Cybersecurity News Today: The DeepSeek Removal Order Reaches Inside Your Vendors' Products
The supply-chain story in cybersecurity news today is not a hack. It is an order. The U.S. Department of Homeland Security has told federal civilian agencies to remove DeepSeek products from their IT systems and to stop buying from the Chinese AI developer and its affiliates. The part that should get every vendor's attention: the order also covers any third-party product or service "developed using DeepSeek implementations" — and the order never defines that phrase. If you sell software to the U.S. government, or buy software that has an AI model inside it, the three-question check below tells you where you stand.
Honest scope — read this first: This order binds federal civilian agencies: what they run and what they buy. It does not restrict private companies or the public, and it does not make DeepSeek illegal to use in the United States. The Defense Department and the intelligence community sit under different officials in the same law. The real exposure for most readers is commercial, not criminal: if a product you sell or depend on was built with DeepSeek technology, a federal customer may have to remove it, and "we did not know a model was inside" is not a defense the order recognizes.
What the order says, exactly
Issuer and dates: Homeland Security Secretary Markwayne Mullin issued the order on July 24, 2026; DHS published it in the Federal Register on October 20, 2026 (docket DHS-2026-0628).
Legal basis: the Federal Acquisition Supply Chain Security Act of 2018, after a review by the Federal Acquisition Security Council, which recommends exclusion and removal orders.
Named target:Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 models, plus its affiliates as defined in federal acquisition rules.
What agencies must do: remove DeepSeek products from their information technology systems, remove third-party products and services developed using DeepSeek implementations, and buy no new IT products or services from DeepSeek or its affiliates.
Precedent: the 2018 law was first used in 2025, when the Director of National Intelligence excluded Acronis, a Swiss cybersecurity company, from intelligence community procurement and ordered its products removed from intelligence community systems.
Jul 242026: the order was signed, months before it became public
Oct 202026: the order was published in the Federal Register
2018the Federal Acquisition Supply Chain Security Act behind the order
60 daysadvance filing for an exception request, per CyberScoop's reporting
The order also stops new purchases, so 100 percent of future civilian-agency IT buying from DeepSeek and its affiliates is off the table unless an exception is granted. Agencies can ask for exceptions; vendors cannot ask on their own behalf, which is why the inventory work below belongs to vendors as much as to agencies.
Why this cybersecurity news today matters: a model is now a regulated part
Most organizations think of an AI model as something they buy. This order treats a model as something a product can contain. DeepSeek's models are open-weight and cheap to run, so they sit inside other companies' chatbots, search tools, coding assistants and support products, often several layers down a supply chain the buyer never inspected. A removal order against one model is only as strong as each vendor's ability to say which models sit inside its own product. That is the gap this order exposes, and it will not be the last order of its kind: the same law, the same council and the same undefined-phrase problem can be pointed at any model supplier a government decides is a supply-chain risk. The organizations that handle this well are the ones that already keep a model inventory the way they keep a software bill of materials.
The DeepSeek inventory check — three questions
Answer honestly. Everything runs in your browser; nothing is sent anywhere.
Run the DeepSeek removal check now
Inventory every model: list each AI model inside each product you run or sell, including open-weight models, fine-tuned copies, and models a supplier embedded on your behalf. Record the family, the version and who chose it.
Flag the DeepSeek family: R1, V3, V4 and their updates, plus distilled or fine-tuned derivatives. A derivative trained from DeepSeek outputs is the hardest case the undefined phrase creates; document your reasoning either way.
Check the contract trail: federal work carries supply-chain clauses (contractors should check for FAR clause 52.204-30). Find out which of your contracts flow the order down to you before a customer asks.
Remove, replace, or prepare the exception: covered products come out of agency systems. Where removal is not possible, the agency, not the vendor, requests an exception, and reporting puts the filing 60 days ahead with a compelling justification. Start early.
Watch the traffic: DHS's July memo told agencies to monitor traffic to and from DeepSeek services. If your product phones a DeepSeek endpoint, that traffic is visible to your customer's security team whether you disclose it or not.
Keep the inventory as evidence: the deliverable is a dated, written model inventory you can hand to any customer who asks. That document is the difference between a vendor who can answer in a day and one who guesses.
DisclosureGuard — Ingenious AI's AI disclosure compliance platform — is built for the habit this order now demands: knowing which AI sits inside what you ship, and holding the disclosure records that prove it. Get early access on WhatsApp.
FROM INGENIOUS AI
DisclosureGuard is built for exactly this: knowing what AI sits inside what you ship, with the disclosure records to prove it.
1. What does the order tell federal civilian agencies to do?
2. Which products beyond DeepSeek's own apps are covered?
3. Does the order restrict private companies or the public?
4. What is the trap in the order's wording?
5. What is the first move for a vendor that sells to agencies?
Frequently asked questions
What is the DeepSeek removal order, in plain terms?
It is an order from the U.S. Department of Homeland Security, dated July 24, 2026 and published in the Federal Register on October 20, 2026, that tells federal civilian agencies to remove DeepSeek products from their IT systems and stop buying them. It also covers third-party products and services developed using DeepSeek implementations, a phrase the order does not define.
Who has to comply with the order, and who does not?
The order covers what federal civilian agencies buy and run. The Defense Department and the intelligence community answer to different officials under the same 2018 law, and each can issue its own order. Private companies and the public are not restricted by this order. Companies that sell IT products or services to civilian agencies are affected through their contracts, because agencies cannot keep or buy covered products.
What counts as a product developed using DeepSeek implementations?
The order does not define the phrase, and DHS has not published a list. On the plain wording, it reaches past DeepSeek's own apps to third-party software and services built with DeepSeek technology, which can include products that embed DeepSeek's open-weight models or were built on its hosted service. Vendors have to judge the reach themselves. Agencies can request an exception, and CyberScoop reports the request must be filed 60 days in advance with a compelling justification.
Why did DHS single out DeepSeek?
The order says DeepSeek's models present multiple threat vectors. It points to the company's privacy policy, which says user data is collected, processed and stored in China, where national security law gives the government extensive authority over data held by companies. It warns that prompts from government employees or vendors could transfer sensitive data to China, that such use could produce actionable intelligence on U.S. persons and agencies, and that the models themselves may contain security vulnerabilities.
What should an agency or vendor do first?
Build the inventory. List every AI model inside every product you run or sell, including open-weight models, fine-tuned copies and models a supplier embedded for you. Flag anything from the DeepSeek family. Then remove covered products, replace them, or start the exception process, and keep the inventory as your evidence. You cannot certify compliance with an order about models you have never listed.
Sources: The Hacker News, October 21, 2026 (the order's terms, the July 24 signing date, the October 20 Federal Register publication, the 2018 law and the 2025 Acronis precedent) · TechCrunch, October 20, 2026 (the exception route and China's response) · CyberScoop's reporting on the order, as carried in the coverage above (the 60-day exception filing and the FAR clause note).