- A DHS order, as reported by The Hacker News, bars federal civilian agencies from DeepSeek products and from third-party products "developed using DeepSeek implementations."
- The notice does not define that phrase. DHS filed the July 24 order for public inspection 87 days later, so vendors must judge its reach themselves.
- Contractors should check for FAR clause 52.204-30 and list which AI models sit inside the products they sell and buy.
An AI model is a part, not just a product
Most organisations think of an AI model as something they buy. A new federal order treats it as something they may already contain.
That is the idea worth taking from it. AI models now travel inside other vendors' software. A ban on one model is only as strong as your ability to see where it sits.
The Hacker News reports that a Department of Homeland Security (DHS) order tells US federal civilian agencies to take DeepSeek products out of their IT systems. The order does not stop at DeepSeek's own tools. Outside software or services built with DeepSeek technology must go as well. Agencies also may not buy new IT from the Chinese AI developer or its affiliates.
What the order says
The Hacker News says Secretary Markwayne Mullin signed the order on July 24, 2026. It was issued under a 2018 supply chain law, the Federal Acquisition Supply Chain Security Act. The Federal Register carried it on October 20.
The named target is Hangzhou DeepSeek Artificial Intelligence Co., Ltd., maker of the R1 and V3 models. Its affiliates, as federal buying rules define them, are included. The Hacker News adds that DeepSeek's privacy policy describes user data being collected, handled and stored in China.
The scope is narrow. According to The Hacker News, the order applies to what civilian agencies buy and run. Private companies and the public face no limit under it. Defense and intelligence agencies answer to other officials, who can issue their own orders.
How an order travels from agency to supplier
Under the 2018 law, a federal council recommends orders. One of three officials then issues each one, depending on which part of government is involved. Agencies "shall comply," the law says.
An agency can ask the issuing official for an exception. The Hacker News says the request must be in writing and make a strong case.
Contracts carry the order further. The Hacker News reports that a federal contract with FAR clause 52.204-30 stops the contractor from supplying or using covered products while doing the work. Only a waiver from the issuing official lifts that bar.
So a supplier can be affected without selling DeepSeek by name to anyone. A product built on DeepSeek technology may be enough.
One limit applies. If an order arrives after a contract solicitation, it reaches an existing contract only when the contracting officer amends the contract, The Hacker News reports.
Three gaps the notice leaves open
First, the key term. The Hacker News reports that the notice does not define "DeepSeek implementations." Does it cover a product that calls DeepSeek's online service? One that embeds the model itself? One tuned from a DeepSeek model? The reporting does not say. Vendors and agencies must make their own call.
Second, reasons. The Hacker News reports that the Federal Register notice gives none. The signed order is a four-page scan attached to the notice. A copy is also filed under docket DHS-2026-0628 on regulations.gov.
Third, timing. DHS filed the July 24 order for public inspection 87 days later, on October 19, and published it the next day. That is according to The Hacker News.
The council's rules leave public release to the issuing official and set no deadline. The reporting does not say whether agencies or contractors heard about the order earlier. It does say the law requires notice to the named company and to congressional committees.
Why this matters beyond Washington
Until now, US limits on DeepSeek were device bans, each adopted by a single body. The Hacker News says Texas and four federal bodies had blocked it on government devices by February 2025. The federal four were Congress, NASA, the Navy and the Pentagon.
Bills to bar DeepSeek from government devices were introduced in the House and Senate that month. They were still in committee on October 21, the outlet reports.
This order is different in kind. It reaches into buying and supply, not only phones and laptops.
The law had its first use in 2025, The Hacker News says. The Director of National Intelligence shut Acronis, a Swiss cybersecurity firm, out of intelligence community buying and ordered its products removed from those systems. Two uses of a tool are not yet a pattern.
China's foreign ministry spokesperson Mao Ning said on October 20 that China "consistently opposes the overstretching of the concept of national security."
Questions to put to your team
If you sell to federal civilian agencies, start with your contracts. Ask whether any carry FAR clause 52.204-30. Ask who tracks new supply chain orders against them.
Then ask for a list of the AI models inside the software you sell and the software you buy. Which models does each product call or embed? Who can confirm it? A vendor that cannot answer has a problem, whatever the order's final reach.
DHS points anyone with questions to a CISA team that handles these orders. Its email is [email protected].
A software bill of materials once listed libraries. The next version has to list models too. The order leaves a key term undefined, and you can only comply with it if you know what is inside your products.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: U.S. Department of Homeland Security.
