In late October, the Department of Homeland Security (DHS) published two orders in the Federal Register. They tell federal civilian agencies to stop buying, and to remove, products from two companies: DeepSeek, the Chinese artificial intelligence (AI) developer, and Acronis AG, a backup and cybersecurity software company. The orders are addressed to agencies. Contractors still have duties under them, and most small firms will not hear about those duties from their contracting officer first.

The law firm Haynes Boone puts it in one sentence: "FAR 52.204-30 turns an order aimed at agencies into inquiry and reporting obligations for contractors." This post explains what the two orders say, what that clause asks of you, and how a small company can check its own tools in an afternoon.

What the two orders say

Both orders were issued under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), which lets the government exclude a source from federal purchases and order its products removed from agency systems.

DeepSeek, Order 2026-01. The Federal Register notice published October 20, 2026 covers more than the DeepSeek app. It describes the order as "removing all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology." Haynes Boone notes that the order carries a July 24, 2026 release date, nearly three months before publication, and that it does not define "DeepSeek implementation." Because DeepSeek's models are open-weight, meaning anyone can download and run them, a vendor can build one into a product without any visible DeepSeek branding.

Acronis, Order 2026-02. The Federal Register notice published October 30, 2026 describes an order "excluding Acronis AG and all affiliated entities, as well as any covered articles directly or indirectly supplied by them (Acronis covered articles) from federal civilian agency procurements; and, removing all Acronis covered articles from civilian agency information technology systems." Federal News Network reports that agencies have 180 calendar days to remove the products, and that Acronis sells through a network of resellers and partners. An Acronis spokesperson told the outlet that the order applies only to federal agencies and that "This does not affect our customers and partners."

That statement is accurate for agencies and their own systems. It does not settle the question for a contractor whose contract contains the clause below.

The clause that pulls contractors in

Federal Acquisition Regulation (FAR) clause 52.204-30, Federal Acquisition Supply Chain Security Act Orders, Prohibition, appears in many federal contracts. Its core rule is direct: unless a waiver applies, "Contractors shall not provide or use as part of the performance of the contract any covered article" that an applicable order prohibits. Note the word "use." The rule covers the tools your staff use to perform the contract, not only what you deliver to the government.

The clause then sets out a routine:

Timing matters. Paragraph (b)(4) says an order issued after the solicitation date applies to the contract's prohibition only once it is added by amendment or modification, and then adds "However, see paragraph (c) of this clause," which is the reporting paragraph. Haynes Boone reads that as meaning the inquiry and reporting duties still run before any modification arrives. If you are unsure how this applies to a contract you hold, ask your contracting officer in writing and keep the answer.

Defense contractors: which orders apply to you

The clause separates the two worlds plainly: "For solicitations and contracts awarded by a Department of Defense contracting office, DoD FASCSA orders apply." All other contracts follow the DHS orders. So the two DHS orders above do not by themselves reach a contract awarded by a Department of Defense (DoD) contracting office.

That is not the end of the question. The law firm Crowell & Moring reports that parallel DeepSeek orders from the Department of War and the Director of National Intelligence appear in the downloadable FASCSA list on SAM.gov. We were not able to read those orders ourselves, so check the SAM.gov list for your own contracts rather than relying on any summary, including this one. Under the clause, reports on contracts from DoD contracting offices go through the Defense Industrial Base Network (DIBNet) portal, the same place a cyber incident report goes. Many small firms also hold both defense and civilian work, and the civilian contracts follow the DHS orders.

Not sure which clauses your contract carries? Our free Contract Clause Checker and its walkthrough post show how to read the cybersecurity clauses in a contract.

Where these products hide in a small company

Most small firms will not find a DeepSeek contract or an Acronis invoice in their files. The exposure, where it exists, tends to come through someone else.

A one-afternoon check

  1. List every federal contract and subcontract you hold, and note which ones contain FAR 52.204-30 and which were awarded by a DoD contracting office.
  2. Search SAM.gov for "FASCSA order," download the current list, and save a dated copy as your record of the review.
  3. Ask your IT provider and your main software vendors, in writing, whether any product they supply to you comes from Acronis or uses a DeepSeek model.
  4. Check your own software inventory and the apps on devices used for contract work.
  5. If you find a covered product, start the 3-business-day clock, report through the right channel, and document what you are doing about it.
  6. Put the next SAM.gov check on the calendar for three months out.

The vendor questions are the same ones a good third-party risk review asks anyway: what do you run, where does it come from, and who else touches our data. FASCSA orders add a deadline to those questions.

This post is general information, not legal advice. Confirm how an order applies to a specific contract with your contracting officer or counsel.

Sources

Find out what is in your supply chain before the government asks

Adams Cloud & Cybersecurity helps small federal contractors read their contract clauses, inventory the tools they use to perform, and set up a simple quarterly review that keeps the records ready.

Book a free consultation