FASCSA Exclusion Order Targeting DeepSeek: Security Implications and Response Guidance
The DeepSeek FASCSA Exclusion Order: Security Implications and Guidance
On October 20, 2026, the U.S. Department of Homeland Security issued an order under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA) excluding DeepSeek and its affiliates' products and services from federal civilian procurement and requiring the removal of all DeepSeek and third-party products "developed using DeepSeek" from civilian agency IT; parallel orders from the Department of War and the Director of National Intelligence cover defense and intelligence systems, constituting the first government-wide exclusion of an AI model provider under FASCSA. CSA's analysis stated that the order's practical scope comes from the third-party clause: DeepSeek R1 and V3 are released as open weights and can be embedded in commercial products, self-hosted inference stacks and fine-tuned derivatives without brand identification, while "developed using DeepSeek" is not yet defined and CISA has not issued guidance; contractor obligations flow down through all tiers of subcontracting via FAR 52.204-30, and covered products must be reported within three business days of discovery.
The article points out that the order's practical scope comes from the third-party clause rather than the DeepSeek brand, and that federal supply chain companies need to treat model provenance as a compliance credential and pay attention to the three-business-day reporting deadline.