Is DeepSeek banned in the US?

Not for private companies or consumers. The DHS order bars DeepSeek products, and third-party products built using DeepSeek, from federal civilian agency purchases and IT systems. Defense networks have blocked DeepSeek separately since January 2025. Contractors are reached through FAR 52.204-30, not by the order itself.

DeepSeek Federal Ban: What Government Contractors Check Now

Image: Pexels, used under the Pexels License.

Civilian federal agencies have to stop buying DeepSeek and pull it out of their systems, and the order doesn't stop at DeepSeek's own app. It also covers "third-party products and services developed using DeepSeek implementations." That's the line that lands on small vendors: a SaaS tool with a model picker, a chatbot built on an open-weight DeepSeek model, an AI feature that routes to whichever model is cheapest that day.

The Department of Homeland Security filed the notice with the Federal Register on Monday, October 19, 2026, at 8:45 a.m. Eastern, and it was published on October 20. Outlets including CyberScoop, the BBC and The Register first reported it on October 19.

What DHS ordered, and when

The notice (FR Doc. 2026-21447, docket DHS-2026-0628) publishes an order issued under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), after a recommendation from the Federal Acquisition Security Council. It does two things:

Part	What civilian agencies must do	Timing in the order
Exclusion	Stop buying IT products and services from Hangzhou DeepSeek Artificial Intelligence and its affiliates (as defined in 48 CFR 2.101), including through approved product lists and e-commerce markets	Effective immediately after issuance
Removal	Remove DeepSeek and affiliate products, plus third-party products and services developed using DeepSeek implementations, from agency IT	Immediately after issuance, or seek an exception
Exceptions	Ask the DHS issuing official in writing, with a compelling justification	Within 60 days of issuance
Review	DHS reviews the order	Within one year, then annually

The order itself is older than the notice. The signed copy in the appendix is Exclusion and Removal Order #2026-01 from Secretary Markwayne Mullin, with an original release date of July 24, 2026, which fits the BBC's report that the ban has been in force since the end of July. (CyberScoop dated it June 26. We went with the date printed on the order.) A footnote spells out the reach: it includes "third party implementations of DeepSeek used to provide products and services to civilian agencies."

First page of DHS Exclusion and Removal Order 2026-01 on DeepSeek, showing the July 24, 2026 release date, Secretary Markwayne Mullin's signature and the scope line

Screenshot: Exclusion and Removal Order #2026-01, appendix to Federal Register document 2026-21447, Department of Homeland Security.

The reasons given are the ones you'd expect. DeepSeek's servers sit in China, its account sign-up collects personal data and may fingerprint users, prompts can carry sensitive data to the PRC, and researchers found critical flaws in its iOS app. Until removal is complete, agencies are encouraged to watch traffic, add logging and exfiltration controls, and flag anomalies.

Who it applies to

Civilian agencies directly: Treasury, State, Justice and the rest of the civilian executive branch. Defense agencies and the intelligence community are outside DHS's FASCSA authority; Defense networks already started blocking DeepSeek in January 2025.
Federal contractors through the FAR: FAR 52.204-30 says that for any contract not awarded by a Defense contracting office, DHS FASCSA orders apply. Contractors must not provide or use a covered product in performance.
Subcontractors: the clause flows down to every subcontract, commercial products and services included. If you're a two-person AI shop selling into a prime, you're in the chain.
Everyone else: a company with no federal work isn't bound. Nothing here bans DeepSeek for private businesses.

One timing detail matters. Under paragraph (b)(4) of the clause, an order issued after your solicitation date only becomes a prohibition in your contract when the agency adds it by amendment or modification. The reporting duty in paragraph (c) doesn't wait for that.

FAR 52.204-30 paragraph (c) on acquisition.gov, the notice and reporting requirement for FASCSA orders

Screenshot: FAR 52.204-30, paragraph (c), Acquisition.gov.

The hard part: "developed using DeepSeek"

Nobody has defined that phrase yet. The Register asked whether it means live API access to a DeepSeek model or any app "vibe-coded with the help of DeepSeek," and DHS didn't answer. The order makes no exception for copies hosted in the US or run on your own servers, so we'd treat those as covered until DHS says otherwise.

Gateways are where vendors get caught. We queried OpenRouter's public API on October 20 at 02:05 UTC: 18 of its 470 listed models carry DeepSeek IDs, and the newest flash model was served by 29 providers, US clouds among them. DeepSeek's pro model showed endpoints on Azure and Cloudflare. A product that routes requests "to the best model" can land on DeepSeek without anyone picking it, and OpenRouter's own docs say its Auto Router "considers every ranked candidate" unless you set patterns.

The Required Actions and Exceptions sections of DHS Order 2026-01, telling civilian agencies to exclude and remove DeepSeek products and setting a 60-day window for exception requests

Screenshot: "Required Actions" and "Exceptions", Exclusion and Removal Order #2026-01, Department of Homeland Security.

What to do now if you sell to civilian agencies

Search SAM.gov for "FASCSA order" and save a dated record of what you find. The clause requires that search, and a check at least every three months during performance.
Inventory every model call in what you deliver. Direct calls to DeepSeek's API, DeepSeek models on a cloud marketplace, self-hosted open weights, fine-tunes built on DeepSeek, and router fallbacks. Look at default model lists and "auto" settings, not only the model your engineers chose.
Lock the routing. On OpenRouter, set an organization model allowlist in guardrails or add deepseek/* to excluded_models; exclusions win over allow patterns. Do the same in whatever gateway you use, and pin model IDs in federal tenants.
Ask your own AI vendors in writing whether any DeepSeek model sits in their routing or fallback chain. The clause expects a "reasonable inquiry" down your supply chain.
If you find it in a federal deliverable, report it. Civilian contractors report to the contracting officer, fast: the first report (contract number, product, vendor, brand, model and mitigation) is due on the short clock in the verdict above, and a second one describing what you did to prevent it follows within 10 business days. Schedule and GWAC holders also remove covered products when the CO tells them to.

What we could not confirm

We couldn't confirm that the order is already listed in SAM.gov's search (the site doesn't load for scripts), and DHS hasn't said whether US-hosted or self-hosted DeepSeek weights count as "third-party implementations." The date conflict above is unresolved outside the order itself.

Community reaction

The r/fednews thread is mostly people saying it was overdue, with a few pointing at the open-weights problem.

https://www.reddit.com/r/fednews/comments/1xa8hco/trump_administration_plans_to_ban_deepseek_from/

"Deepseek is open weight, meaning anyone can run it, and there's a version with an "American" wrapper running around somewhere," one commenter wrote. On r/technology, another put the line where the order seems to draw it: "Banning it from agency systems is a reasonable data security move. Banning the math is a different story."

That wrapper is exactly the case vendors need to check for.