The Department of Homeland Security has ordered DeepSeek out of federal civilian IT. A notice scheduled for the Federal Register on October 20 excludes products and services from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates from civilian agency procurement, and orders them removed from agency systems. The harder question is what the order means for the open-weight models everyone else runs.

What the notice says

The notice, filed October 19 under docket DHS-2026-0628, cites the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321–1328). It excludes “information technology products and services developed by” DeepSeek from federal civilian agency procurements, including its affiliates. It also removes “all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations” from civilian agency IT. It says the order followed review of a Federal Acquisition Security Council recommendation and “affiliated evidence.” It doesn't describe that evidence. Questions go to the FASCSA order implementation team at CISA.

What it doesn't say

The public copy of the notice leaves out several things. The appendix that should hold the signed order is empty, so we can't see the order number, signing date, deadlines or any exceptions. One outlet, MadRobot, reports that the order is dated July 24, that it exempts national security systems, and that agencies have 60 days to request exceptions. We haven't been able to verify those details against the order itself, so treat them as reported, not confirmed. The notice also doesn't address the point we think matters most.

The open-weights question

DeepSeek publishes its models as open weights, which means they run inside many other companies' products and on many other companies' servers. The order reaches “third-party products and services developed using DeepSeek implementations.” The notice doesn't say whether that covers a DeepSeek model running on a US company's servers, or an open-weight DeepSeek model an agency runs on its own infrastructure. Those are different situations, and the answer decides who is affected. Vendors that sell to agencies, resellers, and inference providers that host DeepSeek models are all asking the same thing: does “developed using” mean the model, the code, or any product that touches either?

What this piece is and isn't. It reports what DHS's notice says and where it's silent. We aren't taking a position on whether the ban is justified, and we haven't seen evidence either way, since DHS hasn't described what it relied on. The notice's public copy is incomplete, and implementation guidance from CISA may answer some of these questions.

What we're watching

Three things. First, the published Federal Register text and whether the full order is made public, including any definition of “developed using DeepSeek implementations.” Second, CISA's implementation guidance, especially on hosted and self-hosted open-weight models. Third, how vendors that sell to agencies respond, because procurement teams tend to interpret rules like this broadly when the language is unclear.