian agencies to remove DeepSeek products
The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying DeepSeek products and to remove existing DeepSeek products from their IT systems. The order was made public on 19 October 2026 and published in the Federal Register on 20 October 2026. It also covers DeepSeek affiliates and third-party products built using DeepSeek models. It does not restrict private companies or consumers. Agencies can ask for exceptions, but the request window is 60 days. For a business that automates work, the practical point is simple: if a tool you sell to a federal civilian agency runs on a DeepSeek model, it is affected, and you need to know which models your automations use.
In short
- DHS ordered US civilian federal agencies to stop buying DeepSeek products and remove them from IT systems.
- The order covers DeepSeek affiliates and third-party products built using DeepSeek implementations.
- Private and consumer use is not restricted by this order.
- Exception requests are due within 60 days, and sources disagree on when that window started.
- Vendors selling to federal civilian agencies should check which models their automations run on.
What happened
According to the Federal Register notice, DHS Secretary Markwayne Mullin signed Exclusion and Removal Order 2026-01 on 24 July 2026 under the Federal Acquisition Supply Chain Security Act of 2018. The notice was filed for public inspection on 19 October and published on 20 October. The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. It tells civilian agencies to stop buying DeepSeek products and to remove them from government systems, including third-party products built using DeepSeek implementations. The Hacker News reported the same two actions, and CyberScoop described the order as a ban on DeepSeek across civilian federal agencies.
The order covers federal civilian agencies under DHS authority. Defence Department systems and certain national security systems fall under separate channels, according to the reporting.
Why it matters for businesses that automate work
Most automation projects do not start with a model. They start with a task, such as matching invoices, chasing overdue payments or drafting reports, and the model sits underneath a tool that the business may not have chosen directly. DeepSeek's models are released as open weights, which means other developers can build products on them. BleepingComputer noted that the order reaches those third-party products as well as DeepSeek's own apps.
The wording of the order is the part that matters most for vendors. The notice does not list which products it means. Reporting on the order says it does not explain how an agency should treat a DeepSeek model running on a US company's own servers. Until the agencies publish more guidance, a vendor cannot assume that a product is outside the order because it is hosted in the United States.
What changes in practice
For a business that does not sell to US federal civilian agencies, the order does not stop you from using DeepSeek tools. The order applies to the agencies, and CyberScoop and BleepingComputer both state that it is not a general ban on private or consumer use. Your own rules, your customers' contracts and your data obligations still apply.
For a business that does sell to those agencies, the order adds three checks:
- List every AI tool, plug-in and automation step in products or services delivered to federal civilian customers, and record which model powers each one.
- Ask each software vendor in writing whether its product uses a DeepSeek model, directly or through a third-party layer.
- Check the contract clauses. Under the Federal Acquisition Regulation clause 52.204-30, contractors must not use covered articles or products from a source covered by an applicable FASCSA order, unless a waiver applies.
The 60-day exception window needs care. BleepingComputer and ExecutiveGov describe the window as running from the order's issuance, which would place its close in late September 2026, before the public notice appeared. CyberScoop describes the request as due 60 days in advance. The sources do not agree on the start date, so a business should ask its federal customer which date applies.
Removing a model from an automation is not always a quick swap. A workflow that reads documents or drafts replies may behave differently on another model. Testing, sign-off and a record of changes are needed before the switch. A person still decides whether a replacement is acceptable and checks the output.
What to watch next
Three things will show how far the order reaches. The first is the exception requests and CISA's written approvals or denials, which CyberScoop and BleepingComputer say CISA will issue. The second is any guidance on what counts as a product developed using DeepSeek implementations, which the notice does not define. The third is whether the Department of Defense or other agencies adopt similar orders.
This explains the rule in general terms; it is not legal or tax advice for your case.
Sources
How AiStaffo would automate this
For a business that automates routine work, AiStaffo would start with a model and tool inventory: each automated step for data entry, billing reconciliation, follow-ups and reports, with the AI model or vendor behind it recorded in one place. The system would flag any step that depends on a DeepSeek model, directly or through a third-party product, so the owner sees the list in one view. Routine checks, such as confirming which tool handled which record, would run automatically and produce a log. The owner or a named staff member would still decide on replacements, approve changes to customer-facing outputs and confirm the contract position with their own legal adviser. Book a free automation audit to map which of your workflows depend on which models.
Questions people ask
Does the DHS DeepSeek order ban DeepSeek for all US businesses?
What does the order mean for third-party software built on DeepSeek?
How long do agencies have to request an exception?
Which law is the DHS order based on?
Should a company stop using DeepSeek tools in its automations now?
Book a free automation audit
Thirty minutes. We look at one process you run every week and tell you exactly what an AI worker would take off your desk, and what it would not.
