The clause that travels is "developed using DeepSeek implementations." On 20 October 2026, the Federal Register published DHS's notice of a FASCSA order that reaches past DeepSeek's own apps into third-party products civilian agencies already bought.
FASCSA authority turns a council recommendation into a civilian removal order
Under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321–1328) and 41 CFR 201-1, the Federal Acquisition Security Council can recommend exclusion and removal; certain agency heads then issue orders for systems they cover. DHS Docket No. DHS-2026-0628, document 2026-21447, is the civilian notice. General Counsel James H. Percival II signs the Federal Register package. Contact routing points to CISA's FASCSA Order Implementation Team.
Secondary reads of the signed appendix, Exclusion and Removal Order #2026-01, date the Secretary's issuance to 24 July 2026. Public Inspection filing landed 19 October; Federal Register publication 20 October: 91 FR 66346. That lag matters for the 60-day exception clock.
The notice excludes DeepSeek and removes third-party implementations from agency IT
The published summary orders two actions. First, exclusion of information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, including affiliated entities as defined in applicable regulations (the supplementary text cites 48 CFR 2.101), from federal civilian agency procurements. Second, removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.
Reporting that inspected the signed order adds operational detail consistent with that summary: exclusion applies immediately to approved-product lists and electronic purchasing marketplaces; agencies must remove covered products immediately or seek an exception; executive agencies may request exceptions within 60 days of issuance, with CISA reviewing and deciding in writing; CISA will assist agencies that lack internal removal capability; the Secretary reviews the order within one year and annually thereafter. Exception requests must come from the agency customer; vendors can supply evidence packs but cannot file in the agency's place.
A footnote pattern described in careful secondary coverage extends the procurement exclusion to third-party implementations of DeepSeek used to provide products and services to civilian agencies. On that reading, a hosted DeepSeek endpoint sold into an agency, and applications built on it, sit inside the removal net. Affiliates are framed as entities that control, are controlled by, or share a controller with DeepSeek.
Civilian buyers lose marketplace listings while open weights keep a private life
For federal civilian procurement shops, DeepSeek-branded tools and many DeepSeek-derived offerings drop off the lists agencies are allowed to buy from. Existing installs become removal or exception projects. Software vendors who fine-tuned, wrapped, or hosted DeepSeek weights for government customers inherit a supply-chain conversation even when the invoice never named Hangzhou DeepSeek.
The same week DeepSeek's community stack kept shipping in public (including open inference work adjacent to V4-line weights). That split is the story's technical edge: procurement exclusion for FCEB systems can coexist with open-weight distribution elsewhere. Private and consumer use sit outside this civilian-agency instrument. FY2026 NDAA defence and intelligence provisions travel on separate statutes.
Immediate exclusion, immediate removal, and a 60-day CISA exception window
Agencies in scope must stop new covered procurements at once, including marketplace presence, and remove covered products from agency IT or file for an exception. Exception requests go to CISA with justification and proposed mitigations. The order's own "issuance" date controls the 60-day window. Counted from 24 July 2026, that window closed on 22 September, before publication. Counted from filing or publication, it would run into mid-December 2026. Counsel should treat the ambiguity as live until CISA states which clock it is using.
Authority is limited to civilian agencies where the Defence Secretary and the Director of National Intelligence do not already cover the systems. National security and compartmented systems sit on other tracks. FY2026 NDAA Section 1532 addresses defence systems and contractor use of covered AI during defence contracts; Section 6604 directs intelligence-community standards for removing the DeepSeek application from national security systems. Those sibling instruments run beside this notice rather than inside it.
Publication leaves private forks and SKU schedules unsettled
The Federal Register notice proves DHS issued and published a FASCSA exclusion and removal order aimed at DeepSeek, affiliates, and third-party products developed using DeepSeek implementations for civilian agency IT. It leaves open whether every open-weight fork worldwide is lawful for private use, and it stops short of naming which commercial "DeepSeek-compatible" SKUs CISA will treat as covered. Risk language in secondary accounts of the signed order cites China-based infrastructure access, personal-data collection, and prior vulnerability research on the DeepSeek iOS app (including a February 2025 NowSecure report named in press coverage). Those are the government's stated concerns in the order package; Frontier has not independently re-tested the iOS findings.
Beijing's foreign-ministry protest, reported the same week, is diplomatic colour beside the paperwork.
CISA's issuance clock, covered-product schedules, and waiver practice remain open
Still missing is an authoritative public schedule that lists every covered third-party product by name. Still missing is CISA's written rule on whether "issuance" means 24 July or the October filing/publication dates for late exception requests. Still missing are decision letters showing how research or mission-critical exceptions will be granted for civilian systems. Vendors need agency customers to file; agencies need vendor evidence packs.
Monday posture for civilian contractors and agency CISOs: inventory DeepSeek apps, APIs, hosted endpoints, and any product whose model lineage is a DeepSeek implementation; pull marketplace listings; decide remove-versus-exception per system; watch CISA for the clock clarification. Treat "we only call an API" as an open coverage question until counsel reads the implementations footnote against your architecture.