DHS orders federal civilian agencies to remove DeepSeek AI products and bars new procurement under FASCSA
The U.S. Department of Homeland Security (DHS) has issued a Federal Acquisition Supply Chain Security Act (FASCSA) order directing federal civilian agencies to remove DeepSeek AI products from their IT systems and to stop acquiring them. The notice is due to be published in the Federal Register on October 20, 2026 and names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. as the targeted company. The order covers DeepSeek's affiliated entities and also third-party products and services built using DeepSeek implementations, which extends its reach across government software supply chains. DHS says DeepSeek models pose "multiple threat vectors" that could allow sensitive information to be transferred to the People's Republic of China. According to the article, this is a risk assessment and not confirmation of data theft in every covered deployment.
Technical Details
- Authority: FASCSA of 2018 (41 U.S.C. 1321–1328; 41 CFR 201-1), following a recommendation from the Federal Acquisition Security Council.
- Two parallel requirements: a procurement exclusion for future acquisitions and a removal requirement for products already in use.
- Affiliation is determined under 48 CFR 2.101. The removal requirement explicitly includes third-party products built on DeepSeek implementations, so a third-party interface or rebranding does not exempt a product.
- Docket DHS-2026-0628 on Regulations.gov. The point of contact is the CISA FASCSA Order Implementation Team.
- Scope is limited to federal civilian procurement and IT systems. The notice does not prohibit private individuals from using DeepSeek.
Remediation
- Agencies should inventory the AI components and underlying models in their products, not just standalone DeepSeek chatbot installations.
- Procurement and cybersecurity teams should jointly identify affected suppliers, products and underlying implementations, and block covered technology from procurement pipelines.
- Direct implementation questions to the CISA FASCSA Order Implementation Team.
Linha do tempo
-
DHS orders federal civilian agencies to remove DeepSeek AI products and bars new procurement under FASCSA
ler a análise desta fonte ocultar
The U.S. Department of Homeland Security (DHS) has issued a Federal Acquisition Supply Chain Security Act (FASCSA) order directing federal civilian agencies to remove DeepSeek AI products from their IT systems and to stop acquiring them. The notice is due to be published in the Federal Register on October 20, 2026 and names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. as the targeted company. The order covers DeepSeek's affiliated entities and also third-party products and services built using DeepSeek implementations, which extends its reach across government software supply chains. DHS says DeepSeek models pose "multiple threat vectors" that could allow sensitive information to be transferred to the People's Republic of China. According to the article, this is a risk assessment and not confirmation of data theft in every covered deployment.
Technical Details
- Authority: FASCSA of 2018 (41 U.S.C. 1321–1328; 41 CFR 201-1), following a recommendation from the Federal Acquisition Security Council.
- Two parallel requirements: a procurement exclusion for future acquisitions and a removal requirement for products already in use.
- Affiliation is determined under 48 CFR 2.101. The removal requirement explicitly includes third-party products built on DeepSeek implementations, so a third-party interface or rebranding does not exempt a product.
- Docket DHS-2026-0628 on Regulations.gov. The point of contact is the CISA FASCSA Order Implementation Team.
- Scope is limited to federal civilian procurement and IT systems. The notice does not prohibit private individuals from using DeepSeek.
Remediation
- Agencies should inventory the AI components and underlying models in their products, not just standalone DeepSeek chatbot installations.
- Procurement and cybersecurity teams should jointly identify affected suppliers, products and underlying implementations, and block covered technology from procurement pipelines.
- Direct implementation questions to the CISA FASCSA Order Implementation Team.