Washington Banned One AI Vendor. Chinese Models Already Take Two-Thirds of US Developer Tokens

The Department of Homeland Security signed Exclusion and Removal Order #2026-01 on July 24, 2026. It reached the Federal Register on October 20, 2026 under docket DHS-2026-0628, roughly three months later — and by the time it was public, the 60-day exception window had already closed on September 22.

The authority is a Federal Acquisition Security Council review under the Federal Acquisition Supply Chain Security Act, and the scope is all federal civilian executive branch agencies — roughly 430 departments, bureaus and independent agencies. Agencies can still ask CISA for a scope limitation, a delayed implementation, or an alternative safeguard, backed by a written mission-impact justification. But the character of the instrument has changed: this is exclusion from procurement, not guidance to administrators.

DeepSeek's own application was never the prize. The operative language reaches all DeepSeek and DeepSeek-affiliate products and any third-party product or service built using DeepSeek implementations. That single phrase converts an endpoint cleanup into a disqualification criterion.

For a software company selling into government, this is a compliance cliff with a due date. Procurement officers now have to answer a question they never had to ask before: what is under the hood of the product being bid. That favors incumbents who can produce model-provenance attestations quickly and penalizes smaller vendors who route cheap tasks to a commodity API to hit a price point.

The certified channel is arriving at exactly the moment it is worth the most. Analysis of 1,743 federal contracts between September 2023 and March 2026 found that funds obligated for AI rose from $675 million in 2024 to $7.2 billion in 2026, while total potential award value — including ceilings — rose from $4.6 billion to $91.8 billion.

That is the second-order effect of a blacklist: excluding one vendor hands every surviving supplier a certified channel into a budget that grew tenfold. The rule does not create federal AI demand. It decides which companies get to bid for demand that already exists.

The spread is the argument. The company selling proprietary software into federal mission systems trades at seventy times sales, while the company selling federal labor at scale trades at roughly one times sales and is currently shrinking. Procurement access is not what the market capitalizes. Proprietary margins on top of procurement access are.

Here is the part that does not fit the threat narrative. Chinese models were not a rounding error in Western AI development by the time Washington acted. They were carrying the majority of routed developer traffic.

The September 8 advisory did something more durable than the ban. Its recommended mitigations sit inside the model providers' serving stack: subtly alter responses for suspected distillation attempts, apply differential privacy, reduce reasoning depth on flagged accounts, and do not tell the suspected distiller that anything changed.

Operationally, that tells every frontier lab to degrade output for accounts it cannot confidently identify. That is a recurring inference and engineering cost, borne by the highest-priced tier of usage, in exchange for protecting a capability lead that the same advisory argues is already being harvested at industrial scale. For Alphabet, whose capital spending ran at 37.5% of revenue in Q2 2026, an unpriced reliability tax on the premium tier is not a rounding error.

The read-through is uncomfortable for the winners. A certified-vendor channel solves who gets to sell to the government. It does nothing about whether the government's supplier keeps an advantage it can defend for another twelve months.

China's response was framing, not escalation. Foreign Ministry spokeswoman Mao Ning said Beijing opposes overstretching the concept of national security and politicizing technology and trade issues, and the commerce ministry registered strong dissatisfaction. No countermeasure was announced against American suppliers.

The concrete action with a date on it is not Chinese. On October 29, 2026 the Federal Communications Commission votes on an order that would end recognition of every test lab in mainland China, after a transition ending December 1, 2028. This is the same security logic applied to a different bottleneck, and it has a clearer revenue trail than the AI order.

The economics look poor on the FCC's own numbers, and that is precisely what makes it informative. A rule with a negative benefit-cost ratio, a two-year runway, and a fixed vote date is a real trade for the testing industry in a way that an open-ended model ban is not. The AI order has no comparable price tag because it has no disclosed enforcement cost.

In the next two quarters, watch solicitations. Contract language citing the exclusion by docket number will show up in requests for proposal, and the first material signal will be remediation and re-platforming task orders rather than new model awards. On October 29 the FCC vote either creates or kills a dated migration for device testing. And some agencies filed exception requests by September 22 that have not been disclosed; the denial rate is the cleanest available read on how binding the rule actually is.

Over one to three years, the durable question is whether exclusion becomes default. The precedent is already written: the Pentagon network block in January 2025, then agency-level bans, then Section 1532 of the fiscal 2026 defense authorization act signed December 18, 2025, then this order. Each step widened the definition from a device to a network to a supplier. The next widening would be from a named vendor to a country of origin, which is what a reciprocity response would look like from Beijing. The December 1, 2028 testing transition is the fixed point to anchor that timeline, because it forces the question in hardware before it is forced again in software.

Facts: the order is signed, it covers about 430 agencies, it reaches third-party products built on DeepSeek implementations, and it was published three months after agencies had to comply. DeepSeek's revenue is concentrated outside the United States, and its Western consumer and developer traction is now measured in routed tokens it still holds.

Inference: the instrument that matters is the certification requirement, not the exclusion. Every dollar of a $7.2 billion obligated federal AI budget now has to be bought from a vendor that can pass a provenance test, and that requirement will be copied by state and allied procurement long before it changes DeepSeek's income statement. The near-term winners are federal integrators and accredited testing labs; the losers are vendors whose margins depended on cheap commodity inference nobody could audit.