DFARS Readiness Checklists and guides for DFARS readiness.

Guides / October 20, 2026

DHS Just Ordered DeepSeek Out of Federal Civilian IT. Does It Reach Your Company?

You might use an AI tool built on a DeepSeek model without knowing it. As of October 20, 2026, that matters if you sell to the federal government.

What did DHS order?

The Department of Homeland Security (DHS) published a notice in the Federal Register on October 20, 2026. The notice announces the Secretary's order. The order does two things. First, it excludes information technology (IT) products and services developed by DeepSeek from federal civilian agency procurements. The full name is Hangzhou DeepSeek Artificial Intelligence Co., Ltd. Affiliated entities are included as well. Second, it orders the removal of DeepSeek and DeepSeek-affiliate products from civilian agency IT. It also covers third-party products and services developed using DeepSeek implementations. The notice is FR Doc 2026-21447, published at 91 FR 66346. The authority is the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). The Federal Acquisition Security Council (FASC) reviewed the evidence and recommended the action. The signed order is filed with the notice and posted under DHS docket DHS-2026-0628 on regulations.gov.

Does this order apply to my company?

No. The order binds federal civilian executive branch agencies. It does not name the Department of Defense. It does not change DFARS or CMMC (Cybersecurity Maturity Model Certification) rules. It is not a consumer ban. It does not block private companies from using DeepSeek. But it still matters to you. If you sell products or services to civilian agencies, this order can touch your contracts. An agency buyer must now exclude your product if it is developed using DeepSeek implementations. You may not know which models sit inside your own tools. That is the gap to close.

Why does the third-party reach matter?

The order follows the model, not just the brand. A product you buy can hide a DeepSeek model inside it. The order says removal reaches third-party products developed using DeepSeek implementations. That means a DeepSeek model can sit inside another company's product. A familiar logo on the box does not prove what runs underneath. This is the same logic behind DFARS 252.204-7012. The clause covers systems owned by or operated for the contractor. A vendor's system that holds your data is in scope. Knowing what runs inside your stack is how you show control.

What should I do this week?

  1. List every AI tool your team uses and every AI feature inside your own products.
  2. Ask each vendor which models power their tools. Get the answer in writing.
  3. Record the answers in your System Security Plan (SSP). An SSP is the document that records how you meet each safeguard.
  4. Add an AI model disclosure clause to vendor contracts. Your vendors must tell you when the models under their products change.
  5. Watch civilian agency solicitations for new exclusion terms. FASCSA orders can arrive as contract language.
  6. Do not confuse this order with CMMC. It does not change your self-assessment or your posted compliance score.

Sources

Next step

If a federal buyer asked how your Azure environment meets each NIST 800-171 safeguard, could you show evidence today? PolicyCortex reads live Azure configuration with 33 collectors and maps it to NIST 800-171 controls. SSP, SAR (Security Assessment Report), and POA&M (Plan of Action and Milestones) output comes from the collected evidence.