# The DeepSeek Ban Covers Products Built On It. Audit Your AI Stack > A DHS order bars federal civilian agencies from buying products built with DeepSeek. Here is how to audit your AI supply chain and plan a swap. - Canonical: https://zeroraised.com/blog/deepseek-federal-ban-ai-supply-chain - Published: 2026-10-26 - Author: ZeroRaised Team (https://zeroraised.com/blog/authors/zeroraised) - Publisher: ZeroRaised (https://zeroraised.com/) - Section: Growth - Tags: artificial-intelligence, saas, developer-tools The Department of Homeland Security order made public on 19 October requires federal civilian agencies to remove DeepSeek-related technology from their IT systems and bars them from procuring DeepSeek products, including third-party products developed using its technology ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). That clause reaches software that merely uses DeepSeek underneath. If you sell to government or regulated buyers, you need to know what is in your AI stack. **TL;DR** - The order bars civilian agencies from buying DeepSeek products and requires removal of DeepSeek-related technology, including third-party products built with it ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). - The Federal Register names "third-party products and services developed using DeepSeek implementations" and cites the Federal Acquisition Supply Chain Security Act of 2018 ([Federal Register](https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm)). - It was issued on 24 July, made public on 19 October, covers agencies such as Treasury, State and Justice, and excludes the Department of Defense ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). - Agencies had 60 days from issuance to request exceptions, a window likely closed before publication ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). **Disclosure:** ZeroRaised publishes this analysis and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 26 Oct 2026; ZeroRaised has no commercial relationship with the companies named. This is analysis, not legal advice. **A model bill of materials** is a maintained record of every model, provider, host and dependency behind a product's AI features, detailed enough that any one of them can be swapped or removed without rebuilding the product. ## What the order actually says The CNBC report describes two requirements: removal of DeepSeek-related technology from agency IT, and a bar on procuring DeepSeek products and services, including third-party ones developed using its technology ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). The Federal Register notice excludes IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd from federal civilian procurements and removes "third-party products and services developed using DeepSeek implementations" from civilian agency IT, under the Federal Acquisition Supply Chain Security Act of 2018 ([Federal Register](https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm)). DHS cited the potential transfer of sensitive government data to China and security vulnerabilities, and said the models "present multiple threat vectors" ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). The order covers agencies such as Treasury, State and Justice and excludes the Department of Defense ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). ## The clause that catches third-party products "Third-party products and services developed using DeepSeek implementations" is the phrase to read twice ([Federal Register](https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm)). It moves the question from which vendor you buy from to which model your product was built on. The notice does not publish a list of affected vendors or define how far down a supply chain the phrase reaches. A founder cannot assume that because the customer buys from you rather than from DeepSeek, the product is outside the discussion. A dependency can hide in a direct API call, a fine-tune, self-hosted weights, a wrapper or reseller that does not name DeepSeek, or an internal demo in the same environment as a government-facing service. Know which apply, because a buyer will ask. ## Who is exposed, and who is not The direct scope is federal civilian agencies. Private consumers are not directly covered, and the order as reported excludes the Department of Defense ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). Most B2B software sits in between. A founder selling to a state agency, hospital, bank or contractor will meet questionnaires that borrow from federal practice, because auditors and customers expect it. That is an inference about procurement, not a claim about the order's reach. The risk is asymmetric: losing a deal is expensive, while building the answer is cheap if your code is organised. ## The 60-day problem The order was issued on 24 July and made public on 19 October ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). Agencies could request exceptions with written justification within 60 days of issuance ([CNBC](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html)). If the clock ran from 24 July, the window closed in late September, before publication. That is my reading of the dates, not a legal conclusion, and agencies may have handled requests differently. But do not rely on an exception. Build the swap. ## How to audit your AI supply chain Start with one page, not a platform. List every model call with the provider, model identifier, version, endpoint and hosting region, including embeddings and speech models. Map each call to a feature and a customer, record the data path and retention terms, and note who developed any open weights. Name an owner, a review date and where the evidence lives. Then plan the swap: - **Put the provider behind an interface.