A Federal Register notice will not trend. It should still change how a careful buyer reads a software contract.
On October 20, 2026, the Department of Homeland Security published an order telling civilian federal agencies to get one company’s products out of their information-technology systems and to stop buying them. The net is wider than the logo on the box. It also reaches certain third-party tools developed using that company’s implementations. Anyone who briefs this as “the U.S. government banned DeepSeek, ” or as a ban on artificial intelligence, is already wrong on the scope.
What was ordered, and who it binds
The notice is dry on purpose. Its title is “Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements, ” published at 91 FR 66346, document 2026-21447, Docket No. DHS-2026-0628. It went on public inspection on October 19 and was published the next day. James H. Percival II, Homeland Security’s general counsel, signed the notice. The order itself is the Secretary’s.
The legal vehicle is the Federal Acquisition Supply Chain Security Act of 2018, after review of a recommendation from the Federal Acquisition Security Council. CISA’s FASCSA Order Implementation Team handles implementation. This is a supply-chain security order, limited to federal civilian executive branch procurements and civilian agency IT.
Two actions. First, exclusion from civilian-agency procurements of information-technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., including affiliated entities as 48 CFR 2.101 defines them. Second, removal from civilian agency IT of DeepSeek and DeepSeek-affiliate products, and of third-party products and services developed using DeepSeek implementations.
The published Federal Register summary does not recite the motives commentators often attach: data privacy, access by Chinese authorities, security vulnerabilities, or political bias. Those claims are not what the summary establishes. The notice points readers to the signed order in the appendix, on Regulations.gov under Docket No. DHS-2026-0628. If the rationale matters to a board, read that appendix. The official text is the govinfo PDF of 91 FR 66346 (https://www.govinfo.gov/content/pkg/FR-2026-10-20/pdf/2026-21447.pdf), not the unofficial web rendition and not a headline’s motive paragraph. The docket is at https://www.regulations.gov/docket/DHS-2026-0628.
The clause that reaches a product you did not buy from DeepSeek
Banning an app is easy to picture. Someone finds the icon and deletes it. The harder sentence is the one about third-party products and services developed using DeepSeek implementations. A vendor does not have to be Hangzhou DeepSeek to fall inside that removal language. It has to have built with those implementations in a way the order covers. The published summary does not draw that line for you.
Picture two products a civilian agency might already be running. In the first, a support vendor fine-tuned an agent on DeepSeek model weights and shipped those weights inside the product. In the second, a tool once called a DeepSeek API during a pilot and no longer does. “Developed using” is broad enough that a contracting officer could ask about both: an embedded checkpoint, a fine-tune, distilled weights, maybe a dependency nobody negotiated in the master agreement. It is not specific enough for you to decide the boundary from a news recap. The signed order may tighten the language. Do not brief the edge cases as settled until counsel has read it, and do not assume they are empty.
That is the enterprise problem in the legalese. AI for business is rarely a single model named in the contract. It is a stack. A customer-support agent, a drafting tool, a reconciliation bot in finance. Each can sit on model weights the invoice never names. AI automation makes that opacity feel efficient until a customer, a regulator, or a government buyer asks which model is in the box.
If you cannot answer, you cannot promise that a civilian agency is still allowed to keep your product. This notice does not hand a removal duty to every private company. A firm that never sells to the federal government, and whose customers do not either, does not inherit one from this page. The exposure is flow-down and embedded-component risk: civilian agencies, primes that sell IT to them, and anyone whose product sits on those systems.
Treat it like any other excluded component, not like a news cycle. A model can become a liability without being malicious. It only has to sit in a system your customer is no longer permitted to run. My view, and it is a view rather than a sentence in the notice: model provenance is joining chip origin and cloud region as something a serious procurement file has to answer.
Synthetic media is the same kind of accountability
The cleaner story, governments fear AI and businesses want it, is tidier than the record. The government action documented here is a civilian supply-chain order against one company’s products. On the policing side, what is worth planning against is an evidence problem.
