DeepSeek Ban Creates New Compliance And Reporting Obligations For Contractors

WHAT: Last week, the U.S. Department of Homeland Security (DHS) published a Notice of Exclusion and Removal Order No. 2026-01 (DHS FASCSA Order). The order directed exclusion of information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek) and affiliated entities from federal civilian agency procurements. This includes removal of all DeepSeek and DeepSeek-affiliate and third-party products and services developed using DeepSeek implementations from civilian agency information technology. DeepSeek is a privately owned Chinese producer of free, widely available artificial intelligence (AI) applications.

The order was issued pursuant to the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), which established the Federal Acquisition Security Council (FASC) to identify and address supply-chain risks in federal procurement and IT systems. DHS and FASC determined that the use of DeepSeek products presents risks including:

• The potential transfer of sensitive U.S. government data to the People’s Republic of China;
• Intelligence collection targeting U.S. persons and agencies; and
• Exposure to malware and other cybersecurity vulnerabilities.

WHEN: DHS published the Notice in the Federal Register on October 20, 2026, though the order took effect when it was issued on July 24, 2026.

WHAT DOES THIS MEAN FOR INDUSTRY:

The DHS FASCSA Order prohibits the use of DeepSeek products and services in federal civilian agency procurements and IT systems and requires federal civilian agencies to:

1. Exclude “DeepSeek, DeepSeek-affiliated entities, and their products from civilian agency procurements . . . to include agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions that facilitate the procurement of information technology hardware, software, and services”; and
2. Remove “products provided by DeepSeek, DeepSeek-affiliated entities, and third-party products and services developed using DeepSeek implementations,” from agency IT systems.

For entities with contracts awarded by an agency other than the U.S. Department of Defense that include FAR 52.204-30 or RFO FAR 52.240-91, the order could require immediate action.

• Under the FAR clauses, those contractors must conduct a reasonable inquiry to identify whether any DeepSeek products, DeepSeek-affiliate products, or third-party products or services created using DeepSeek were provided to the Government or used during contract performance.
• This includes products and services provided by a subcontractor.
• If a contractor identifies any such products or services, the contractor must provide a report to the Government within three business days of identifying the products or services.
• Contractors also may not provide to the Government or use DeepSeek products or services in performance of civilian agency contracts in the future.

Wiley’s cross-disciplinary Government Contracts, National Security, and Cybersecurity teams will continue to monitor these developments and advise clients on compliance issues related to the DHS FASCSA Order and future FASCSA Orders.

Tessa Jones, a Law Clerk at Wiley Rein LLP, contributed to this alert.