Deep Dive — DeepSeek banned from federal agencies. Its weights aren't

If you searched "is DeepSeek banned in the US government", the answer is yes — and it has been since July 24, three months before anyone outside the executive branch could see the paperwork.

The Department of Homeland Security published Exclusion and Removal Order #2026-01 on Monday, filed as Federal Register document 2026-21447 under docket DHS-2026-0628. It is signed by Homeland Security Secretary Markwayne Mullin and copied to Russell Vought at the Office of Management and Budget, and it rests on the Federal Acquisition Supply Chain Security Act of 2018 — a law written for compromised routers and backdoored antivirus software, now applied to a chatbot.

The order has two limbs. Federal civilian agencies must stop buying anything "developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd," including affiliated entities, and must remove DeepSeek products from their systems. The second limb is the one that will cost money: it also covers "third-party products and services developed using DeepSeek implementations." A vendor that put a DeepSeek model inside a product sold to the Treasury Department is now selling an excluded article.

Scope is the entire federal civilian executive branch, minus national security systems and secure compartmented information systems. The Department of Defense is not covered, because it operates under its own authorities, CNBC reported. Civilian agencies did get an exit ramp: a written justification asking for an exception or a compliance delay, filed to DHS within 60 days of the order's issuance. Run the calendar and the window closed around September 22 — before the order was public. Whatever exceptions exist were negotiated in private, with CISA's FASCSA Order Implementation Team making the call, and nothing in the notice says they will be published.

Fifteen months of measures that didn't bind

The ban is not a surprise; it is the end of a sequence of gestures that each stopped short of the thing that actually constrains an agency, which is what it is allowed to buy.

The Defense Information Systems Agency blocked DeepSeek on its networks in January 2025, days after Pentagon staff were found using the app on government devices. The Commerce Department told bureau staff the app was banned on government phones that March, per Reuters. The House barred staff from installing it, and New York did the same for its own workforce. Congress restricted DeepSeek inside intelligence community systems in December 2025 through the intelligence authorization act folded into that year's defense bill.

Every one of those was a device rule or an internal memo. None of them touched whether DeepSeek's code could sit inside a product the government had already bought, and none created a consequence for a contractor who embedded it. FASCSA does. It reaches into the acquisition system — approved product lists, solicitations, the terms under which a vendor may bid — and it names an agency responsible for enforcement instead of leaving compliance to each department's general counsel.

That difference in mechanism is also the reason this took so long. A device ban is a memo; a FASCSA exclusion is a formal finding that requires a recommendation from the Federal Acquisition Security Council, a review of the underlying evidence, and a signature from the Secretary. The council's work is what sat between July and October.

What DHS says the risk is

The stated threat model is not "the model says wrong things." It is data flow and code provenance. DHS cites DeepSeek servers located in China, Chinese law that gives state agencies broad reach into company infrastructure, the collection of personal data and device fingerprints at signup, and the possibility that prompts from government staff or their vendors are transferred to the PRC, where they "could produce actionable intelligence on U.S. persons and/or government programs."

The order also cites published research finding critical vulnerabilities in DeepSeek's iOS app, SiliconANGLE noted, and describes the models as presenting "multiple threat vectors" that could give the Chinese Communist Party "extensive authority" over American government infrastructure.

Notice what that argument does and does not require. It does not require DeepSeek to be worse than American models at anything. It requires only two things a procurement officer can act on: the vendor is subject to a foreign legal regime that can compel disclosure, and the artifacts it ships cannot be audited by the buyer. Under FASCSA, that is enough — the statute is about supply-chain trust, not benchmark scores. Which is precisely why the order is uncomfortable for anyone who hoped this debate would be settled on capability.

The clause nobody can enforce cleanly

Here is the problem the order creates rather than solves. "Developed using DeepSeek implementations" is a provenance test, and a model has no serial number.

On Tuesday morning I ran the Hugging Face API's model search for "deepseek" and got back the query's 1,000-result ceiling. Eighty-six of those repositories belong to DeepSeek itself. The other 914 are spread across 346 other accounts. Two hundred twenty-seven carry "GGUF" in the name — community quantizations, repackaged to run on consumer hardware. Seventy-two carry "LoRA," meaning fine-tunes. Thirty carry "uncensored," meaning someone removed the refusal behaviour. One hundred twenty-nine were created since September 1.

That is the artifact layer of a supply chain that the federal government has just declared untrustworthy, and almost none of it is attributable to the vendor the order names. A quantized, merged, fine-tuned derivative of a DeepSeek model still contains the weights; it just no longer says whose. Nothing in the file format records lineage, and there is no equivalent of a software bill of materials for model weights. A vendor that genuinely does not know which base model its own engineering team fine-tuned eighteen months ago has no cheap way to find out, and a vendor that does know has every incentive to describe it as "a proprietary in-house model."

