DHS FASCSA Order 2026-01 Removes DeepSeek and Third-Party Products Built on It From Federal Civilian IT: Dated 24 July, Published 20 October 2026
On 13 September 2017 the Acting Secretary of Homeland Security, Elaine Duke, ordered every federal agency to find Kaspersky antivirus software on its networks. Binding Operational Directive 17-01 gave agencies 30 days to report what they found, 60 days to submit a removal plan and 90 days to begin taking the software out. The notice of that directive appeared in the Federal Register six days after it was issued. The target was a branded product from one company, and an inventory could find it by name.
Nine years later the Department has used a stronger statute against an artificial intelligence developer, and the object of the order is harder to find. A model can sit inside another vendor's product without carrying its maker's name.
What the Federal Register printed on 20 October 2026, and what sits behind the notice
The notice at 91 FR 66346, filed on 19 October and signed for publication by DHS General Counsel James H. Percival II, takes one page. It states that the Secretary has ordered two things: the exclusion of information technology products and services developed by DeepSeek and its affiliates from federal civilian procurements, and the removal of DeepSeek and affiliate products, "and third-party products and services developed using DeepSeek implementations," from civilian agency information technology. The signed order follows as an appendix printed as four images, pages 66347 to 66350, which do not appear in the Federal Register's text edition. Read from the printed PDF, they carry the operative terms.
The document is headed Exclusion and Removal Order #2026-01. It bears the signature of Secretary Markwayne Mullin, is copied to OMB Director Russell Vought, and gives an original release date of 24 July 2026; the signature itself is undated. It applies to federal civilian executive branch agencies, with their national security systems and sensitive compartmented information systems carved out; under the Act those belong to the Department of War, which the order's footnotes still call the Department of Defense, and to the Director of National Intelligence.
Practical takeaway. The DeepSeek order is dated 24 July 2026 and was published in the Federal Register on 20 October. Exclusion and removal are both stated to take effect on issuance, the 60-day agency exception window has likely already run if counted from that date, and the removal duty extends to any third-party product developed using DeepSeek implementations. Vendors selling AI into civilian agencies should expect to be asked what their models were built from.
How the Federal Acquisition Supply Chain Security Act of 2018 gave DHS this power
The Act, codified at 41 U.S.C. 1321 to 1328, created the Federal Acquisition Security Council to recommend excluding or removing risky products from federal procurement and systems. The Secretary of Homeland Security issues the resulting orders for civilian agencies, and the implementing rule at 41 CFR part 201-1 requires agencies to comply. The DeepSeek order says it followed review of a Council recommendation. Its stated risks are concrete: DeepSeek's servers are located in the People's Republic of China, Chinese law gives state cyber and intelligence functions broad access to private infrastructure, account creation collects personal information and may fingerprint users, prompts can carry sensitive government data to China, and outside researchers found critical flaws in the DeepSeek iOS app in February 2025. Several footnotes cite the House Select Committee on the CCP's April 2025 report "DeepSeek Unmasked".
The statute is more durable than the 2017 directive. A binding operational directive is a cybersecurity instruction to agencies. A FASCSA order reaches procurement as well as systems, and it flows into contracts through a standing clause.
Which dates the order sets: removal on issuance, exceptions within 60 days, review by July 2027
The required actions are short. Agencies must exclude DeepSeek, its affiliates and their products from procurements "effective immediately after issuance," including approved-products lists, e-commerce markets and similar purchasing channels. They must remove DeepSeek products and third-party products developed using DeepSeek implementations "immediately after the issuance of the Order, or seek an Exception." Exception requests go to DHS in writing within 60 days of issuance, with a compelling justification and any alternative mitigations; CISA reviews them and answers in writing. Until removal is complete, agencies are encouraged to monitor traffic, enhance logging and add controls on data exfiltration. The Secretary will review the order within one year and annually after that.
