Today's briefing covers one Federal Register notice: the Department of Homeland Security's publication of Exclusion and Removal Order #2026-01, issued under the Federal Acquisition Supply Chain Security Act, which bars products and services from Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates from federal civilian procurement and orders their removal from civilian agency information technology. The removal duty extends to third-party products and services developed using DeepSeek implementations, and agencies that need more time or a narrower scope must request an exception in writing within 60 days of the order's issuance.
The Department of Homeland Security published notice on 2026-10-20 (Docket No. DHS-2026-0628, 91 FR 66346) of an order by the Secretary of Homeland Security under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328) and its implementing regulations at 41 CFR part 201-1, issued after review of a Federal Acquisition Security Council recommendation and affiliated evidence. The signed order, reproduced in the notice's appendix, carries an original release date of 2026-07-24 and applies to federal civilian executive branch agencies except for their national security systems and secure compartmented information systems.
It requires agencies to (1) exclude DeepSeek, its affiliated entities as defined in 48 CFR 2.101, and their products from civilian agency procurements, effective immediately after issuance, including agency-approved product lists, service provider equipment lists, e-commerce markets and similar functions that facilitate IT procurement; and (2) remove products provided by DeepSeek and its affiliates, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems immediately after issuance, or seek an exception. The order's risk summary states that DeepSeek's servers are located in the People's Republic of China, whose legal system permits extensive authority for government cyber and intelligence functions to access private company infrastructure; that account generation for DeepSeek-hosted models collects personally identifiable information and may track and digitally fingerprint users; that its prompt-and-response applications may transfer sensitive data to the PRC if used by U.S. government employees or vendors; and that the models may contain malware or other security vulnerabilities.
Exception requests go to the DHS issuing official under 41 CFR 201-1.304(b) and must be submitted in writing within 60 days of the order's issuance. Each must identify the order, the exception sought, and the covered product or service, give a compelling justification such as the impact on mission-critical functions or national-interest considerations, and describe any alternative mitigations; CISA reviews the requests and provides written approval or disapproval. Until covered articles are fully removed, agencies are encouraged to monitor traffic in and out of the agency, implement enhanced logging and data-exfiltration controls for the relevant systems, and detect and flag anomalous activity. CISA may provide technical assistance to agencies that lack the capability to comply, and the Secretary will review the order within one year and annually thereafter.
The removal duty reaches past the named vendor: third-party products and services developed using DeepSeek implementations must also come out of civilian agency IT, so suppliers to civilian agencies need to know which of their offerings were built that way, and agencies need to look for embedded use, not only direct purchases. Agencies should check approved-product lists and deployed systems, apply the interim logging and exfiltration controls while removal is under way, and confirm with CISA how the 60-day exception window is counted, since the order carries an original release date of 2026-07-24 while the Federal Register notice is dated 2026-10-20.
