The DeepSeek Order Reaches the Model Inside the Product
A federal contractor that has never bought anything from DeepSeek can still owe its contracting officer a DeepSeek report within 3 business days. The Department of Homeland Security's FASCSA order removes from civilian agency systems "third-party products and services developed using DeepSeek implementations." FAR 52.204-30, the clause that carries FASCSA orders into contracts, treats a device or a piece of software with information technology embedded in it as a covered article and a supplier at any tier as a source. On a civilian contract the question becomes which model runs inside what the company delivers and uses, rather than whose name is on the invoice.
What the order requires
The Secretary of Homeland Security issued Exclusion and Removal Order #2026-01 under the Federal Acquisition Supply Chain Security Act, with an original release date of July 24, 2026. DHS published its notice at 91 FR 66346 on October 20, 2026, and SAM.gov has listed the order as an active FASCSA order record since October 16, 2026. It applies to federal civilian executive branch agencies, except for their national security systems and secure compartmented information systems, and it directs them to do two things.
- Exclude DeepSeek, DeepSeek-affiliated entities and their products from civilian agency procurements, effective immediately after issuance, including agency-approved products lists and e-commerce markets.
- Remove DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems.
The procurement bar carries the same reach in a footnote of its own.
Both limbs land on a product another company built using DeepSeek. Agencies that could not remove in time could ask the DHS issuing official for an exception within 60 days of issuance. That route belongs to the agency; the order gives a contractor none.
Three DeepSeek orders sit in SAM
The Federal Register printed the DHS order and no other, and that order says civilian throughout. SAM.gov carries six active FASCSA order records, and three of them name Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.
- Department of Defense, active September 8, 2026.
- Office of the Director of National Intelligence, active October 16, 2026.
- Department of Homeland Security, active October 16, 2026.
The other three name Acronis AG and Acronis SCS Inc, under an ODNI order active since July 11, 2025 and two Department of Defense records active since March 10, 2026.
FAR 52.204-30 sorts orders into two lanes. A contract awarded by a Department of Defense contracting office answers to DoD FASCSA orders, and every other contract answers to DHS FASCSA orders. DeepSeek sits in both lanes. The DoD order's text was not printed in the Federal Register, so a company with defense and civilian work has a DeepSeek order on each side and a published text for one of them.
Software counts
The clause defines a covered article in four parts. The fourth is "Hardware, systems, devices, software, or services that include embedded or incidental information technology." A source is "a non-Federal supplier, or potential supplier, of products or services, at any tier." Read beside the order's third-party language, those definitions put a device, a software tool or a service inside the question whenever a DeepSeek model runs in it, whoever sold it to the contractor.
A running contract does not wait for a modification
Paragraph (b)(4) of 52.204-30 says a FASCSA order issued after the date of solicitation applies to the contract only if added by an amendment or a modification. The same paragraph then says "However, see paragraph (c) of this clause." Paragraph (c) binds every contract that carries the clause, with no modification needed.
- Review SAM.gov at least once every three months, or as the contracting officer advises.
- On finding a new FASCSA order that could affect the supply chain, conduct a reasonable inquiry into whether a covered article, or a product or service from a covered source, was provided to the Government or used in performance.
- Report one that turns up, including through a notice from a subcontractor at any tier, within 3 business days, giving the contract number, the order number, the product, the vendor with its CAGE code and UEI if known, the brand, the model number, the item description and readily available mitigation.
- Within 10 business days after that, report further mitigation and the steps taken to prevent future submission or use.
On a civilian contract the report goes to the contracting officer. The prohibition on providing or using the article waits for the modification; the review, the inquiry and the report do not.
A reasonable inquiry is "designed to uncover any information in the entity's possession" and expressly does not require an internal or third-party audit. The prime must also put the substance of the clause into every subcontract, commercial ones included, with everything except the quarterly SAM review. Each subcontractor then runs its own inquiry, and its notice starts the prime's 3 business days as surely as the prime's own finding.
A new offer represents against it
On a civilian solicitation that carries FAR 52.204-29, the offeror represents by submitting the offer that it has conducted a reasonable inquiry and does not propose to provide or use any covered article or source prohibited by an applicable FASCSA order in effect on the date the solicitation was issued. An offeror that cannot make that representation discloses the product, the vendor, the brand, the model and the reason, and the Government decides whether to waive. Any civilian solicitation issued after SAM listed the order on October 16, 2026 puts DeepSeek, third-party implementations included, inside that representation.
The clauses in force are 52.204-29 and 52.204-30 (DEC 2023). FAR Case 2026-001, published June 23, 2026 at 91 FR 37550, proposes folding them into a new provision at 52.240-2 and a new clause at 52.240-3, and no final rule had published as of October 21, 2026.
Where it lands
For a company on a civilian contract that carries 52.204-30, the exposure sits in what its vendors know about their own products. A vendor's answer on which model runs inside a product the company delivers or uses on the contract becomes information in the company's possession the day it arrives. If that answer is DeepSeek, the contracting officer is owed the contract number, the product, the vendor and the model number within 3 business days, whether or not the contract has been modified to add the order.