> ## Content Index
> Fetch the complete content index at: https://unhyd.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# DHS DeepSeek Order Becomes Public: What Federal Agencies Must Remove
- URL: https://unhyd.com/article/dhs-deepseek-order-federal-civilian-agencies/
- Published: 2026-10-19T17:15:30.000Z
- Updated: 2026-10-19T17:15:30.000Z
- Description: The newly published notice reveals a July 24 directive covering both DeepSeek products and certain third-party implementations, with important limits on which systems are affected.
- Author: Unhyd Editorial
- Tags: Technology, DeepSeek, Federal Technology, Cybersecurity, Government Procurement, AI Policy, Supply Chain Security, #home-featured-top

The **DHS DeepSeek order** became public in a federal notice on October 19, but the signed directive itself carries an earlier date: July 24, 2026\. That distinction is central to understanding the news. The Department of Homeland Security did not describe a brand-new nationwide ban on the Chinese AI developer's tools this morning. Instead, a [Federal Register public-inspection filing](https://public-inspection.federalregister.gov/2026-21447.pdf?ref=unhyd.com) disclosed a previously issued exclusion-and-removal order for federal civilian executive branch information technology and procurement.

The order reaches beyond software sold directly by DeepSeek. It also instructs covered agencies to remove third-party products and services developed using DeepSeek implementations. That is potentially consequential for government IT inventories, because a service can depend on an AI model even when the model maker's name is not prominent in the interface.

## The date matters: July order, October notice

The appendix to the six-page notice identifies the original release date as **July 24, 2026**. The public-inspection document says it was filed October 19 at 8:45 a.m. Eastern and scheduled for Federal Register publication on October 20\. The fresh development is the public disclosure of the signed order and its detailed scope, not proof that the government first adopted the restriction on October 19.

That timeline also changes how readers should interpret deadlines. The text tells covered agencies to exclude affected products from procurement and remove covered technology immediately after issuance, or seek an exception. Its written exception-request process refers to 60 days from issuance of the order—not 60 days from publication of the public notice. The document does not say whether every agency has completed removal or how many exceptions, if any, were granted.

[Reuters reported the public notice](https://www.reuters.com/technology/us-banning-chinese-ai-deepseek-government-agency-it-systems-2026-10-19/?ref=unhyd.com) on October 19 and quoted DHS's concerns about sensitive data potentially reaching China. Those are the government's stated risk assessments. The notice does not supply a public audit proving that every DeepSeek deployment in a federal environment has leaked sensitive information.

## Two duties: stop buying and remove what is installed

The order has two operational parts. First, it excludes DeepSeek and affiliated entities' IT products and services from covered civilian-agency procurements. The appendix specifies that the exclusion reaches approved product lists, service-provider equipment lists, e-commerce markets and other procurement mechanisms. That is a forward-looking purchasing restriction.

Second, it directs removal from existing agency IT systems of DeepSeek and affiliated products, plus third-party products and services developed using DeepSeek implementations. That is an installed-base requirement. The two duties should not be collapsed: preventing new purchases does not, by itself, remove software that is already in use.

The third-party provision deserves particular attention. It could require agencies to look beyond direct contracts with DeepSeek and determine whether vendors supply applications or services built using DeepSeek implementations. The exact technical and contractual steps will depend on agency inventories and vendor disclosures. The public notice does not identify every third-party product that might be covered.

![Diagram showing the DeepSeek order applies to federal civilian executive branch information technology, bars future procurement, requires removal of existing DeepSeek and certain third-party implementations, and permits written exception requests.](https://storage.ghost.io/c/df/e4/dfe4d080-643c-453a-8a60-0452bdbc0efd/content/images/2026/10/dhs-deepseek-order-scope-2026-unhyd.png)

The July 24 order directs covered federal civilian agencies to exclude DeepSeek products from procurement and remove DeepSeek and certain third-party implementations from agency IT. The public notice was filed October 19\. Agencies can seek written exceptions; the directive is not a nationwide consumer ban.

## Which agencies and systems are covered?

The document addresses **federal civilian executive branch agencies**. Its appendix excludes national security systems and sensitive compartmented information systems from this DHS order's civilian scope, reflecting separate authorities for the Department of Defense and intelligence community. The [federal acquisition rule](https://www.acquisition.gov/node/59401/printable/print?ref=unhyd.com) likewise distinguishes DHS, defense and intelligence supply-chain orders.

Nothing in this particular notice establishes a blanket prohibition on private individuals in the United States using DeepSeek, a general ban on the model's public availability, or an automatic rule applying to every state and local government. Those are different legal and policy questions. Likewise, it would be premature to conclude that every private vendor using an open model is barred from all federal work; the order addresses specified products, implementations and covered procurement and IT systems.

The risk also intersects with a broader issue Unhyd has examined in its coverage of [unapproved workplace AI tools](https://unhyd.com/article/ncsc-shadow-ai-workplace-security-guidance/): organizations may not have a reliable inventory of where AI capabilities have been embedded. A model can be introduced through a plugin, a vendor feature or a background service rather than through an obvious standalone application.

## What the exception process and interim controls say

The order permits written exception requests to the DHS issuing official, including requests tied to a particular agency, activity or delay in compliance. The appendix calls for identification of the affected order, a description of the requested exception, justification and proposed alternative risk mitigations. It says CISA will review exception requests and provide a written approval or disapproval. The published text does not list actual exception decisions.

During the interval between issuance and full removal, agencies are encouraged to monitor traffic flows, enhance logging, control data exfiltration and flag anomalous activity. These are interim cybersecurity measures, not an alternative that automatically cancels the removal requirement. They also reflect a familiar principle from Unhyd's [permission-first AI security guide](https://unhyd.com/article/ai-agent-security-permission-first-guide/): model access and data pathways matter as much as the name of the application at the surface.

## What agencies and vendors should verify next

For federal technology teams, the practical questions follow from the actual wording: which installed tools depend on DeepSeek implementations, which suppliers can document their model dependencies, which procurement catalogs contain covered products, and whether any exceptions have been requested or approved. Those are analytical questions prompted by the order, not findings that particular agencies are noncompliant.

For the public, the clearest conclusion is narrower than a headline about banning Chinese AI everywhere. A July federal civilian IT order is now publicly documented; it restricts procurement, calls for removal and reaches certain third-party implementations. The filing does not provide an agency-by-agency compliance report, and the distinction between issuance and disclosure should remain explicit in any follow-up coverage.