According to a Department of Homeland Security notice published in the Federal Register on October 20, the Secretary of Homeland Security has issued an order under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328) and its implementing regulations at 41 CFR 201-1. After reviewing a Federal Acquisition Security Council recommendation and its attached evidence, the order does two things. First, it excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., including affiliated entities as defined in 48 CFR 2.101, from federal civilian agency procurements. Second, it requires removal of all DeepSeek and DeepSeek-affiliate products, and of third-party products and services developed using DeepSeek implementations, from civilian agency information technology. The notice carries docket number DHS-2026-0628; the signed order appears as page images in the appendix, and DHS points readers to regulations.gov for the docket.
Our takeThe third-party clause is the technically consequential part: scope moves from one vendor's products to anything built on its implementations, which asks agencies to trace model provenance through their own supply chain - hard when weights and fine-tunes carry no verifiable lineage. The notice states the security rationale but not the technical criteria behind the recommendation, and the order's compliance terms exist only as scanned page images, so operative deadlines are not machine-readable.