DHS orders civilian agencies to remove Acronis and DeepSeek. The orders are dated July.

The Department of Homeland Security (DHS) has ordered every federal civilian agency to stop buying and to remove two companies' products: Acronis AG, a Swiss maker of backup and data protection software, and DeepSeek, a Chinese developer of artificial intelligence (AI) models. Both are exclusion and removal orders under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). DHS numbered them for 2026: the DeepSeek order is #2026-01 and the Acronis order is #2026-02.

The timing deserves attention, as the law firm Haynes Boone has also pointed out. The signed DeepSeek order gives an "Original Release Date" of July 24, 2026, and the signed Acronis order gives July 31, 2026. SAM.gov, the federal System for Award Management, lists the DeepSeek order as active on October 16. The public notices appeared in the Federal Register on October 20 and October 30. Both orders count their deadlines from "issuance." If issuance means the July release date, the 60-day window to ask for an exception closed in September for both orders, before either was public, and the Acronis removal deadline is January 27, 2027.

What each order requires

Both orders apply to federal civilian executive branch agencies. They do not apply to an agency's national security systems or to what the orders call "secure compartmented information systems." The Department of Defense (DoD) and the Director of National Intelligence (DNI) issue their own orders for those.

Sources: DeepSeek notice and signed order, Acronis notice and signed order.

"Stop buying" reaches past contracts. Both orders tell agencies to exclude the products from "agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions" that agencies use to buy information technology (IT).

The orders give short reasons. The Acronis order says the company's "cyber and backup tools have privileged or root access to customer security systems and present significant risk to the U.S. government information systems." It says nothing more about the risk. The DeepSeek order says DeepSeek's servers are in the People's Republic of China, that account sign-up collects personally identifiable information, that prompts may send sensitive data to China, and that the models "may contain malware or other security vulnerabilities."

The gap between an order's date and its notice

The first FASCSA order also reached the public weeks after it took effect. That order, from the Director of National Intelligence against Acronis, lists July 11, 2025, as its active date and was posted on SAM.gov on September 15, 2025. The two DHS orders took longer.

Nothing in the rules sets a date for public notice. Under the Federal Acquisition Security Council's regulation, the official who issues an order must notify the named company, the congressional committees, and the Interagency Suspension and Debarment Committee, and give the order to the council's information sharing agency. Public disclosure is something the official "may" do (41 CFR 201-1.303(f)). The public record does not say when DHS told agencies about these two orders.

The gap matters most for deadlines. Both orders count from "issuance" and do not define it. Here is the Acronis order's calendar, counted from its July 31 release date.

Counted from the Federal Register dates instead, the exception windows would close on December 19, 2026, for DeepSeek and December 29, 2026, for Acronis, and the Acronis removal deadline would be April 28, 2027. Counted from SAM.gov's October 16 active date, the DeepSeek window would close on December 15, 2026. Only DHS can say which count it uses. An agency that needs an exception should ask the FASCSA Order Implementation Team at the Cybersecurity and Infrastructure Security Agency (CISA) now, in writing, rather than assume the later date.

Why the DeepSeek order reaches further than DeepSeek

The DeepSeek order covers "third-party products and services developed using DeepSeek implementations." It does not define "DeepSeek implementation." DeepSeek's models are open-weight, so anyone can download them and run them on their own servers. The order's removal text does not separate DeepSeek's own hosted service from a model a vendor runs inside its own product. Haynes Boone notes these gaps (Haynes Boone). Crowell & Moring reads the wording as reaching products developed with DeepSeek's coding assistant too (Crowell & Moring).

That makes the DeepSeek order an AI supply chain question, not only an app ban. An agency cannot answer it from its software inventory alone. It must ask the vendors of its AI-enabled products which models they use.

The orders reach contractor and cloud systems

The orders apply beyond equipment an agency runs itself. In a footnote citing the Federal Information Security Modernization Act (FISMA), the Acronis order says it applies "to all Federal Information Systems, including information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency." The DeepSeek order has no such sentence, but its exclusion covers "third party implementations of DeepSeek used to provide products and services to civilian agencies." The law defines a covered article to include "cloud computing services of all types" (41 U.S.C. 4713(k)(2)).

