What happened
The Department of Homeland Security filed notice on Monday of an order barring the Chinese artificial intelligence developer DeepSeek from federal civilian agency contracts and directing agencies to remove its products. Secretary Markwayne Mullin signed it under the Federal Acquisition Supply Chain Security Act of 2018, which gives the DHS secretary authority to exclude risky technology from civilian agency networks. The notice runs in the Federal Register as document 2026-21447, docket DHS-2026-0628.
The removal mandate is broader than the company. It covers products and services from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates, and it also reaches third party products and services "developed using DeepSeek implementations," which on any plain reading includes tools built on DeepSeek's open weight models. DHS said the models present multiple threat vectors, may contain malware or other vulnerabilities, that employee or vendor use could move sensitive data to China, and that DeepSeek's servers sit where Chinese law allows state cyber and intelligence services to reach privately held infrastructure.
Agencies have 60 days from issuance to request exceptions, which CISA approves or denies in writing. The company has 60 days after receiving notice to challenge the order in the US Court of Appeals for the District of Columbia Circuit. The order also urges agencies to watch network traffic for signs of data leaving their environments and to tighten logging.
None of this is new in direction. The Navy, NASA and other agencies blocked the chatbot more than a year and a half ago, and Texas, New York, Virginia, Australia, South Korea and Taiwan keep it off government systems. What is new is a formal order with dates, an exception route and reach into the contractor base. The Federal Acquisition Security Council's implementing rule extends exclusion and removal orders to prime contractors and subcontractors, and a 2023 Federal Acquisition Regulation update requires contractors to follow them.
Why this is a GRC story
Procurement is a control, and this one has a paper trail. An exclusion order converts a judgement call into an obligation with a deadline, an owner and an appeal route. That is the shape auditors and regulators increasingly ask for: not an opinion that a vendor felt risky, but a record of the decision, who made it, and when it took effect.
"Built on" is where inventories break. A vendor register that tracks company names will not answer this order. Any team that cleared a tool because the vendor was not DeepSeek now has to answer a different question about what the tool was built on. Model provenance belongs in intake, next to the security questionnaire, and it needs to survive the vendor's own rebranding.
What to watch
Watch how many exception requests reach CISA and which are granted in writing, because exceptions become the de facto guidance. Watch whether DeepSeek files a challenge in the DC Circuit, and whether other agencies reach for the same authority after the Department of Defense used it against Anthropic.
For anyone outside government, the test is smaller than a legal review. Ask which underlying model each tool your teams use actually calls, who confirmed it, and when that answer was last checked.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.