The US Department of Homeland Security has published an order that bans DeepSeek from federal civilian agencies. It goes further than most of the headlines suggest. Agencies must stop buying DeepSeek products, and they must also remove “third-party products and services developed using DeepSeek implementations” from their IT systems. In other words, the ban reaches software that runs on DeepSeek under the hood, not just the DeepSeek app.
The Federal Register notice (document 2026-21447) was filed for public inspection on 19 October at 08:45 Washington time and formally published today, 20 October. It gives notice of an order already issued under the Federal Acquisition Supply Chain Security Act of 2018. CyberScoop broke the story on Monday, and CNBC and the WSJ followed.
What the order actually says
The signed order is attached as an appendix to the public inspection PDF. It is titled “Exclusion and Removal Order #2026-01”, it is signed by Homeland Security Secretary Markwayne Mullin with OMB director Russell Vought copied, and it gives an original release date of 24 July 2026. (CyberScoop’s write-up puts the letter at 26 June. The order itself says 24 July, so we’re going with the document.) The order has been in force for nearly three months and is only now public.
It requires all federal civilian executive branch agencies to do two things:
- Exclude DeepSeek, its affiliated entities and their products from procurement. That includes approved-product lists, service-provider equipment lists and e-commerce marketplaces used for government buying.
- Remove products from DeepSeek and its affiliates, plus third-party products built on DeepSeek, from agency IT systems. A footnote spells out that this covers “third party implementations of DeepSeek used to provide products and services to civilian agencies”.
Agencies could ask for an exception, but only in writing within 60 days of the order being issued, with a “compelling justification” such as a mission-critical function. On a 24 July issue date, that window closed around 22 September, a month before anyone outside government could read the order. National security systems, the Department of Defense (called the “Department of War” in the order) and the intelligence community are outside its scope.
The stated risks are familiar: data stored on servers in China, PII collection and digital fingerprinting by DeepSeek-hosted services, a “prompt and response” design that “may result in the transfer of sensitive data”, and the NowSecure findings on the DeepSeek iOS app from February 2025. Agencies are told to step up logging and exfiltration monitoring until DeepSeek is fully removed.
Why search and SEO vendors should read the footnotes
The timing is awkward for DeepSeek. Three days ago it opened its in-house search engine to developers through paid Search and Fetch APIs, and it has been actively courting agent builders through DeepSeek Harness. The pitch is cheap, open-weight and good enough, and it has worked: a lot of Western SEO, content and research tools now route some of their work to DeepSeek models, often without saying so in the UI.
Under this order, any of those tools sold into a US civilian agency is now a compliance problem. That covers a rank tracker that summarises SERPs with DeepSeek, a content tool that drafts with deepseek-flash, and a research agent grounded on DeepSeek’s new search endpoint. The wording “developed using DeepSeek implementations” is broad. It does not obviously separate calling DeepSeek’s hosted API from running the open weights on your own US servers. That difference matters a lot technically, and the order’s risk section focuses on DeepSeek-hosted data, but the scope language doesn’t draw the line. Expect procurement teams to read it conservatively.
Notably, DeepSeek is the only model maker named. Qwen and Kimi, which US officials have raised in the same breath, are not covered, and nor is anything built on them. If you’re a vendor quietly swapping models, that is the obvious next move.
Our take
For most readers this will not change much day to day. Federal civilian agencies were never a big buyer of Chinese-model SEO tooling, and many had already blocked DeepSeek at their own discretion. The bigger story is the precedent. Supply-chain orders now reach derivative software by model lineage, and that is a disclosure requirement in all but name. If you sell search, analytics or content tools to the public sector anywhere, start documenting which models sit behind which features. The next order may not come with a published exception window either.
It is also another reminder that DeepSeek’s international story keeps splitting in two. In China it is becoming search infrastructure; we covered the funding round and the outage refund this month. In the US public sector it is now formally radioactive. More DeepSeek coverage is in our DeepSeek category.