FASCSA Orders Require Exclusion and Removal of DeepSeek AI

New Federal Acquisition Supply Chain Security Act (FASCSA) orders from the Department of Homeland Security (DHS), the Department of War (DoW), and the Director of National Intelligence (DNI) require the exclusion and removal of products and services by DeepSeek and its affiliated entities (collectively, DeepSeek).1 The DoW and DNI orders are laid out in their entirety within the SAM.gov downloadable spreadsheet of FASCSA orders, and neither provides details about the reasons for excluding or removing DeepSeek. By contrast, the civilian order, published on October 20, 2026, identifies DeepSeek’s free open-source artificial intelligence (AI) models as “present[ing] multiple threat vectors.” These include threat vectors associated with the company’s known technical vulnerabilities, obligation to provide the government of the People’s Republic of China certain access, and the fact that information collected by the company’s apps and AI models could be used to create “actionable intelligence” about the U.S. government.   

FASCSA established the Federal Acquisition Security Council (FASC), which is an inter-agency body created to assess supply chain risk and make removal and exclusion recommendations to three order-issuing agencies: DHS, with respect to civilian agencies; DoW, with respect to defense agencies; and DNI, with respect to the Intelligence Community (IC) agencies and contracts involving sensitive compartmented systems. (Read more about the contractor obligations, including the obligation to review SAM.gov for new orders every three months and conduct a reasonable inquiry based on new FASCSA orders, here.) FASCSA also authorizes agency- and contract-specific “covered procurement actions,” which was one of the authorities DoW used to designate Anthropic a supply chain risk in early 2026.  

These specific DeepSeek orders impact all federal executive agency procurements. They have three parts:  

1. The orders designate AI models and applications developed or provided by DeepSeek as “covered articles.”  
2. The orders require federal agencies to exclude DeepSeek (including its affiliates) and its products and services (i.e., covered articles) from their procurements.  
3. The orders require removal of covered articles from federal systems or those that are used in performance of federal contracts. 

The definition of “covered articles” sets the scope for these orders. The defense and IC orders appear to define their scope to cover only “applications and services that implement” a DeepSeek AI model. That is, the “covered article” definition focuses on software that incorporates a DeepSeek AI model, regardless of where that model is hosted, even if the DeepSeek model integrated is the open-source, open-weight instance that has been integrated locally. The civilian order, on the other hand, has a significantly broader scope because DHS defines “covered articles” to include all the above as well as “third-party products and services developed using DeepSeek implementations” (emphasis added). The language suggests that products or services developed through DeepSeek’s coding assistant are “covered articles” under civilian agency procurements, subject to the exclusion and removal order.  

Each order requires contractors at all tiers to undertake a reasonable inquiry into their supply chains to identify any provision or use of the “covered articles” in the performance of an applicable contract, pursuant to FAR 52.204-30. If a contractor identifies covered articles, then FAR 52.204-30 requires the contractor to notify the contracting officer within three business days of the discovery and to update that report with mitigation actions within ten business days.