DHS ordered every federal civilian agency to rip DeepSeek out of its information technology on October 19, and the part that matters is one clause: the ban covers “third-party products and services developed using DeepSeek implementations.” A vendor naming DeepSeek in its docs is procurement-excluded just like DeepSeek’s own product line. The order is real, signed, and publishes in the Federal Register on October 20 as doc 2026-21447 under docket DHS-2026-0628.
The mechanism, and why it is bigger than a ban
The authority is the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328, implemented at 41 CFR 201-1), used here for the first time against a frontier AI lab. After a Federal Acquisition Security Council recommendation, the Secretary ordered two things: exclusion of DeepSeek products, services, and affiliated entities from all federal civilian procurement; and removal of DeepSeek plus anything built on DeepSeek implementations from civilian agency systems. Contact for implementation questions goes to CISA’s FASCSA Order Implementation Team. Actual deadlines will arrive as GSA and agency CIO follow-on guidance, which is how these orders usually land: the order names the scope, the memoranda name the dates.
The scope phrase “developed using DeepSeek implementations” is the whole story. An order against a vendor is a procurement rule: you stop buying their thing. An order against a model, named as an implementation, reaches every company that put the model under the hood of something else: API resellers, coding-assistant products, agent platforms, any contractor tooling whose pipeline calls a DeepSeek checkpoint. Agencies now have to inventory not just “do we have DeepSeek” but “what in our stack eventually calls DeepSeek,” which is a harder question and the one supply-chain law is designed to force.
What stays legal
The weights are untouched. DeepSeek’s checkpoints - V4.1 Flash 1017, V4.1, the R-class reasoning models - are MIT-licensed, sitting on Hugging Face with tens of thousands of downloads, and running outside a federal civilian agency is unchanged law. States, cities, companies, and homelabs keep operating as before. Two separate policy threads often get mashed together here, so untangling: China’s draft export-control update would require licenses to ship certain AI technologies out of China, which matters to the supply side of open weights; the DHS order is a demand-side answer on the US federal market. One licenses what Beijing lets leave, the other governs what Washington keeps buying. Nothing in the US order amends the licenses on the files.
The precedent is the part to watch. FASCSA orders name supply-chain risk, and a legal instrument that reached from one vendor to “every implementation of their model” now exists in the federal register. The same instrument could name any lab. The unanswered question for procurement lawyers - whether open-weight provenance can ever pass a FASCSA review when the weights keep updating upstream - now has a live test case with docket number DHS-2026-0628.
For the modeldex
Our DeepSeek rows stay runnable and stay listed: nothing here changes what you can run on your own hardware, which is the site’s editorial line. For anyone shopping the fit tables for US government-adjacent work, the ordering is now explicit: DeepSeek checkpoints and anything embedding them are out of federal civilian scope until the guidance says otherwise, and the three small HN threads (top: 14 points as of Monday) suggest most of the industry has not priced in the third-party clause yet.
Sources: Federal Register doc 2026-21447 (DHS-2026-0628) - Reuters: US banning Chinese AI DeepSeek from government agency IT systems - Quartz: DeepSeek barred from civilian agencies
Related on this site: China’s export draft leaves published weights alone - Twenty-one ways to run a model locally: the engine catalog - DeepSeek V4.1 Flash (model page)