US / Desk — 30 Oct 2026

Washington spent the fortnight building walls around its technology base rather than writing rules for it. The Treasury proposed the statutory outbound investment regime. It extends the limits on US capital from chips, AI and quantum to biotechnology, supercomputing and hypersonics, and to five more countries. The Federal Communications Commission ordered device testing out of China by December 2028. It also tightened its rules for international carriers and first enforced its ban on parts from listed companies, against Huawei's HiSilicon chips. Homeland Security disclosed a July order barring DeepSeek from civilian federal IT, while the health department plans a no-bid bridge contract for Anthropic's Claude as the $1 government deal ends. For Europe the reach runs through US subsidiaries, test labs and software built on Chinese models, and Finland signed its own technology pact with Washington.

At a glance

Period covered: 18 to 30 October 2026.

• Federal AI: Chinese models out, American labs in without a tender. Federal exclusion orders will likely extend to other Chinese AI developers within a year, while US labs keep winning federal work without open tenders.
• Outbound investment: Treasury widens the ban to biotech and five more countries. Treasury will likely finalise the rule in 2027 with biotechnology kept in, taking the US investment ban beyond the sectors Europe reviews.
• FCC: a hardware perimeter around US networks. Testing for the US market will likely leave China by December 2028, with European labs probably kept eligible under the 1998 recognition agreement.

Coming up: 30 Oct, NIST: false base stations in 5G networks; 3 Nov, US midterm elections; 4 Nov, FinCEN: special measure against the A7 Network, comments close; 9 Nov, FCC: cost catalogue for the upper C-band transition, comments close.

Threads

Federal AI: Chinese models out, American labs in without a tender

AI & Compute

Bottom line. Federal exclusion orders will likely extend to other Chinese AI developers within a year, while US labs keep winning federal work without open tenders.
Likely (60 to 90%), moderate confidence. Main limit: the council's recommendation and its evidence are not public, only one company is named so far, and the order waited three months for publication.

What happened. On 20 October the Department of Homeland Security (DHS) disclosed an order barring DeepSeek from civilian federal IT. It was signed on 24 July and took effect at once. Agencies may not buy DeepSeek products and must remove those already deployed. The order also reaches third-party products 'developed using DeepSeek implementations'. It uses the 2018 supply-chain security law, on a recommendation from the Federal Acquisition Security Council. The Pentagon followed on 8 September and the intelligence chief issued a parallel order, the Congressional Research Service (CRS) notes. National security systems are exempt. Meanwhile the health department (HHS) announced a six-month sole-source contract for Anthropic's Claude. On 27 October the General Services Administration (GSA) replaced the $1 offer with a 40% discount on usage-based pricing. (Federal Register (DHS))

Washington's line. DHS gives no reasons in the notice. CRS cites the federal case. CISA, the FBI and the NSA say DeepSeek ran large-scale distillation of US models. NIST's AI standards centre found its models easier to jailbreak and more likely to echo Communist Party narratives. HHS calls its contract a bridge for 'continuity' while it seeks a long-term deal. A State Department cable now orders 'Super Intelligence' for AI in all official wording.

Outside view. Procurement scholar Jessica Tillipman says HHS's added details weaken its sole-source case. DHS's revised AI directive lets the chief AI officer waive any rule. CDT's Tom Bowman says: 'A rule that comes with its own off switch is not a rule.'

For Europe. European software sold to US agencies is affected if it is built on DeepSeek weights, because the order reaches derived third-party products. Vendors serving both markets are likely to drop Chinese models to keep US contracts, which would set a de facto standard for EU public buyers too. The EU has no common rule: Italy's data protection authority blocked DeepSeek's app in 2025, and some member states bar it on official devices. The question for Brussels is whether to decide model provenance in public procurement itself, before supplier choices decide it.