Read against the calendar, the sequence is unusual. If issuance means the 24 July release date printed on the order, the exception window closed on 22 September, and Federal Register publication came after that calculated window had closed. The order is addressed to agencies; the public notice is what reaches contractors and everyone else. The 2017 Kaspersky directive reached the Federal Register in six days. This one took 88, and the notice gives no reason for the gap.
What "developed using DeepSeek implementations" can reach
DeepSeek released its R1 reasoning model in January 2025 with open weights under the MIT license, which lets anyone download, modify and redistribute the model. Since then DeepSeek weights have been fine-tuned, distilled into smaller models and embedded in commercial software. The exclusion clause in the order, at its footnote 13, covers "third party implementations of DeepSeek used to provide products and services to civilian agencies." The removal clause covers products "developed using" those implementations.
Neither phrase is defined. A plain reading covers a vendor product that runs DeepSeek weights locally, where no data travels to China at all. A broad reading could cover a model distilled from DeepSeek outputs, or a product whose developers used DeepSeek during development. The order's own risk analysis concerns DeepSeek-hosted services and the app; the removal duty is written more widely than that analysis. The text also contains small inconsistencies that counsel will notice: the notice names "Hangzhou DeepSeek Artificial Intelligence Co., Ltd," the order names "Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.," and its affiliate footnotes refer to "DeepSeek AG."
For a federal contractor the mechanics run through FAR 52.204-30, in force since December 2023. Contractors must check SAM.gov for FASCSA orders at least every three months, make a reasonable inquiry when a new order could affect their supply chain and report covered products they find, including through subcontractor notices. Paragraph (b)(4) provides that an order issued after the solicitation enters a contract's prohibition only once it is added by amendment or modification. Paragraph (c) is separate: the quarterly check, the inquiry and the report can all be due before any modification, so contractors face the reporting questions now and the prohibition contract by contract. Quentir traced the same move from new purchases to equipment already installed in Executive Order 14421 on the bulk-power system; here the installed base is software, and its components are model weights.
How Quentir Reads It
The order turns model lineage into a procurement fact. An agency can apply the exclusion at the point of purchase, by turning down DeepSeek products and vendor offerings that use DeepSeek implementations. Compliance with the removal clause requires knowing which of its existing tools contain DeepSeek components, and that information sits with vendors and their suppliers. Software bills of materials list libraries and packages; they rarely say which base model a fine-tune started from, or which model generated the training data for a distilled one. The first practical effect of Order 2026-01 is likely to be questionnaires: civilian agencies and prime contractors asking AI vendors to state, in writing, what their models were built from.
The people affected reach well past Washington. Federal employees will lose tools they may have adopted without knowing their origin. Small developers who built on open weights because they were free and capable now face a lineage question that falls hardest on products that started from someone else's model. For citizens, the order narrows one path by which data entered into a government service could reach servers abroad. The definition of "implementations" will decide how wide each of those effects becomes, and the annual review due by July 2027 is the first fixed date on which DHS must look at it again. Quentir's All-access membership keeps this order beside the earlier analyses of federal supply-chain instruments, so the next exclusion can be read against the ones already issued.
Sources: Department of Homeland Security, "Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements," 91 FR 66346, FR Doc 2026-21447, Docket DHS-2026-0628, published 20 October 2026, with the signed Exclusion and Removal Order #2026-01 (original release date 24 July 2026) printed as images at 91 FR 66347-66350 in the GPO PDF edition; Federal Acquisition Regulation, 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition (Dec 2023); Department of Homeland Security, "Notification of Issuance of Binding Operational Directive 17-01," 82 FR, FR Doc 2017-19838, published 19 September 2017 (directive issued 13 September 2017); DeepSeek, DeepSeek-R1 repository and MIT license; House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, "DeepSeek Unmasked," 16 April 2025. The 22 September date is a calculation from the order's printed release date and its 60-day exception window.
Published intelligence, built to inform your own decisions. Published: October 20, 2026.