DHS Dated Its DeepSeek Ban July 24. It Reached the Federal Register on Tuesday, 28 Days After the Exception Deadline.

On Tuesday, October 20, 2026, the Federal Register published a Department of Homeland Security notice that takes DeepSeek out of the federal civilian government. Agencies may no longer buy from Hangzhou DeepSeek or its affiliates. They must remove what they already run. And the removal reaches "third-party products and services developed using DeepSeek implementations."

The ban made headlines. Fewer people read the four pages attached to it. The signed order, Exclusion and Removal Order #2026-01 from Homeland Security Secretary Markwayne Mullin, carries an "Original Release Date" of July 24, 2026. That is 88 days before the public notice.

The date matters because of one sentence. Agencies that want an exception must ask "in writing within 60 days of the issuance of this order." Count 60 days from July 24 and the window closed on Tuesday, September 22. The order became public 28 days later.

What the Order Actually Says

The authority is the Federal Acquisition Supply Chain Security Act of 2018, the law that set up the Federal Acquisition Security Council. The notice says Mullin acted after reviewing a council recommendation and "affiliated evidence." Here is the timeline from the documents themselves.

The order covers federal civilian agencies except their national security systems and secure compartmented information systems. Those belong to the Pentagon and the Director of National Intelligence. An exception request has to identify the product, give a "compelling justification," and propose mitigations. CISA reviews the requests. Until removal is complete, agencies are "encouraged" to watch traffic, add logging, and put controls on data exfiltration.

One more date is in play. CyberScoop described a Mullin letter dated June 26. The four-page order in the docket shows July 24 as its original release date, and we did not find a June 26 date in it. Either way, the clock started months before Tuesday.

The Phrase Nobody Defined

The DeepSeek app is the easy part. Navy and NASA staff were told to stop using the chatbot in early 2025, as BankInfoSecurity notes. The hard part is "third-party products and services developed using DeepSeek implementations." The order never defines that phrase, and it names no third-party product.

That matters because DeepSeek's weights are open, and US clouds sell them. AWS made DeepSeek-R1 fully managed in Amazon Bedrock in March 2025 and added DeepSeek-V3.1 on September 18, 2025. Google's Vertex AI documentation lists five DeepSeek models offered as managed APIs, including V4.1 Flash. Read broadly, the order reaches a DeepSeek model running on American servers. Read narrowly, it means DeepSeek's own hosted service.

The risk section leans toward the narrow reading. Its data concerns are framed around "DeepSeek-hosted instances" and servers in China. For everything else it offers one line: "The models themselves may contain malware or other security vulnerabilities." That is a short argument for pulling a self-hosted model off a US cloud.

The drafting has rough edges, too. The order names the company as Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. The Federal Register summary drops the middle of that name. And the two footnotes that define an affiliate say it is an affiliate "of DeepSeek AG," an entity that appears nowhere else in the order. The first FASCSA order ever issued, by the Director of National Intelligence on September 15, 2025, targeted Acronis AG.

The evidence is thin on the page. The newest source in the order's footnotes is dated August 25, 2025, a TechTarget explainer. The others include a NowSecure audit of the iOS app from February 2025 and a House Select Committee report from April 2025. The council recommendation itself is not posted; the docket lists no supporting documents.

Three Regimes, One Company

With this order, each part of the federal government now has its own DeepSeek rule.

Contractors feel the civilian order through FAR clause 52.204-30. It tells them to check SAM.gov for FASCSA orders at least once every three months. If a covered product was used on a contract, the first report is due within 3 business days of finding it. Both clocks depend on the order being visible on SAM.gov, and we could not confirm when DHS posted it there.

Beijing answered on Tuesday. At the Foreign Ministry briefing, spokesperson Mao Ning said China consistently opposes overstretching the concept of national security and politicizing technology and trade issues, and that it will firmly safeguard the legitimate rights of Chinese companies. DeepSeek did not comment in the coverage we read.

Caveats

We do not know when agencies themselves received the order. If DHS sent it to agencies in July, they had the full 60 days, and only the public was late. DHS has not said. The 60-day reading also assumes the original release date is the issuance date the exception clause counts from. And the order may let DHS hear a late request anyway; the text does not say either way.

Our Take

The ban itself is not a surprise, and on the narrow question of DeepSeek's own app it is overdue. Sending a federal employee's prompts to servers in China was never defensible, and many agencies had already blocked it.

What bothers us is the process. A rule that took effect "immediately" in July, with a 60-day window to object, should not reach the public 88 days later. The vendors most exposed are not DeepSeek. They are the US integrators who put an open-weight model inside a product an agency bought, and they had no public notice that the line had moved.

The undefined phrase is the bigger problem. "Developed using DeepSeek implementations" could mean a chatbot wrapper. It could also mean a fine-tune, a distilled model, or a coding tool that once used V3 to generate training data. A contractor cannot certify against a phrase with no edge. Our bet is that the next 60 days of compliance work will be lawyers asking CISA where that edge is.

Three signposts for the next 60 days: whether CISA publishes guidance defining "DeepSeek implementations," and whether it covers open weights run on US clouds; whether AWS, Google or other providers change how they sell DeepSeek models to government customers; and whether DHS posts the council recommendation, or a second FASCSA order for another lab named in the September distillation advisory.

Sources: Federal Register (DHS notice and signed order), Public inspection PDF, TechCrunch, CyberScoop, BankInfoSecurity, Tech Times, China Foreign Ministry briefing, FAR 52.204-30, Covington (first FASCSA order), Mayer Brown (Acronis order), WilmerHale (FY2026 NDAA), AWS (DeepSeek-R1 in Bedrock), AWS (DeepSeek-V3.1 in Bedrock), Google Cloud (DeepSeek on Vertex AI).