Outbound investment: Treasury widens the ban to biotech and five more countries

Semiconductors & Supply Chain

Bottom line. Treasury will likely finalise the rule in 2027 with biotechnology kept in, taking the US investment ban beyond the sectors Europe reviews.
Likely (60 to 90%), moderate confidence. Main limit: the biotech definitions may narrow after industry comments, and no date for the final rule is given.

What happened. On 26 October the Treasury proposed the rules for the COINS Act, which Congress passed with the defence budget law in December 2025. They replace the programme set up under a 2023 executive order, which covered chips, AI and quantum in China. The law adds supercomputing, hypersonics and five countries: Cuba, Iran, North Korea, Russia and Venezuela. The Treasury adds biotechnology to the prohibited list on its own authority. It covers biological systems used to produce export-controlled toxins, agents with similar effects and certain energetic materials. US investors must notify some deals and avoid others. Comments close on 7 December. (Federal Register (CFIUS))

Washington's line. The Treasury says the United States 'remains committed to maintaining a strong, open investment environment' and wants the least burdensome rule. Congress, it notes, wants US capital kept out of adversaries' military modernisation. The old programme drew about 100 notifications in 21 months. The new one adds a confidential tip line and may publish a database of covered foreign companies.

Outside view. No major outside analysis of the full proposal had appeared by publication.

For Europe. The rule binds US persons, which includes their control over foreign subsidiaries. European affiliates of US groups will need to screen deals in six sectors, and EU funds with US investors will be asked for contractual assurances. Biotechnology is the new front: it reaches European drug developers with Chinese research partners. The EU only asked member states, in a January 2025 recommendation, to review outbound investment in chips, AI and quantum, so the US scope now runs ahead of Europe's. A US database of named Chinese companies would become a reference list for European compliance teams.

FCC: a hardware perimeter around US networks

Regulation & Standards

Bottom line. Testing for the US market will likely leave China by December 2028, with European labs probably kept eligible under the 1998 recognition agreement.
Likely (60 to 90%), moderate confidence. Main limit: the order itself was not available; the list of reciprocal economies and Beijing's response are unknown.

What happened. On 29 October the Federal Communications Commission (FCC) adopted final rules on the labs that test every electronic device sold in the United States. From 1 December 2028 testing and certification must take place in the US or in a country that recognises US labs in return. Fewer than 4% of devices are tested in the US today; Chairman Brendan Carr puts China's share at 82.3%. At the same meeting the FCC tightened its rules for international carriers. They must follow baseline NIST security practices, drop Covered List equipment and report ownership stakes of 5% or more. A week earlier it made its first use of a new ban on 'logic-bearing' parts from listed companies, blocking two devices with Huawei's HiSilicon chips. (FCC)

Washington's line. The FCC presents the order as reciprocity: it 'lacks confidence' in testing where the US has no oversight and has seen 'egregious violations'. Carr says labs see sensitive product details months before launch. Both orders passed unanimously, with Democrat Anna Gomez joining Carr and Commissioner Olivia Trusty.

Outside view. Covington's Inside Global Tech sets out the new component rules in detail. No major outside analysis of the lab order had appeared by publication.

For Europe. European device makers that test in China for the US market have two years to move that work. EU labs should stay eligible: Carr ties reciprocity to mutual recognition agreements, and the 1998 EU–US agreement covers telecom and EMC testing. The order's own list of reciprocal economies was not available to us. The component ban is the bigger shift: one Huawei chip inside a camera now blocks US approval. That goes further than the EU 5G Toolbox, which covers networks and not devices. The Cyber Resilience Act will raise the same question for Europe's own notified bodies.

Signals

Regulation & Standards

• Exemptions To Permit Circumvention of Access Controls on Copyrighted Works · Federal Register (Copyright Office)
  The triennial DMCA review decides what researchers and repairers may unlock, including for AI and security research.
• SP 800-221 Rev. 1, Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk PortfolioInitial Public Draft · NIST
  NIST's ICT risk guidance is a reference for NIS2 supply-chain duties; open for comment until 7 December.

