DHS Banned DeepSeek From Federal Agencies, and the Order Follows the Model Into Anything Built On It. Here's the 20-Minute Audit If You Sell to Government.
The Department of Homeland Security's DeepSeek order hit the Federal Register on October 20, and the sentence that matters for software vendors is short. The notice covers "third-party products and services developed using DeepSeek implementations." If you are a solo builder with a government customer, or a customer who resells to one, your model list just became something a buyer can ask about.
This is not a ban on you. It is a rule about what federal civilian agencies may buy and run. But the rule is written so that the exclusion follows the model, not just the company, and that is the part to take seriously.
What the order says
The order is numbered DHS-2026-0628 and was issued by the Secretary of Homeland Security under the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328. The notice was filed for public inspection on October 19 and published in the Federal Register on October 20. Secondary coverage says the order itself is dated July 24, 2026.
It excludes IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates from federal civilian procurement. It also directs removal of those products, and of the third-party products and services built using DeepSeek implementations, from civilian agency IT. National security systems fall under separate authorities. Coverage from BleepingComputer states plainly that it is not a general ban on private or consumer use.
What it does not say
The notice, as filed, does not explain how "developed using DeepSeek implementations" applies to a product that merely offers DeepSeek as one selectable option, or one that calls a hosted DeepSeek-derived model, or one that self-hosts open weights. Commentary from The Neuron makes the same point: the procurement consequences for vendors are potential, not spelled out. The reported exception process runs through CISA, and the coverage I read says requests are due within 60 days of issuance. Since the order is dated July 24, I cannot tell from secondary sources whether that clock has already run, and the filed notice text I could read did not include the procedure. If this matters to your contract, read the notice and write to the implementation team at fascsa.orders@cisa.dhs.gov.
I want to be careful here: I am not a lawyer, and nothing above is legal advice. What I can do is describe the practical exposure, which is a buyer's procurement office asking a question you have no ready answer for.
The 20-minute audit
Open your codebase and answer these in a single document you can send on request.
First, list every model your product can call, by provider and by name, including defaults, fallbacks and anything gated behind a feature flag. Second, mark each one: DeepSeek or a DeepSeek derivative, or not. Fine-tunes and distilled models are where people get surprised, so check the base model of anything you did not train yourself. Third, note where each model runs: your infrastructure, a cloud provider's hosted endpoint, or a third party's API. Fourth, record whether a customer can switch a DeepSeek-based option on, and whether you can disable it per customer.
If the answer to the last question is no, fix that first. A per-tenant allowlist of models is a small change and the cheapest way to answer "can you guarantee this is off for our agency."
What I'd actually do
If you have federal civilian customers, or sell through someone who does, remove DeepSeek-based options from those tenants now and tell the customer in writing that you did. It costs you little, since you can keep serving the same feature from another model, and it keeps a procurement question from becoming a contract problem.
If you have no government exposure, do the inventory anyway but don't rip anything out. The order doesn't reach you. Its value is as a preview: model provenance is becoming a thing buyers ask about, and the vendors who can answer in one page are the ones who close.
Where this could be wrong
The order's reach into self-hosted open weights is untested. It is plausible agencies read it narrowly, covering only products that ship DeepSeek weights, and a vendor who uses a DeepSeek-derived model internally for something invisible to the customer is never asked. It is also plausible they read it broadly. Until CISA's exception decisions or guidance appear, I would plan for the broad reading in any federal deal and the narrow one everywhere else.
Author
Lukas
@lukcombinatorSources
DHS bans DeepSeek products across US federal civilian agencies, BleepingComputer What DHS's DeepSeek Order Means for AI Software Vendors, The Neuron Federal Register public inspection filing 2026-21447