DeepSeek's federal ban: what the order covers, and whether your AI stack is exposed

The Department of Homeland Security has ordered every federal civilian agency to pull DeepSeek out of its IT and stop buying from the company, and the order reaches past DeepSeek's own app. It also covers "third-party products and services developed using DeepSeek implementations" (Federal Register, Oct 20, 2026), and the notice never says what that phrase means (The Hacker News). If your company holds a civilian federal contract, that undefined phrase is your problem this week. If it doesn't, the order puts no obligation on you today, but it will start showing up in security questionnaires from customers who do.

Start with one rule. If a civilian federal contract of yours carries FAR clause 52.204-30, treat every route to DeepSeek's models (direct API, aggregator, agent tool, self-hosted weights) as covered until your contracting officer or CISA tells you otherwise in writing. Then run the four-question audit below, which takes less time than the meeting about it.

What the order binds, and what it leaves alone

Homeland Security Secretary Markwayne Mullin signed the order on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), per The Hacker News. DHS filed it for public inspection on October 19, 87 days later, and the Federal Register published it on October 20 as document 2026-21447, docket DHS-2026-0628 (Federal Register). The order was nearly three months old before anyone outside government could read it.

It does two things, per the notice summary:

1. Excludes IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates from civilian agency procurement.
2. Removes "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations" from civilian agency IT.

Source: Federal Register document 2026-21447, captured 2026-10-21.

FASCSA gives three officials this power: the DHS Secretary for civilian agencies, the Secretary of Defense for the Defense Department (DoD) and national security systems, and the Director of National Intelligence for the intelligence community (FAR 52.204-30). This is a DHS order, so it binds civilian agencies only. The Hacker News reads it plainly: "It does not restrict companies or the public." Nobody is telling your startup to uninstall anything.

The published notice states no reason (The Hacker News). Security Magazine, writing from the public-inspection copy on October 19, reports that the order describes DeepSeek as presenting "multiple threat vectors" to IT systems (Security Magazine). The notice gives no reason, but DeepSeek's own privacy policy suggests one: "we directly collect, process and store your Personal Data in People's Republic of China" (DeepSeek privacy policy).

There is precedent: the law's first exclusion order, which the DNI published on September 15, 2025, kept Acronis out of intelligence-community systems only, while this one covers the civilian agencies (Mayer Brown).

The undefined phrase is where your exposure lives

"Developed using DeepSeek implementations" could mean a product that calls DeepSeek's API. It could also mean a product running DeepSeek weights on American hardware, or a model fine-tuned from a DeepSeek checkpoint. The notice doesn't pick one. Gabrielle Hempel, a security operations strategist at Exabeam, told Security Magazine the breadth "raises some significant questions about software provenance and supply-chain compliance," and argued that "a locally-deployed model with appropriate controls presents a different risk profile than a foreign-hosted service" (Security Magazine). She's right about risk. The order, though, doesn't draw that line, and your contracting officer won't draw it for you by inference.

Here is how the four common routes to a DeepSeek model look under the narrowest and broadest readings.

How you reach DeepSeek	Where the prompt is processed	Narrow reading	Broad reading
DeepSeek's own API or app	DeepSeek's servers; data stored in the PRC per its privacy policy	Covered	Covered
Aggregator such as OpenRouter	Whichever upstream provider serves the request; OpenRouter's docs list DeepSeek itself and third parties like DeepInfra as providers for DeepSeek models	Covered if DeepSeek is the provider	Covered for any provider
An agent or IDE tool with a DeepSeek backend	The tool vendor's chosen backend, often invisible to you	Covered if it calls DeepSeek's API	Covered
Self-hosted DeepSeek weights	Your own hardware; the weights are MIT-licensed per the DeepSeek V4 Pro model card	Arguably outside	Covered as "developed using DeepSeek implementations"

The third row is the one teams miss. Our newsdesk covered an attack campaign on October 21 whose logs showed a setup called "claudecode_deepseek-v4.1-flash", Claude Code driving a DeepSeek V4.1 Flash backend (our coverage). The wrapper said Claude; the model doing the work was DeepSeek's. Your engineers' agent configs can look the same way.

Federal contractors: the clause that pulls you in

The order reaches private companies through FAR 52.204-30. A contractor whose contract carries it "shall not provide or use as part of the performance of the contract" any covered article or product from a source named in an applicable FASCSA order, unless the issuing official grants a waiver (FAR 52.204-30(b)(1)). Two details in the clause decide whether this order is yours.

First, the issuer has to match the contracting office. For contracts awarded by a DoD contracting office, DoD FASCSA orders apply; for everyone else, DHS orders apply (FAR 52.204-30(b)(1)). A contractor working only for DoD is not bound by this DHS order through the clause, though nothing stops DoD from issuing its own.

Second, timing. An order issued after your solicitation reaches the prohibition in an existing contract only once the contracting officer adds it by amendment or modification (FAR 52.204-30(b)(4)). The reporting duties in paragraph (c) don't wait for that modification. During performance you have to:

• Check SAM.gov for FASCSA orders at least once every three months (FAR 52.204-30(c)(1)).
• Make a "reasonable inquiry" into your supply chain when a new order could affect it ((c)(2)).
• Report any covered product used in performance within 3 business days of identifying it ((c)(4)(i)).
• Follow up within 10 business days with mitigation details and what you did to prevent the use ((c)(4)(ii)).
• Flow the clause down to your subcontractors ((e)).

