DHS Order 2026-21447 Bars DeepSeek from Federal Civilian Agency Systems

The order, published in the Federal Register under docket 2026-21447, directs agencies to remove DeepSeek software, APIs, and weights from networks, endpoints, and cloud instances. It applies to 100-plus civilian departments and mirrors language used in prior Kaspersky and ByteDance prohibitions. Procurement officers must certify removal within 90 days and block future acquisitions through updated FedRAMP and CISA guidance.

Primary evidence is the 12-page Federal Register notice citing national security risks from Chinese-origin large language models. No quantitative risk data appears in the document; the rationale rests on statutory authorities under the Secure Technology Act and Executive Order 13873. Parallel actions include the 2023 Kaspersky ban and 2024 TikTok enterprise restrictions, both enforced via supply-chain audits rather than technical findings.

The ban extends earlier controls on Chinese hardware and software into the open-weight model layer. DeepSeek-V2 and V3 releases, hosted on Hugging Face and domestic clouds, now trigger the same compliance reviews applied to Huawei equipment. Agencies must replace inference workloads with approved U.S. or allied models, increasing procurement costs and extending migration timelines by 12-18 months.

Contractors face secondary obligations under forthcoming CISA binding operational directives. Expect expanded scope to grant-funded research and state systems within 18 months if enforcement metrics mirror the Kaspersky rollout.