What happened
- The U.S. Department of Homeland Security (DHS) published an order from its secretary in the Federal Register on October 20, 2026. It excludes IT products and services from Hangzhou DeepSeek Artificial Intelligence and its affiliates from civilian federal procurement (91 FR 66346, docket DHS-2026-0628).
- The order also directs civilian executive-branch bodies to remove those products from their IT systems. It covers third-party products and services built on DeepSeek implementations.
- According to BleepingComputer, which reviewed the text, the procurement exclusion and the removal apply immediately. Exceptions must be requested within 60 days and are reviewed by CISA, DHS’s cybersecurity body.
- The outlet notes it is not a general ban on companies or consumers.
Why it matters
- The phrase that carries weight is “built on DeepSeek implementations.” The order does not target only the app: it targets the supplier chain. Software with a DeepSeek model inside falls within scope even when another company makes it.
- For a Chilean or Latin American company that sells software or integrations to U.S. contractors, the question becomes which model runs under its product. The requirement arrives through contracts, not through a local law.
- The consequence the notice leaves open: DeepSeek publishes open weights, so using its models does not always go through the company. The published summary does not say when a model hosted by a third party counts as an “implementation.”
The number
60 days. The window for a body to request an exception, with justification and mitigation measures, according to BleepingComputer.
Context
DHS justifies the measure by the risk that Chinese authorities could reach DeepSeek’s infrastructure and government users’ data, and cites a February 2025 NowSecure report on the iOS app: unencrypted transmissions and data shared with ByteDance. It is another front of the same conflict: Mamífero already reported how DeepSeek released its open inference engine and how the U.S. accuses Chinese labs of distilling models.
What’s next
- Exceptions: the 60-day window ends around December 19, 2026, by our count from the publication date.
- CISA answers each request in writing and offers technical help to those who cannot comply.
- No announced dates for compliance audits or for extending the measure to the private sector.
Bottom line
The analysis DHS cites comes from NowSecure, the same firm that just measured how many mobile apps lack post-quantum encryption. App audits end up deciding what software can enter a state.
Sources
- Federal Register — Notice of Order Regarding Exclusion and Removal of DeepSeek Products (document 2026-21447, October 20, 2026; title, issuing department, date and abstract were verified; the full text did not open from our access)
- BleepingComputer — DHS bans DeepSeek products across US federal civilian agencies (October 20, 2026; source for deadlines and scope)
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
