# DHS order reaches DeepSeek-based tools in federal civilian IT > A DHS order directs federal civilian agencies to exclude DeepSeek-related technology from purchases and remove covered products from IT systems, including third-party implementations. By BIG CHANGE Editorial Published: 2026-10-20T09:06:38.027Z Updated: 2026-10-20T09:06:38.027Z Canonical: https://bigchange.ai/blog/dhs-deepseek-federal-civilian-it-order ![Conceptual charcoal illustration of an unmarked office building with a thin orange line along parts of its outer edges.](https://bigchange.ai/api/media/file/dhs-civilian-scope-building-hero-v1.png) AI-generated conceptual illustration by BIG CHANGE. Federal civilian agencies must exclude DeepSeek-related products from technology purchases and remove covered products from their IT systems under a [Department of Homeland Security order](https://public-inspection.federalregister.gov/2026-21447.pdf). The signed order reaches some third-party tools built with DeepSeek implementations, so identifying the developer on a contract or an app screen alone may not establish whether a product is covered. The order's original release date is July 24, 2026. DHS filed the notice for public inspection on October 19, and the Federal Register scheduled publication for October 20. Those October dates disclose the order; they are not the dates on which the signed order says the required actions begin. ## The big change - **What changed:** A federal supply-chain order now makes DeepSeek implementation a question for civilian agency procurement and system inventories, including third-party services built with that technology. - **Why it matters:** An agency and its suppliers need to establish what a product uses, as well as who sells it. The order directs immediate exclusion from covered purchases and removal from covered IT, subject to its stated scope and exception process. - **What to watch:** The practical boundary will turn on product identification and agency exception decisions. The order provides a written request route and calls for DHS to review the order within one year and annually afterward; it does not report how many products or agencies are affected. ## Two required actions, both tied to issuance [Exclusion and Removal Order #2026-01](https://public-inspection.federalregister.gov/2026-21447.pdf) directs federal civilian agencies to exclude DeepSeek, its affiliated entities and their products from civilian agency procurements. A footnote says this includes third-party implementations of DeepSeek used to provide products and services to those agencies. The procurement instruction covers agency-approved product lists, service-provider equipment lists, e-commerce markets and similar channels that facilitate purchases of IT hardware, software and services. The separate removal instruction covers products supplied by DeepSeek or an affiliate, as well as third-party products and services developed using DeepSeek implementations, in civilian agency IT systems. Both instructions say action is required immediately after the order's issuance. The document does not give agencies a general 60-day period to complete removal. The order applies to federal civilian executive-branch agencies except for their national security systems and secure compartmented information systems. It describes the Homeland Security secretary's authority as distinct from orders for Defense Department and intelligence-community systems. It does not impose a general restriction on private-sector use of DeepSeek. ## An exception request has a 60-day filing window An executive agency may ask the DHS issuing official to make an exception for the agency, particular actions or a delay in compliance. The request must be in writing within 60 days of the order's issuance. It must identify the order and the requested exception, name or describe the covered product or service, explain the justification and identify alternative ways to reduce the risk. The signed order says CISA will review requests and provide a written approval or disapproval. That filing window is different from a general transition period: the order calls for immediate action or an exception request. Until covered products are fully removed, it *encourages* agencies to monitor traffic into and out of their systems, strengthen logging and controls on data exfiltration, and detect anomalous activity. It also says CISA may provide technical help to agencies that lack sufficient internal capability. For a vendor serving a civilian agency, the first question is whether a supplied product or service uses a DeepSeek implementation, including one incorporated by another provider. For the agency, the order makes that answer relevant to both purchasing channels and existing systems. The signed text does not list specific third-party products, quantify deployments or say that a pending exception automatically suspends either required action. ## DHS's stated grounds DHS says it acted under the Federal Acquisition Supply Chain Security Act after reviewing a Federal Acquisition Security Council recommendation and associated evidence. In the signed order, the department points to possible transfer of sensitive information through prompts, potential access to company infrastructure under Chinese law, and cited research on vulnerabilities in DeepSeek's iOS app. These are DHS's stated reasons for its supply-chain decision. The public notice and appendix do not establish that every covered deployment transmitted sensitive federal data or that every third-party implementation has the same technical risk. ## Sources - [DHS notice of order, Federal Register document 2026-21447](https://public-inspection.federalregister.gov/2026-21447.pdf) — The first two pages summarize the procurement exclusion and IT removal, identify the statutory authority, and record filing on October 19, 2026, for scheduled publication on October 20. The notice alone does not set out the exception procedure. - [Signed Exclusion and Removal Order #2026-01, appendix to the DHS notice](https://public-inspection.federalregister.gov/2026-21447.pdf) — Pages three through six carry the order's July 24 original release date, federal civilian scope, immediate required actions, written exception process and interim measures. It does not identify specific third-party products or report how many agencies have removed covered technology.