Appeals court leaves Pentagon’s Anthropic risk designation in place

A divided U.S. Court of Appeals for the D.C. Circuit panel denied Anthropic’s consolidated petitions, leaving a Pentagon supply-chain restriction on the AI company in force. Judges Gregory Katsas and Neomi Rao formed the majority in the 2–1 decision issued September 25; Judge Karen LeCraft Henderson dissented.

The ruling preserves the Pentagon’s March 3 procurement action under the Federal Acquisition Supply Chain Security Act. Under a March 6 implementation memo, Anthropic products were to be removed from department systems as soon as practical and no later than 180 days. The memo also barred contractors from using those products in work for the department.

The dispute began after Anthropic refused to accept an “all lawful uses” contract term for Claude while retaining Claude use restrictions covering lethal autonomous warfare and mass domestic surveillance. The majority held that the department could reasonably treat Anthropic’s ability and willingness to build use restrictions into Claude as a covered supply-chain risk. Those restrictions, it found, could prevent the model from performing functions the department considered authorized and necessary.

In the majority’s reading, the law’s definition of supply-chain risk focuses on how manipulation affects a product’s function or use and does not require malicious intent. The court also rejected Anthropic’s due-process and First Amendment claims. It found that the company received prompt notice and an opportunity to respond, and that the exclusion followed a contractual impasse rather than retaliation for Anthropic’s public advocacy.

That interpretation distinguishes the appellate ruling from an August 27 decision by the U.S. District Court for the Northern District of California. The California court set aside a different supply-chain-risk designation under 10 U.S.C. § 3252, a provision whose definition refers to an adversary and requires bad motive. The D.C. Circuit majority agreed that Anthropic had not acted with bad motive, but held that motive was not required under the broader provision before it, 41 U.S.C. § 4713.

In dissent, Henderson argued that the words surrounding “otherwise manipulate,” together with the statute’s history, limit the provision to intentionally subversive or deceptive conduct. On that reading, Anthropic’s disclosed enforcement of its use restrictions would not qualify as the kind of supply-chain risk Congress intended the law to cover.

Anthropic said in March that the designation applied to customers’ use of Claude directly in Pentagon contracts, not to unrelated uses by customers that also hold such contracts. After the appellate ruling, a company spokesperson said Anthropic remained confident in its position and was considering all options, including further review.