So the question for a security office is not only "do we run Acronis?" It is also "does any provider that runs a system for us use Acronis or a DeepSeek model inside it?" In FedXchange's reading, that includes backup and recovery tools a provider uses inside the system it runs for the agency.

Contractors have their own duties under the Federal Acquisition Regulation (FAR) clause 52.204-30. For contracts outside DoD, DHS orders apply. The clause requires a contractor to:

• check SAM.gov for FASCSA orders at least once every three months during the contract;
• make a reasonable inquiry when a new order could affect its supply chain;
• report a covered product to the contracting officer within 3 business days of finding it; and
• send more detail on mitigation, and on how it will prevent repeat use, within 10 business days after that report.

A FASCSA order issued after the solicitation date becomes a prohibition under that contract only when it is added by an amendment to the solicitation or a modification to the contract, though the inquiry and reporting duties still apply. For an order issued after award, the contracting officer should make that modification within a reasonable time, and no later than 6 months after the program office decides it is needed (FAR 4.2304(c), FAR 52.204-30).

What agency staff should do now

A few more steps fit specific roles:

• Chief Information Security Officers should record each finding and its removal date in the plan of action and milestones, and treat any product kept under an exception as an accepted risk with an end date.
• Senior agency officials for privacy should check whether any staff entered personally identifiable information into DeepSeek's hosted service, since the order names that collection as a risk.
• Acquisition staff should confirm that solicitations and existing contracts carry FAR 52.204-29 and 52.204-30, and that the program office has decided which existing contracts need modification.
• Authorizing officials should ask whether any system they authorized depends on an excluded product, including through a provider, before its next continuous monitoring review.

Three orders for each company

DHS's orders complete a set. FedXchange's governance tracker records DoD orders against Acronis (March 10, 2026) and DeepSeek (September 8, 2026), and the DNI order against Acronis from 2025. Crowell & Moring also describes a DNI order against DeepSeek. The tracker dates each order by its SAM.gov active date, which can differ from the date on the signed order. For civilian agencies, the DHS orders are the ones that apply. Federal News Network reports that the DNI order against Acronis gave no detail on its concerns, and Crowell & Moring reports the same of the DoD and DNI orders against DeepSeek. The DHS orders give short reasons. The FedXchange governance tracker lists each order as SAM.gov posts it.

Sources

• DHS: Notice of Order Regarding Exclusion and Removal of DeepSeek Products, 91 FR 66346 (October 20, 2026), with Exclusion and Removal Order #2026-01
• DHS: Notice of Order Regarding Exclusion and Removal of Acronis Products, FR Doc. 2026-22215 (October 30, 2026), with Exclusion and Removal Order #2026-02, public inspection copy
• Federal Register public inspection page for FR Doc. 2026-22215
• 41 CFR part 201-1, Federal Acquisition Security Council
• 41 U.S.C. 4713, Authorities relating to mitigating supply chain risks
• FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition
• FAR subpart 4.23, Federal Acquisition Security Council
• SAM.gov Supply Chain Security Orders
• Mayer Brown: DNI Issues First FASCSA Exclusion and Removal Order Against Acronis AG
• Crowell & Moring: FASCSA Orders Require Exclusion and Removal of DeepSeek AI
• Haynes Boone: DHS Issues DeepSeek Exclusion and Removal Order
• Federal News Network: DHS bans Swiss cyber firm from federal systems
• FedXchange governance tracker: DHS order excluding Acronis AG
• FedXchange governance tracker: DHS order excluding DeepSeek
• FedXchange governance tracker: DoD order excluding Acronis AG
• FedXchange governance tracker: DoD order excluding DeepSeek
• FedXchange governance tracker: DNI order excluding Acronis AG

Icons by Font Awesome Free, licensed CC BY 4.0.