The Federal Register published document 2026-21447 on Tuesday morning: DHS notice of Exclusion and Removal Order #2026-01, docket DHS-2026-0628, barring federal civilian agencies from procuring anything made by Hangzhou DeepSeek Artificial Intelligence Co. and requiring them to purge existing DeepSeek software from their systems. Politico had it Monday afternoon; Reuters had it Monday night; by Tuesday it was a Hacker News thread at 277 points and 236 comments, most of them some variation of “obviously.”

Here is the part that isn’t obvious. The order was signed on July 24.

Eighty-Seven Days Between the Signature and the Notice

The notice landed Monday at 8:45 a.m. The order it announces is nearly three months old. For that entire window it was, by its own terms, operative — agencies were directed to stop buying DeepSeek products and to remove what they already had. What did not exist was any public document telling the vendor base what “DeepSeek product” meant.

That gap is the story nobody is covering, because the coverage is all about the ban’s existence rather than its plumbing. The plumbing matters. This order runs through the Federal Acquisition Supply Chain Security Act of 2018, which is not a censorship statute and not a criminal statute. It is a procurement statute. It does not fine you; it makes you ineligible. The lever is the contract, which means the actual compliance work falls not on DeepSeek — a company with no federal business to lose — but on American firms that sell into federal contracts and now have to prove a negative about software they did not write.

A compliance lead at a small document-analytics integrator put it this way in a Slack message to her sales team, which I have paraphrased lightly and which she would prefer not be traced further: they discovered this week that a summarization feature a subcontractor bolted on last winter was, in the government’s reading, a DeepSeek product. Nobody at the company had ever opened a DeepSeek account. Nobody had thought to ask what the subcontractor’s model was built on.

The Clause That Reaches Past DeepSeek

Read the operative language. The order excludes DeepSeek products and removes “third-party products and services developed using DeepSeek implementations.” Not the API. Not the app. The lineage.

That is a genuine doctrinal shift, and it happened through a docket rather than a debate. Historically, federal IT security review has asked what a piece of software does — what it connects to, what it exfiltrates, what privileges it requests. This order asks where it came from. Ancestry becomes the security test. A derived model inherits the taint of its progenitor regardless of what the derivative actually does, who hosts it, or whether it ever phones home.

As doctrine, that is coherent. Open-weight models are downloadable, fine-tunable, and effectively impossible to un-publish; if you cannot control the artifact, controlling the procurement chain is the only lever left. As administration, it is a mess. Nothing in the notice tells a 40-person vendor how to certify lineage it cannot inspect. The practical answer will be a new paperwork genre — a model bill of materials, signed attestations, indemnities pushed down the subcontractor stack — invented by consultants and priced per seat.

The Question the Cheering Section Hasn’t Asked

If ancestry is the test, ancestry is the test. It does not stop at the Pacific.

American open-weight vendors have spent three years shipping models fine-tuned on outputs from competitors, distilled from larger teachers, and trained on scraped corpora nobody can fully itemize. The same logic that makes a Chinese-origin weight vector presumptively hostile will eventually be aimed at a domestic lab whose model card admits synthetic training data from a model it declines to name. The precedent set this week is that provenance, standing alone, can disqualify. Whoever holds the pen in 2028 will find that precedent useful, and they will not necessarily be pointing it eastward.

Conservatives spent a decade arguing that the administrative state writes rules in the dark and announces them after the fact. This order did exactly that — signed in July, disclosed in October, operative the whole time — in a cause most of them support. That is how precedents get made: the first application is congenial, so nobody audits the mechanism.

What a Procurement Rule Cannot Do

One more thing the notice does not do. It cannot stop a single determined employee from running open weights on a laptop, air-gapped and forgotten. Nothing in the Federal Acquisition Supply Chain Security Act touches that, and pretending otherwise is how agencies end up with compliant paperwork and noncompliant networks. The controls that would actually bite are unglamorous: egress monitoring, endpoint management, procurement review that happens before the purchase order rather than three months after. None of that generates a Federal Register notice, which is presumably the problem.

The order is probably right on the substance. It is careless on the process, and careless on the precedent. The people celebrating this week should ask themselves a simple question: which domestic vendor do they intend to sacrifice first, when the ancestry test comes home?

Sources