IC Technology & Cyber — 2026-10-21

DHS Bans DeepSeek Products Across Federal Civilian Agencies Using Supply Chain Authorities

BLUFConverting a chatbot ban into a full supply chain audit will force federal integrators to map underlying AI models across their product lines, creating procurement friction that extends well beyond DeepSeek itself.

DHS, citing the Federal Acquisition Supply Chain Security Act and a Federal Acquisition Security Council review, barred civilian federal agencies from procuring products and services from Hangzhou DeepSeek Artificial Intelligence, its affiliates, and third-party tools built on its models, per a Federal Register notice 123. The notice reproduces Secretary Markwayne Mullin's June 26 exclusion letter, though TechSpot, citing AP, dates the order to late July 13. Mullin cited China-based servers, PII collection, possible transfer of sensitive prompt data to Beijing, and potential malware 12. Agencies have 60 days to remove DeepSeek and may request exceptions from CISA with "compelling justification"; DoD national security systems are excluded 2. China's Foreign Ministry spokesperson Mao Ning on Tuesday accused Washington of politicizing technology and trade 3.

Analysis
Civilian agencies must purge DeepSeek and any vendor software built on its models within 60 days, turning a chatbot ban into a software supply chain audit. Integrators selling AI-enabled products to federal buyers now must trace which model underlies each product, which many cannot do today. The order has been in force since at least late July, so agencies and contractors have already operated under it while the public notice lagged. CISA waivers require compelling mission justification and will be narrow, and DoD national security systems fall outside the order. The order may instead mostly formalize restrictions agencies already imposed, with limited operational effect beyond signaling to Beijing and to Chinese open-weight developers such as Moonshot and Alibaba. Confidence is high: four outlets agree on scope, deadlines and exemptions, though all draw on the same Federal Register notice (one also on AP), so independence is limited and the order's date is the only discrepancy.

4 sources