DHS's DeepSeek exclusion order appears in the Federal Register, extending to other companies' products that embed it; China's commerce ministry warns of "all necessary measures"

An order by the US Department of Homeland Security (DHS) excluding DeepSeek was published in the Federal Register dated October 20 (document number 2026-21447, primary source). The legal basis is FASCSA (the Federal Acquisition Supply Chain Security Act), which governs supply chain security in federal procurement. Exclusion orders have been issued under the law before, but this is the first time one has targeted a company that builds AI models. The order covers not only DeepSeek's own products but also other companies' products that embed DeepSeek, making them subject to removal.

China pushed back immediately. The Ministry of Commerce strongly condemned the US for ignoring the agreement between the US and Chinese leaders and warned it would take "all necessary measures" (Ministry of Commerce statement, primary source). The Ministry of Foreign Affairs also addressed the matter at its regular press briefing on October 20 (Ministry of Foreign Affairs). CyberScoop has also reported on the move as a DHS ban on DeepSeek.

A FASCSA exclusion targets a "model company" for the first time

FASCSA is a mechanism for removing supply chain risks from what the federal government buys and uses. Orders under the law come in two forms: "exclusion," which bars future procurement, and "removal," which requires taking out what is already in place. Until now, the targets have been suppliers of software and hardware.

This time, the target is a Chinese lab that releases open-weight language models. Just four days earlier, on October 17, DeepSeek had released the weights for V4.1-Flash-1017 under the MIT license and opened its Search API and Fetch API for agents (as previously reported). Artificial Analysis gave the model an Intelligence Index score of 45, placing it in a tie for second among open-weight models. The US federal procurement system has, in effect, begun treating a Chinese model approaching the frontier in capability as a "supply chain risk," on the same footing as telecommunications equipment and security software.

Until now, when US government agencies shut out DeepSeek, they relied mainly on individual agencies' device-use policies and state orders. What is different this time is that the action runs through a procurement law. A single decision now applies across DHS's procurement and operations as a whole.

Other companies' products that embed it are also subject to removal

The part of the order with the biggest practical impact is that it extends removal to other companies' products that embed DeepSeek. DeepSeek's models are not used only directly through DeepSeek's app and API.

In OpenRouter's weekly tallies, DeepSeek V4.1-Flash ranked first in a week in mid-September with 15.8 trillion tokens (as previously reported; based on media reports). Alibaba's cloud added deepseek-v4.1-flash-1017 to its model list as of October 18. DeepSeek's Search API is said to be available free of charge until November 1 not only from DeepSeek Harness but also from Claude Code and Codex (secondary source). The model is embedded deep behind routers, clouds and coding tools.

If removal extends to "products that embed DeepSeek," DHS and its contractors will have to verify which models the SaaS products and agent platforms they use are routing requests to behind the scenes. The more widespread it becomes for routers to pick a model task by task, the harder that verification gets. Security in model procurement shifts from a question of contracts with labs to a question of the software bill of materials (SBOM) for embedded components.

At the time of writing, however, the following points could not be fully confirmed: the details of the removal deadline and effective date, and whether the order covers running DeepSeek's weights on one's own servers inside the US, or derivative models built by other companies on top of DeepSeek's models. Because the weights are under the MIT license and anyone can take them, how broadly "DeepSeek products" is defined will greatly change how heavy the order turns out to be.

China's commerce ministry: "Ignoring the leaders' agreement"

The Ministry of Commerce's response was forceful. It condemned the US measure as ignoring the agreement between the US and Chinese leaders and warned it would take "all necessary measures" to protect the legitimate rights and interests of Chinese companies. The Ministry of Foreign Affairs also responded at its briefing the same day.

The timing is significant. China is accepting comments on Announcement No. 48 on export controls until November 15 and plans to implement Nos. 49–51 on November 18. The Fifth Plenary Session is scheduled for October 26–29, and US-China dialogue on superintelligence is also ongoing, slated to run through November (all issues covered in earlier reporting). The ministry's deliberate invocation of the "leaders' agreement" can be read as a signal that it is treating the DeepSeek exclusion not as an isolated procurement matter but as an issue bearing on the two countries' commitments as a whole. It has not yet indicated what countermeasures it will take.

Open questions

The order sets a precedent for handling open-weight models within a national security procurement framework. Three questions come next.

The first is whether the order will spread beyond DHS. FASCSA also includes a mechanism through which the council can recommend government-wide exclusions. The second is whether the same treatment will extend to Chinese labs other than DeepSeek, such as Zhipu (Z.ai) or Moonshot. Between September and October, Anthropic named Zhipu and Moonshot in connection with GLM-5.3's cyber capabilities and distillation attacks (as previously reported). The third is how self-hosted open weights will be treated. If they are brought into scope, federal procurement would put a brake on the very practice of US companies building products on top of Chinese open-weight models.

What the Ministry of Commerce's "all necessary measures" refers to should become clearer after the November 18 implementation of the export controls and the Fifth Plenary Session.