Compare the thing FASCSA was built to do. A camera has a model number and a firmware hash. A networking appliance has a vendor, a serial number and firmware that can be hashed. An AI model that has been through two rounds of distillation and one quantization is a pile of numbers that behaves like the original and carries no evidence of it.

So enforcement will run on self-declaration. Agencies will ask vendors which foundation model sits behind each AI feature, and vendors will answer in a contract representation. That works right up until it doesn't — and the failure mode is silent, which is the same criticism independent evaluators have made of every model-provenance proposal since 2024.

What the order deliberately leaves standing

It is worth being precise about the boundaries, because the coverage has blurred them.

This is not an Entity List action. DeepSeek has not been added to the Commerce Department's list of restricted parties, which means American chipmakers, cloud providers and inference hosts face no new export-control obligation to cut the company off at the infrastructure layer — a lever that is losing value anyway, given that DeepSeek's training stack is shifting onto Huawei silicon, including a planned 160,000-chip cluster in Inner Mongolia. It is not a consumer ban: nothing stops an American from downloading the app, and nothing stops a Fortune 500 company from running DeepSeek weights in its own data centre. State and local governments, universities and federal contractors outside the civilian acquisition system are untouched unless a covered agency buys their product.

It also isn't a capability judgment. DeepSeek's V4.1-Flash-1017 is the model that briefly held the open-weight lead this month at roughly 77 percent on DeepSWE for about $0.20 a completed task, which we worked through when it shipped. On Artificial Analysis's broader cost-per-task measure the same week, MiniMax's M3.1 Flash came in at $0.22 against DeepSeek's $0.26. Different suites, same conclusion: the cheapest competent models in the world right now come out of Chinese labs, and the federal government has just removed itself from that market.

That is a defensible trade if the threat model is data exfiltration through a vendor relationship. It is a strange one if the goal was to slow DeepSeek down, because the ban costs DeepSeek almost no revenue — its business is Chinese enterprises, open weights and API resale, not GSA schedules — while costing American agencies the option to use the cheapest tier.

The over-compliance risk

The real second-order effect is not on DeepSeek. It is on the vendors who sell to government and to everyone else out of the same codebase.

Federal procurement has a long history of shaping commercial products well beyond the federal market: FedRAMP authorizations became a de facto security baseline for state governments and regulated industries, and the Kaspersky case started as a prohibition on federal networks and ended with a Commerce rule barring US sales of the company's software altogether. A vendor facing a contract representation that says "no DeepSeek implementations" has three options — rip the model out, maintain a separate federal build, or stop bidding. Two of those three produce a product that no longer contains DeepSeek for any customer.

The spillover will be uneven and mostly invisible. Nobody will announce that a mid-market document tool quietly swapped its base model. The tell will be benchmark regressions in tools that were previously cheap and good, and a widening gap between what a federal buyer can procure and what a startup can rent for twenty cents a task.

There is a mirror-image risk inside the government too. A rule that is hard to verify and easy to sign produces paperwork, not security: attestation clauses, model inventory spreadsheets maintained by people who cannot read a config file, and an audit trail that certifies compliance without testing it. The interesting question for CISA is whether it builds a model-level attestation standard or simply inherits the one it has, which is a signature on a form.

What to watch

Whether Commerce follows. FASCSA is a purchasing rule; the Entity List is an infrastructure rule. The absence of a Commerce action this week is the clearest signal that the administration wants to constrain its own agencies without forcing Nvidia, AWS and Azure to make decisions about a Chinese customer.

Whether a model-provenance standard appears. If CISA's implementation team publishes a template for declaring foundation models in vendor products, that document will matter more than the order — it will define what "developed using" means in practice, and it will be copied by every state procurement office that wants to look serious.

Whether any exception becomes public. Sixty days of private filings have already happened. A FOIA request for docket DHS-2026-0628 is the only way to learn which agencies asked for more time, and for what.

Whether DeepSeek answers. The company and China's embassy in London did not respond to CNBC's request for comment. Silence has been DeepSeek's pattern through every restriction so far, and there is no reason to expect a legal challenge: suing over a procurement exclusion requires standing the company does not have.

The order is, in the end, an honest statement of a position the US government has been drifting toward since January 2025 — that a model trained under Chinese jurisdiction is a supply-chain risk regardless of how good it is. The hard part starts now, because the artifact it wants removed is a file that a thousand strangers have already copied.

If your company sells AI features into government contracts, do you actually know which base model is behind each one? Write to us via our contact page.