** One internal function that takes a prompt and returns a result. Scattered model names make every change a project. - **Keep a small evaluation set.** Real tasks with known good answers, run against a second model before you need it. - **Test cost and latency, not just quality.** Our guide to [reducing LLM costs](https://zeroraised.com/blog/how-to-reduce-llm-costs) covers caching and model choice; the [guide to choosing an LLM API](https://zeroraised.com/blog/how-to-choose-an-llm-api) covers the checklist. - **Fix the contract terms.** Ask for notice of model changes, a subprocessor list and a termination route. Rotate keys on a schedule, following the [API key rotation guide](https://zeroraised.com/blog/how-to-rotate-api-keys), and use the [security checklist for vibe-coded apps](https://zeroraised.com/blog/vibe-coded-app-security-checklist) if the product was built quickly. Self-hosting changes where a model runs, not who developed it. The Federal Register refers to products developed using DeepSeek implementations, so moving the same weights to your servers does not obviously change the origin. Put that question to the buyer in writing. ## What this means for bootstrapped founders Supply chain compliance used to need an enterprise budget. It is now a small-team problem, because one API dependency can disqualify a product from a deal. Most small competitors will handle this badly, by ignoring the questionnaire or overclaiming. A founder with a clear model inventory, named dependencies and a tested fallback looks more reliable than a larger vendor with a vague security page. That is a sales advantage you can build cheaply. Do not claim compliance you cannot evidence. Do not confuse hosting with origin. And do not wait for the next order: DeepSeek open-sourced its DeepInfer inference engine on 20 October, a day after the order was made public ([AIMap weekly roundup](https://aimap.page/en/news/weekly/2026-w43/)). ## Where ZeroRaised fits ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity. If you want a public page for your product, [submit it here](https://zeroraised.com/submit). The [pricing page](https://zeroraised.com/pricing) explains the options. We cannot promise traffic, procurement approval or any result, and nothing here is legal advice. [Join the ZeroRaised newsletter](https://zeroraised.com/newsletter) for the next analysis. ## Sources - [CNBC: US orders federal agencies to remove DeepSeek from their systems](https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html) - [Federal Register: Notice of exclusion order under the Federal Acquisition Supply Chain Security Act](https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm) - [AIMap weekly roundup, week 43 of 2026](https://aimap.page/en/news/weekly/2026-w43/) ## Frequently asked questions ### Does the DeepSeek order apply to products that use DeepSeek through an API? The order's wording is broad. The Federal Register text covers third-party products and services developed using DeepSeek implementations, and CNBC reports that the order includes third-party products and services developed using its technology. A product calling a DeepSeek model through an API is a plausible candidate, so document the dependency and get legal advice on your specific contract. ### Does the order apply to the Department of Defense? CNBC reports that the order applies to civilian agencies such as Treasury, State and Justice, and excludes the Department of Defense. If you sell only to defence, the direct scope is different, but your prime contractors may still apply their own flow-down requirements. ### Is self-hosting DeepSeek weights enough to avoid the order? Self-hosting changes where the model runs, not who developed it. The Federal Register text refers to products and services developed using DeepSeek implementations, so moving the same weights to your own servers does not obviously change the origin of the model. Treat this as a question for your buyer and your lawyer, not a workaround. ### What is a model bill of materials? It is a maintained record of every model, provider, host and dependency behind your AI features, with enough detail to swap or remove any one of them. At minimum it should name the model and version, the provider, the hosting region, the data retention terms and the product features that depend on it. ### How quickly should a small team respond? If you have a live government or regulated pipeline, start with the deals you expect to close first. Build the inventory, ask each buyer whether they apply the order, and test a second provider before you need it. A small team can do this in days if the product already has a provider abstraction.