Contractor inquiries and reporting deadlines
DHS published notice of Exclusion and Removal Order No. 2026-01 in the Federal Register on October 20, 2026. The order had already taken effect upon issuance on July 24, 2026.
Wiley Rein says immediate action may be required for contractors whose contracts were awarded by an agency other than the U.S. Department of Defense and contain FAR 52.204-30 or RFO FAR 52.240-91. Those clauses require a reasonable inquiry to determine whether contractors supplied the government with covered DeepSeek products or services or used them to perform a contract. The inquiry must also account for items supplied by subcontractors.
The review extends beyond DeepSeek's own offerings to products from its affiliates and third-party products or services developed using DeepSeek. Contractors that identify covered items must report them to the government within three business days. They also cannot supply DeepSeek products or services to the government or use them in future performance of civilian agency contracts.
Crowell & Moring's October 21, 2026 client alert details an additional requirement under FAR 52.204-30: contractors must notify the contracting officer within three business days of discovery and update the report with mitigation actions within ten business days.
The reach of the civilian order
The order targets Hangzhou DeepSeek Artificial Intelligence Co., Ltd, a privately owned Chinese company that produces free, widely available AI applications, and its affiliated entities. Civilian agencies must exclude their products from procurement, including approved-product lists, service-provider equipment lists and e-commerce marketplaces. Agencies must also remove DeepSeek and affiliate products, as well as third-party products and services developed using DeepSeek implementations, from their IT systems.
Akin Gump's October 20, 2026 analysis says the order covers federal civilian executive branch agencies but excludes their national security systems and secure compartmented information systems.
The third-party provision makes the civilian order broader than separate defense and intelligence orders, according to Crowell & Moring. Those orders appear to reach only applications and services that implement a DeepSeek AI model. Crowell interprets the civilian order as potentially reaching products or services developed through DeepSeek's coding assistant as well.
Security findings and agency exceptions
According to Wiley Rein, DHS and the Federal Acquisition Security Council identified several risks from DeepSeek use: sensitive U.S. government data could be transferred to China, U.S. persons and agencies could be targeted for intelligence collection, and systems could be exposed to malware and other cybersecurity vulnerabilities.
Akin Gump says the order specifically cites DeepSeek's servers being located in China and the collection of personally identifiable information during account creation for DeepSeek-hosted instances of its models. CNBC also reported that the order cited open-source research finding multiple critical vulnerabilities in DeepSeek's iOS app.
Agencies had a 60-day window from the order's issuance to seek an exception in writing, according to Akin Gump. The Cybersecurity and Infrastructure Security Agency reviews those requests and issues written approvals or disapprovals. CNBC reported that requests could include compliance delays and required written justification to DHS.
Secretary of Homeland Security Markwayne Mullin issued the order under the Federal Acquisition Supply Chain Security Act of 2018, or FASCSA, after reviewing a Federal Acquisition Security Council recommendation, Akin Gump says. The secretary will review the order within one year and annually afterward.
Separate defense and intelligence restrictions
FASCSA established the Federal Acquisition Security Council to address supply-chain risks in federal purchasing and IT systems. Its recommendations go to three authorities: DHS for civilian agencies, the Department of War for defense agencies, and the Director of National Intelligence for Intelligence Community agencies and contracts involving sensitive compartmented systems, according to Crowell & Moring.
Crowell's October 21 alert says the Department of War and the Director of National Intelligence issued separate orders requiring DeepSeek products and services to be excluded and removed. Those orders appear in the downloadable FASCSA orders spreadsheet on the SAM.gov contracting portal. Unlike the DHS order, they do not detail the reasons for excluding DeepSeek.
State restrictions preceded the federal action
State governments had imposed DeepSeek restrictions before the federal order. The National Law Review reported on April 2, 2025 that Oklahoma Governor Kevin Stitt announced a ban on DeepSeek on all state-owned devices on March 21, 2025. Alabama Governor Kay Ivey followed with a March 26 memorandum banning both DeepSeek and Manus from the state's IT network and devices.
The same report said 21 state attorneys general had urged Congress to pass the "No DeepSeek on Government Devices Act."