Interpol’s Project SynthWave runs from March 2025 through February 2026, funded by the Government of Japan. The countries listed are Brunei, Cambodia, Indonesia, Laos, Malaysia, the Philippines, Singapore, Thailand, and Vietnam. Interpol defines synthetic media as images, video, audio, or text wholly or partly generated or manipulated by AI. It predicts that most digital content may become synthetically generated and hard to tell from the real thing. That is a forecast, not a measurement. It is still the forecast to plan against.
The same page does not treat synthetic media as only a threat. It says synthetic media can also be a tool for law enforcement. The work listed is institutional: research, guidelines, training, and protocols for authenticating digital evidence, plus a related research study titled “Forged Realities.” Quieter than a public-service campaign. Closer to how companies actually get hurt.
Once a face or a voice can be reproduced from a thin slice of public content, the old tells stop being a control. Bad grammar, an off-brand logo, a slightly wrong background: those were never a strong system, and they are a weaker one now. A familiar voice on an unsolicited call is not a credential. A video that looks live is not proof of a live person. Identity has to move from “does this look right?” to “can we authenticate the record?”
Prevalence figures travel faster than their methods. Do not hang a control framework on an unsourced percentage. The direction is enough. Synthetic image, audio, and video can imitate real people, and checks that stop at appearance are under strain. You are accountable for signals you did not produce, just as you are accountable for models you did not think you bought.
Three questions to send before the next renewal
None of this requires a new ideology about data, and it does not require stapling a favorite infrastructure pitch onto a security notice. It requires the questions procurement teams already know how to ask about any other critical supplier. Put them in writing:
- Was any feature of this product developed using DeepSeek implementations? Say whether that means embedded weights, a fine-tune, distilled weights, an API dependency, or something else, and say so if the answer is no.
- Is Hangzhou DeepSeek Artificial Intelligence Co., Ltd., or any affiliated entity as 48 CFR 2.101 would define affiliation, anywhere in the development or delivery chain?
- If a civilian-agency customer had to remove the product, what would removal actually require: a configuration change, a model swap, a retrain, or a rip-out? How long would it take, and who owns the work?
Apply the same discipline to the agents you run yourself. This part is a recommendation, not a finding in the notice. Use tools you can explain, log, and swap out. Restrict what an AI agent may approve without a human or a logged check. For regulated work, a dazzling consumer model is a poor production system if nobody can reconstruct why a decision fired. Purpose-built tools, explainable enough for an examiner, assist a process instead of creating one nobody can review.
For anything customer-facing, including payments and AI for sales, verify unsolicited voice, video, and payment requests on a second channel. That is the same habit a surprise wire instruction should already have triggered. It does not depend on this order, and it does not depend on one police campaign.
Questions for the next steering committee
- Did Homeland Security ban AI, or ban DeepSeek across the U.S. government?
No. The October 20, 2026 notice excludes and removes specified DeepSeek-related products from federal civilian executive branch procurements and civilian agency IT. It is not a government-wide DeepSeek ban, and it is not a ban on AI tools.
- Does the published notice spell out the national-security rationale?
Not in the Federal Register summary, which does not state the privacy, access, vulnerability, or bias theories often repeated in commentary. Read the signed order appendix under Docket No. DHS-2026-0628, using the govinfo PDF, before treating those theories as the order’s findings.
- Does a private company inherit this duty if it never sells to Washington?
Not from this notice alone. The live risk is flow-down and embedded components: civilian agencies, contractors who sell IT to them, and vendors whose products sit on those systems, including some tools not bought from DeepSeek itself.
- What has Interpol actually published on synthetic media?
Project SynthWave, March 2025 through February 2026, funded by the Government of Japan, covers research, training, and protocols for authenticating digital evidence with listed Southeast Asian members. Interpol also describes synthetic media as a possible law-enforcement tool, not only as a crime method.
- Should we pause AI automation until the rules settle?
Nothing in this order requires a pause. Prefer tools you can explain, log, and replace, and confirm unsolicited voice, video, and payment requests on a second channel. That second step is operational advice, not a finding from the notice.
The companies that handle this well will look boring in the best way. They will know which models sit under their agents. They will be able to pull one out without an archaeology project. They will treat a convincing face on a video call as a claim, not as proof. Washington’s notice is a reminder that the model in the stack is now a supplier, whether or not anyone in the room negotiated with it.