What happened
On 19 October 2026 the Department of Homeland Security issued an order (docket DHS-2026-0628; Federal Register public-inspection document 2026-21447) directing US civilian federal agencies to remove all DeepSeek products from their information technology systems and excluding the Chinese AI company from federal procurements, citing PRC data-transfer, surveillance and malware risk. The order is issued under the 2018 supply-chain security statute (FASCSA).
Why it matters
This is a binding national-security action that directly controls whether a foreign frontier/LLM vendor may serve US government data or workloads. It signals that AI model provenance and data-localisation can be handled via supply-chain/cyber authorities rather than data-privacy law, and is likely to be extended to private-sector requirements and to other Chinese model vendors. Any organisation serving US federal agencies must now vendor-vet model providers against a de-facto exclusion list.
Action needed
Review AI/LLM vendor supply chains for DeepSeek dependencies; for federal contractors and agencies, remove DeepSeek products from federal systems and update procurement/source documents with a DeepSeek exclusion clause.