US DHS orders federal civilian agencies to remove DeepSeek AI products, including third-party products built on DeepSeek, and bars DeepSeek from federal purchasing (FASCSA Exclusion and Removal Order 2026-01, made public 19 Oct); Australia's Commonwealth ban has been in place since February 2025
The US Department of Homeland Security published notice on 19 October 2026 (filed for public inspection at 8:45 am ET, 8:45 pm Perth; formally published in the Federal Register on 20 October, FR Doc. 2026-21447, docket DHS-2026-0628) of a Federal Acquisition Supply Chain Security Act (FASCSA) order against Chinese AI developer Hangzhou DeepSeek Artificial Intelligence. Exclusion and Removal Order #2026-01 was signed by Homeland Security Secretary Markwayne Mullin with an original release date of 24 July 2026. It applies to federal civilian executive branch agencies; national security systems and sensitive compartmented information systems, which fall to the Defense Department and the Director of National Intelligence, are excluded. Agencies must immediately exclude DeepSeek, its affiliates and their products from procurement, including approved-product lists and e-commerce marketplaces, and must immediately remove products from DeepSeek and its affiliates, and third-party products and services developed using DeepSeek implementations, from their IT systems, or seek an exception. Exception requests must be made in writing to CISA within 60 days with a compelling justification and alternative mitigations. Until removal is complete, agencies are encouraged to monitor traffic in and out, add logging and data-exfiltration controls for the affected systems, and flag unusual activity. The order's risk summary says DeepSeek's servers are in China and Chinese law gives the state wide powers to access company infrastructure; that DeepSeek-hosted services collect personal information and may track and fingerprint users; that prompts can send sensitive government or vendor data to China; that the models may contain malware or security weaknesses; and that independent research found multiple critical vulnerabilities in the DeepSeek iOS app. DHS will review the order within a year and every year after that. In Australia, PSPF Direction 001-2025 (4 February 2025) already requires Australian Government entities to prevent the use or installation of DeepSeek products, applications and web services and remove any existing instances from government systems and devices. Primary: Federal Register public-inspection notice with the signed order; wire: Bloomberg (19 Oct).
- Product
- DeepSeek AI products and services (Hangzhou DeepSeek and affiliates), and third-party products and services built on DeepSeek
- Versions
- n/a — US federal procurement and removal order (signed 24 Jul 2026; made public 19 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- Commonwealth entities: confirm PSPF Direction 001-2025 is still enforced on all systems and devices. All organisations: list where DeepSeek is used, including the app, web chat and API, and AI tools, agents or SaaS features that run DeepSeek models behind the scenes; ask suppliers which models their AI features use and where prompts are processed; and set an AI-use policy that covers foreign-hosted model services. Practitioner page: /knowledge/third-party-supply-chain.
Primary: Federal Register (public inspection) — DHS notice of order: Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch IT Systems and Procurements (FR Doc. 2026-21447; filed 19 Oct 2026, published 20 Oct) · Vendor: Australian Government PSPF — Direction 001-2025 on DeepSeek products, applications and web services (4 Feb 2025) · Bloomberg — US moves to bar China's DeepSeek from federal agencies' systems (19 Oct 2026)