Who Has to Take DeepSeek Off a Federal Computer?

That second command is the one that reaches past DeepSeek's own apps, and the sentences a person can read never say what an implementation is. A chatbot DeepSeek hosts fits the words. A contractor running downloaded weights on hardware the agency never touches may fit them too. So may a feature tuned from a DeepSeek model and sold under another brand. If you sell software to a civilian agency, you need to know whether your product is inside the sentence. The type in the Register will not tell you.

Bill Toulas at BleepingComputer, writing the morning the notice appeared, described the rationale sitting in that appendix. The concern is that the Chinese government could reach DeepSeek's infrastructure, collect personal information, track users, and end up with sensitive government data. He also cites a February 2025 report from NowSecure on the DeepSeek iOS app: unencrypted transmissions, weak encryption, insecure local storage, user fingerprinting, and data shared with ByteDance. He is plain about the boundary. The order covers federal civilian agencies. Someone using DeepSeek at home is outside it.

The date is where the people who say they have read the pictures diverge. A Haynes Boone client alert says the appendix is Exclusion and Removal Order #2026-01, signed by Secretary Markwayne Mullin, with an original release date of July 24, 2026. Count sixty days from July 24 and the alert says an agency's chance to request an exception ended on September 22, before the public notice existed. Elena Voss at Threat Frontier, working from the same PDF, also reports a July 24 original release date, and she quotes the order as effective immediately after issuance. She treats the sixty days as unsettled. In her account the text never says whether the clock starts in July or at publication in October. Only agencies may ask for an exception. Vendors have no request of their own. CISA answers in writing. There is no second date by which the software must be gone. The instruction she reports is the word immediately.

So who has to take DeepSeek off a federal computer? Civilian agencies do, when the product is plainly DeepSeek's or an affiliate's. That duty is in the type anyone can read. Vendors are stuck with the undefined phrase. Threat Frontier notes that the published order includes no vendor certification and no bill of materials for models, so a company has no stated way to prove a stack is clean. Haynes Boone's advice is what you tell a client when a category has no drawn edge: find every place a DeepSeek weight sits in the product, including the copy you host yourself, and write it down. Voss adds a limit that changes the "who." National security systems and sensitive compartmented systems sit outside this order, with Defense and the Director of National Intelligence.

A kitchen laptop is outside it too. The hard case is the derivative. DeepSeek's weights have been public for a long time, so an IT office can delete an app with DeepSeek's name on it and still be left holding a coding tool, a chatbot, or a vendor feature that was built from those weights. DHS answered that problem with a clause, then published the clause's parent document as an image, on a delay long enough that one law firm says the chance to object was over before the notice existed. Until CISA or the Register prints the order as text, the honest answer stays narrow. Agencies have to remove what they can identify as DeepSeek. Everyone else is guessing at a word the government has not defined in type.