DeepSeek banned from federal civilian procurement: the exclusion reaches products built on its models

The details

What was issued, and when. The order, signed by Homeland Security Secretary Markwayne Mullin under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328), was filed on Oct. 19 and published in the Federal Register on Oct. 20 as Exclusion and Removal Order #2026-01, following a Federal Acquisition Security Council recommendation. Haynes Boone notes the timing quirk: the order’s stated release date is July 24, 2026, so the 60-day window for agencies to request exceptions had already closed by publication.

Parallel orders. Crowell & Moring reports that the Department of War and the Director of National Intelligence issued matching orders for defense and intelligence-community procurements, posted in the SAM.gov spreadsheet of FASCSA orders without published rationales. The DHS order covers civilian agencies, excluding national security systems.

Scope of the civilian order. It requires agencies to (1) exclude IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., including affiliates as defined in 48 C.F.R. 2.101, from civilian procurement, and (2) remove DeepSeek products and third-party products and services developed using DeepSeek implementations from agency IT. Crowell flags that the civilian order is significantly broader than the defense and IC orders, which target applications and services that implement a DeepSeek model — including locally hosted, open-weight instances.

Stated rationale. The civilian order calls DeepSeek’s free open-source models a set of “multiple threat vectors”: known technical vulnerabilities, an obligation to provide the Chinese government certain access, and the potential for app and model data to be used to build “actionable intelligence” about the U.S. government, according to Crowell’s summary.

Contractor obligations. Under FAR 52.204-30, contractors at every tier must conduct a reasonable inquiry into whether covered articles appear in the performance of an applicable contract, notify the contracting officer within three business days of a discovery and update the report with mitigation actions within ten business days. Contractors are also required to check SAM.gov for new FASCSA orders quarterly.

What buyers should do

• Map model provenance in your IT and services stack. Identify where DeepSeek models or fine-tuned derivatives sit in software you buy or deliver into federal work, including self-hosted open-weight deployments, and document the result.
• Add model-origin representations to vendor terms. Ask software and services suppliers whether their offerings embed or were developed using Chinese frontier models, and require disclosure of changes, the way you would for country-of-origin on hardware.
• Run the FAR 52.204-30 playbook now, not at discovery. Assign who performs reasonable inquiry, who notifies the contracting officer inside three business days, and how mitigation updates are tracked within ten.
• Review SAM.gov quarterly as a control. Build the FASCSA order spreadsheet check into supplier-risk routines; this order was operative nearly three months before it appeared in the Federal Register.
• Expect commercial spillover. Private-sector customers in regulated industries commonly flow federal acquisition restrictions down their own supply chains; treat model-origin questions as a durable diligence item. This is general guidance, not legal advice.

What to watch next

• Definitions and enforcement. The order does not define “developed using DeepSeek implementations”; watch CISA guidance and early contractor disputes for how far the clause reaches coding assistants and derivative models.
• SAM.gov order updates. Additional FASCSA orders on other AI models or vendors would appear in the quarterly-check spreadsheet that triggers contractor inquiry duties.
• Precedent expansion. Crowell notes the Defense Department used a separate FASCSA “covered procurement action” authority to designate Anthropic a supply chain risk in early 2026; further designations would widen the field.

The bigger picture

Model choice is becoming a procurement-regulated decision, not just a technical one. The DeepSeek order sits alongside a widening web of acquisition rules that category managers already absorb — the FAR overhaul’s second proposed rule for federal contractors and the skills gap in evaluating AI procurement tools. For commercial buyers, the practical takeaway arrives before any U.S. rule applies to them: suppliers that serve the government must now trace AI components through their products, and that traceability will show up in sales conversations everywhere else.