What your contracting officer will ask for

The 3-business-day report has a fixed shape. The clause asks for the contract number, order numbers, the product or service you delivered or used, the covered source, the vendor that supplied it (with CAGE code and unique entity identifier if known), brand, model number, an item description, and any mitigation already under way (FAR 52.204-30(c)(4)(i)). If you can't fill those fields from your own records in three days, your inventory is the gap. Questions about scope go to CISA's FASCSA Order Implementation Team at fascsa.orders@cisa.dhs.gov (Federal Register). Ask them about self-hosted weights specifically, and keep the reply.

The five-minute stack audit

Four questions. A yes on any of them, plus a civilian federal contract, means you file or you get a written scope answer.

1. Does anything call DeepSeek directly? Search code, infra config, and secrets managers for the provider name and its API host.

# Run from the root of each repo; covers code, IaC, and committed env templates
rg -i --hidden -g '!node_modules' -g '!.git' 'deepseek|api\.deepseek\.com' .

2. Does an aggregator route to DeepSeek? On OpenRouter, a DeepSeek model ID can be served by several providers, and allow_fallbacks defaults to true, so a backup provider can take the request when your first choice is down (OpenRouter provider selection docs). If you keep a DeepSeek model for non-federal work, pin the provider list and turn fallbacks off. If federal work shares the gateway, drop the DeepSeek models from that route entirely.

{
  "model": "<MODEL_ID>",
  "messages": [{ "role": "user", "content": "..." }],
  "provider": {
    "only": ["<APPROVED_PROVIDER_SLUG>"],
    "allow_fallbacks": false
  }
}

The only and allow_fallbacks fields come from OpenRouter's request schema (OpenRouter docs); copy the exact provider slug from the model's provider list.

3. Do any tools pick DeepSeek for you? List every agent, IDE plugin, and SaaS feature with a model picker or "auto" mode, and get the backend list from each vendor in writing. This is the row from the table above that a code search won't find.

4. Are DeepSeek weights, or models fine-tuned from them, on your hardware? Check your model registry and the default Hugging Face cache on GPU hosts.

# Default Hugging Face cache; adjust if HF_HOME is set
ls "${HF_HOME:-$HOME/.cache/huggingface}/hub" | grep -i deepseek

Hugging Face model cards record a fine-tune's parent in the base_model metadata field, so check it for every model you deploy.

Where the alternatives run inference

If the audit turns up DeepSeek and you need to replace it, the order raises one axis: who runs inference and under whose jurisdiction. Benchmarks are a separate question, covered in our Kimi K2.7 vs DeepSeek V4 vs Qwen3 comparison and our Mistral Large 4 vs Aleph Alpha Kolibri guide.

Model	Developer, country	Open weights	Developer-hosted inference	Named in this order
DeepSeek V4 Pro	Hangzhou DeepSeek, China	Yes, MIT (model card)	DeepSeek's API; personal data stored in the PRC (privacy policy)	Yes (Federal Register)
Qwen3.5-397B-A17B	Qwen team, Alibaba, China	Yes, Apache 2.0 (model card)	Alibaba Cloud Model Studio (model card)	No
Llama 4 Maverick	Meta, United States	Yes, Llama 4 Community License (model card)	Download the weights; run on your own hardware or a host you choose	No
Mistral Large 4	Mistral AI, France	Promised by end of October; preview API only today (Mistral)	Mistral's own datacenters in Europe for the preview (Mistral)	No

Qwen is not named in the order, and its weights are Apache 2.0, but its developer-hosted API runs on Alibaba Cloud. If your customer's objection is Chinese-hosted inference, Alibaba's API has the same profile as DeepSeek's, and an order naming Alibaba would land on any team that swapped DeepSeek for Qwen. Self-hosted Qwen weights avoid the hosting question entirely.

Llama 4 has its own catch. Its license is not unlimited: companies above 700 million monthly active users on the release date need a separate license from Meta (Llama 4 Community License), which almost no reader will hit.

For a federal-facing workload with no data-residency rules beyond "US-controlled", self-hosted Llama 4 is the lowest-friction swap in this table. Mistral Large 4 is the pick if EU hosting is a plus and you can wait for the weights.

If you take the self-hosted Llama 4 route without your own GPUs, price capacity on a general cloud host such as Cloudways or DigitalOcean, sized against the model card's hardware requirements.

What breaks first

The scope of "DeepSeek implementations" will move. A CISA FAQ, a waiver granted to one agency, or a DoD order of its own could narrow or widen it, and an inventory you built this week assumes today's text. Put the SAM.gov check on a calendar at the three-month interval the clause requires and re-run the audit each time.

Vendor model pickers break second. An agent tool that adds a DeepSeek backend in a minor release puts a covered product into contract performance without anyone in your company choosing it. Ask each vendor to notify you of backend changes, the same way you'd treat a new subprocessor.

What to do, by reader type

Civilian federal contractor with 52.204-30 in a contract: run the four-question audit today. If anything turns up, the 3-business-day report clock starts when you identify it (FAR 52.204-30(c)(4)). Pull DeepSeek from every system used in contract performance, including self-hosted weights, and email CISA's implementation team for a written scope answer before you put any DeepSeek-derived model back.

DoD-only contractor: this order doesn't reach you through the clause (FAR 52.204-30(b)(1)). Run the audit anyway so a DoD order, if one comes, is a one-day job.

Selling into government or regulated buyers, no contract yet: expect "do you use DeepSeek, directly or through a subprocessor?" on the next security questionnaire. Have the audit output and your model list ready, and keep DeepSeek off any route that touches customer data you'd have to disclose.

Everyone else: you have no obligation. If you call DeepSeek's hosted API, its own privacy policy tells you your data sits in the PRC; decide on that basis, not on the order. The order doesn't restrict private companies (The Hacker News), so DeepSeek weights running on your own hardware are untouched by it.