Cyber Operations & Attribution

• Imposing Sanctions to Protect Americans from Intellectual Property Theft · State Department
  Intellectual-property sanctions used for AI trade secrets: five entities tied to the convicted ex-Google engineer.

AI & Compute

• Back in the Chat: California and New York Take Diverging Paths in Second Wave of Chatbot Regulations · Future of Privacy Forum
  States keep writing the binding AI rules: New York's chatbot law against California's.
• Liability Could Rein In Rogue AI Agents. Current Law Falls Short. · Just Security
  The liability argument that the frontier accord leaves open, after the Hugging Face breach.

Semiconductors & Supply Chain

• Request for Comments on Further Suspension of Section 301 Action: China's Targeting of the Maritime, Logistics, and Shipbuilding Sectors for Dominance · Federal Register (USTR)
  The truce in practice: the Section 301 measures on Chinese shipbuilding stay suspended to keep talks going.
• Energy Department Designates Helium as Critical Material to Strengthen American Manufacturing and Supply Chain Security · Department of Energy
  Helium is a chip-fab input on which Europe also depends on imports.

Platforms & Data

• Publicis and LiveRamp; Analysis of Proposed Agreement Containing Consent Order To Aid Public Comment · Federal Register
  Consolidation of advertising identity data, a competition question on both sides of the Atlantic.

Digital Sovereignty & Identity

• OCC Advances U.S. Digital Asset Leadership with Final Rule to Implement GENIUS Act · OCC News
  A final GENIUS Act rule after regulators missed the Act's July deadline: stablecoin issuers under the OCC get their rulebook, including foreign ones.

EU–US

• Memorandum of Understanding Between The Government of the United States of America and the Government of Finland Regarding the Technology Prosperity Deal · White House
  A member state signs a bilateral technology pact with Washington covering 6G standards, quantum and export financing of a 'trusted stack'.

Worth reading

• The Lithography Lever · ChinaTalk
  The case for cutting off DUV exports and servicing, the decision that sits partly in The Hague.

Background from cyber/verso

• The Munition Economy
  How Washington came to treat frontier AI as a strategic asset: the logic behind buying US models and excluding Chinese ones.
• Europe and Digital Sovereignty: Deciding in the Digital World without Depending on Others
  The European side of the dependency question that the FCC's lab rules and the outbound regime raise for EU firms.

Watchlist

Term of the issue

FASCSA, Federal Acquisition Supply Chain Security Act

A 2018 law that created the Federal Acquisition Security Council and lets DHS, the Pentagon and the intelligence chief order agencies to exclude or remove a supplier's products on supply-chain grounds. The council recommends; the department head issues the order, and the evidence can be kept from the public. It is the tool used against DeepSeek. For European readers, it resembles the high-risk-vendor logic of the EU 5G Toolbox, applied to software and AI and made binding across the federal civil service.

Sources and originals

Primary sources and the basis of each assessment.

Federal AI: Chinese models out, American labs in without a tender

• Anchor: Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements, Federal Register (DHS) (T1 · regulation)
• Reading: Removing PRC Artificial Intelligence Models from Federal Agencies, Congressional Research Service (official)
• Reading: HHS sole-source award to Anthropic continues to raise questions, FedScoop (independent)
• Reading: What’s new in Homeland Security’s updated AI policy, FedScoop (independent)
• Reading: How Black-Box Distillation Works, Georgetown CSET (external)
• Reading: GSA expands OneGov agreement with Anthropic, touting steep discounts, FedScoop (independent)
• Reading: Just the Docs: DHS Discloses July Order Stripping DeepSeek AI from Federal Civilian IT Systems, Just Security (external)
• Reading: State Department orders ‘super intelligence’ wording across all official communications, Nextgov/FCW (independent)
• Indicators to watch: Federal Acquisition Security Council orders naming other Chinese AI developers; HHS's solicitation for a long-term AI contract; Whether agencies seek exceptions to keep DeepSeek-based products.
• Assessment: likely, moderate confidence. Basis: The DHS order and its legal basis; the Pentagon and intelligence orders; the HHS sole-source notice and GSA's expanded Anthropic deal; the CRS summary of the federal case.
• EU frameworks: AI Act (public authorities as deployers), Public Procurement Directive 2014/24/EU, GDPR

