The Department of Homeland Security published a Federal Acquisition Supply Chain Security Act exclusion order in the Federal Register on October 20 (91 FR 66346) directing federal civilian agencies to remove DeepSeek products and stop procuring them. The order’s reach is the news: it covers Hangzhou DeepSeek Artificial Intelligence Co., its affiliates, and “third-party products and services developed using DeepSeek implementations.”

That derivative clause is what matters. TechCrunch notes the order “goes beyond banning DeepSeek’s own product” to cover anything built on it. The authority runs through FASCSA 2018 and 41 CFR 201-1, following a Federal Acquisition Security Council recommendation. Scope: all civilian agencies (Treasury, State, Justice), but, per CNBC, explicitly not DoD.

The procedural timeline is its own story. DHS Secretary Markwayne Mullin signed the notice June 26; the operative order is dated July 24; it became public October 20. Agencies must immediately pull covered products from approved-product lists and remove deployed instances, per BleepingComputer. CISA will field exception requests within 60 days on a “compelling justification” standard. DHS cites data transfer to China, user fingerprinting, and vulnerabilities documented in a February 2025 NowSecure report on DeepSeek’s iOS app.

Here’s the operational problem for small B2B vendors selling into federal buyers. There’s no clean technical attestation for “developed using DeepSeek implementations.” Current AI software bill-of-materials tooling can’t reliably trace fine-tunes, distilled weights, or embedded components back to upstream model lineage. Documentation discipline, training records, model-card attestations, upstream vendor contracts, becomes the fallback.

The order lands alongside the White House AI task force’s “no new law” charter and Anthropic’s draft federal AI bill preempting state regimes. Watch the next four to six weeks for CISA’s definition of the derivative clause and the first wave of re-qualifications. The federal procurement perimeter now extends to the provenance of model weights, and the burden of proof sits with the vendor.

Sources

Sources