Outbound investment: Treasury widens the ban to biotech and five more countries

• Anchor: Outbound Investment Security Program Regulations, Federal Register (CFIUS) (T1 · consultation draft)
• Indicators to watch: Comments by 7 December, especially from pharmaceutical groups; Whether Treasury decides to publish a database of covered foreign companies; The Commission's follow-up to member states' outbound reviews, which were due by 30 June 2026.
• Assessment: likely, moderate confidence. Basis: The proposed rule and the COINS Act; Treasury's reasoning for adding biotechnology; the operation of the existing programme since January 2025.
• EU frameworks: FDI Screening Regulation (revised), Commission Recommendation on outbound investment review (January 2025), Economic Security Strategy

FCC: a hardware perimeter around US networks

• Anchor: FCC Proceeds on Device Test Lab Onshoring, Reciprocity Rules, FCC (T1 · regulation)
• Reading: FCC Blocks Two Devices Containing Foreign Surveillance Chips, FCC (official)
• Reading: FCC Bolsters Security for Cross-Border Communications, FCC (official)
• Reading: FCC Takes First Covered List Enforcement Action Under New Ban on Devices Incorporating Prohibited “Logic-Bearing Hardware Components”, Inside Global Tech (independent)
• Indicators to watch: The FCC's list of reciprocal economies; Chinese countermeasures against US labs or certification bodies; Further Covered List component enforcement beyond HiSilicon.
• Assessment: likely, moderate confidence. Basis: The FCC's release and Carr's statement, which ties reciprocity to mutual recognition agreements; the 29 labs already removed; the 1998 EU–US mutual recognition agreement for telecom equipment.
• EU frameworks: EU–US Mutual Recognition Agreement (1998), telecommunications and EMC annexes, Radio Equipment Directive 2014/53/EU, Cyber Resilience Act (conformity assessment), 5G Toolbox

Watchlist, full titles

• 30 Oct: NIST: false base stations in 5G networks (CSWP 36G), comments close
• 3 Nov: US midterm elections
• 4 Nov: FinCEN: special measure against the A7 Network, comments close
• 9 Nov: FCC: cost catalogue for the upper C-band transition, comments close
• 23 Nov: FTC: Publicis and LiveRamp consent order, comments close
• 28 Nov: White House: proposed legal definition of 'Super Intelligence' due from the science adviser
• 30 Nov: FTC: platforms' duties against impersonation scams, comments close
• 30 Nov: Federal Reserve: GENIUS Act rules for stablecoin issuers, comments close
• 30 Nov: NIST: guide to operational technology security (SP 800-82 Rev. 4), comments close
• 7 Dec: Copyright Office: new DMCA anti-circumvention exemptions, first comments close
• 7 Dec: NIST: ICT risk in enterprise risk portfolios (SP 800-221 Rev. 1), comments close
• 7 Dec: Treasury: outbound investment rules under the COINS Act, comments close

Term of the issue. First seen 2026-10-30; last seen 2026-10-30.

Glossary

• CFIUS: Committee on Foreign Investment in the United States
• CISA: Cybersecurity and Infrastructure Security Agency
• CRS: Congressional Research Service
• FCC: Federal Communications Commission
• FinCEN: Financial Crimes Enforcement Network (Treasury), the anti-money-laundering authority
• FTC: Federal Trade Commission
• NIST: National Institute of Standards and Technology
• OCC: Office of the Comptroller of the Currency, the national bank regulator
• USTR: Office of the United States Trade Representative

How the desk works, and how to report an error: method and corrections.