On Sept. 25, the U.S. Court of Appeals for the D.C. Circuit issued its much-anticipated decision in Anthropic PBC v. U.S. Department of War, upholding the U.S. Department of Defense's exclusion of Anthropic's Claude artificial intelligence models from its supply chain under the Federal Acquisition Supply Chain Security Act of 2018, or FASCSA.
The ruling means the government may continue its efforts to require contractors to cease the use of Anthropic as part of the performance of federal contracts. This article summarizes the decision and steps contractors should consider taking in response.
Background
The dispute between Anthropic and the federal government began with a contract disagreement over AI usage restrictions — i.e., Anthropic held a $200 million Pentagon contract and was the first frontier AI company to deploy models on classified government networks.
Anthropic maintained two "red lines": It refused to allow its Claude AI model to be used for mass domestic surveillance of Americans or in fully autonomous weapons systems. When the DOD demanded that Anthropic agree to "all lawful use" of its technology without these restrictions, Anthropic refused. On Feb. 27, President Donald Trump and Secretary of Defense Pete Hegseth announced on social media their intention to remove Anthropic from the federal supply chain.
On March 3, Hegseth issued a formal determination under FASCSA to take covered procurement actions against Anthropic, finding that the continued integration of Claude into DOD systems presented a "significant supply chain risk," that removal was "necessary to protect national security," and that no "less intrusive measures" were "reasonably available."
Hegseth also determined that an "urgent national security interest" required immediate action. DOD Chief Information Officer Kirsten Davies then ordered the removal of all Anthropic products from DOD systems within 180 days and prohibited contractors from using Anthropic products in DOD work.
Anthropic filed suit challenging these designations in the D.C. Circuit (regarding the FASCSA designation) and the U.S. District Court for the Northern District of California (regarding the designation under a different statute, Title 10 of the U.S. Code, Section 3252).
On Aug. 27, in Anthropic PBC v. U.S. Department of War, the Northern District of California set aside the DOD's designation of Anthropic as a supply chain risk, finding that Section 3252's definition of "supply chain risk" — which requires that "an adversary" engage in sabotage or subversion — did not encompass Anthropic's good faith enforcement of contractual usage restrictions.
The D.C. Circuit's Decision
Writing for a 2-1 majority, U.S. Circuit Judge Gregory G. Katsas rejected each of Anthropic's challenges.
Supply Chain Risk Designation
The central question was whether Anthropic's conduct fell within FASCSA's definition of "supply chain risk" — the risk that "any person" may "sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate" the design, integrity or operation of covered information technology products.
The court held that Anthropic's model training, through which it embedded restrictions preventing Claude from performing certain tasks, constituted manipulating the design and operation of Claude within the statute's plain meaning. The court rejected Anthropic's argument that the statute's references to "sabotage" and "malicious" conduct imposed an overarching requirement of bad motive.
Instead, the court found that the word "manipulate" in both verb strings of the statutory definition does not uniformly connote bad intent. The court emphasized that the statute focuses on what a supplier does to a product's function, not why it does so.
The court distinguished FASCSA from the narrower Section 3252 at issue in the Northern District of California case. Under Section 3252, the term "supply chain risk" is limited to threats from an adversary who may "sabotage, maliciously introduce unwanted function, or otherwise subvert" covered systems — language that the court held more clearly connotes hostile intent. The D.C. Circuit acknowledged that the Northern District reasonably concluded that Anthropic did not act with such bad motive but held that Section 4713's broader language required no such showing.
The breadth of the court's holding has significant implications for contractors. Under the court's holding, the government could designate products as supply chain risks for standard commercial features. For example, the government could designate a software-as-a-service provider a supply chain risk because it has the capability to cut off access for nonpayment and therefore could deny the government access under FASCSA.
Similarly, an application developer who can push software updates is also a potential supply chain risk because such updates could manipulate the application under FASCSA. Having rejected Anthropic's "bad motive" interpretation, the majority's decision has handed the government the authority to turn standard commercial features into potentially company-crippling vulnerabilities through a supply chain risk designation.
No "Less Intrusive Measures" Available
The court also upheld the secretary's finding that less intrusive measures were not reasonably available. Anthropic argued that the FASCSA designation branded it as a national security threat, causing reputational harm beyond what ordinary contract termination would produce. The court was skeptical, noting that Anthropic's valuation had reportedly soared to over $900 billion since the exclusion.
Regardless, the court reasoned that articulating the same national security concerns through conventional contract termination would have been equally stigmatizing. The court further credited the secretary's decision to make a "clean break" rather than undertake the delay, expense and uncertainty of a granular, system-by-system review of Claude's uses.
Ban Did Not Violate Due Process and First Amendment Rights
The court rejected Anthropic's due process and First Amendment claims. On due process, the court found that post-deprivation process was constitutionally sufficient given the government's legitimate need to act quickly.
On the First Amendment, the court found no causal connection between Anthropic's protected advocacy regarding AI safety and the adverse action. The record showed that the DOD removed Anthropic from its supply chain because of a contractual dispute — i.e., Anthropic's refusal to agree to an "all lawful uses" term — not because of the company's public statements.
The court noted that the DOD had never retaliated against Anthropic during years of advocacy and had continued to pursue the commercial relationship even after Anthropic published articles calling for AI safety limits.
Dissent Finds FASCSA Interpretation Too Broad, Previews Potential Further Proceedings
U.S. Circuit Judge Karen L. Henderson dissented, arguing that the majority's broad reading of "manipulate" in Section 4713(k)(6) effectively reads out the statute's multiple references to hostile and deceptive conduct.
Relying on canons of statutory construction, Judge Henderson contended that the residual "or otherwise manipulate" clause should be limited to acts of intentionally subversive or deceptive manipulation, consistent with the surrounding verbs "sabotage" and "maliciously introduce." She warned that the majority's interpretation would allow the government to designate any contractor that enforces disfavored contractual restrictions as a supply chain risk, even if the restrictions are lawful and applied in good faith.
In response to the ruling, Anthropic stated that it remains "confident in our position" and that it is "considering all options, including further review." While it is not yet clear what steps Anthropic will take next, available options could include seeking rehearing en banc before the full D.C. Circuit. Judge Henderson's dissent, combined with the significant questions of statutory interpretation at the heart of the case, could support such a petition.
What Does the D.C. Circuit's Decision Mean for Contractors?
The D.C. Circuit's decision carries significant implications for the government contracting community. We provide guidance below in light of the ruling.
The D.C. Circuit's decision does not change how the ban is implemented.
The court's ruling validates the secretary's authority to exclude Anthropic under FASCSA, but it does not itself operate as a contract-level prohibition. The ban still reaches individual contractors the same way it did before the decision (i.e., via Federal Acquisition Regulation 52.204-30 as incorporated into specific contracts), through contract modifications identifying Anthropic as a covered source, and through agency directives and certification requests.
Contractors should expect implementation activity to accelerate now that the court has upheld the designation.
Understand the scope of "as part of the performance of" a federal contract.
FAR 52.204-30 prohibits contractors from providing or using covered articles "as part of the performance of the contract." But what does that mean in practice?
For example, does the prohibition reach a back-office business system — such as a human resources or accounting tool powered by Anthropic — that indirectly supports contract performance? What if Claude is embedded in a third-party software tool used across the contractor's enterprise, including by personnel performing the contract? These questions may be particularly challenging for contractors with shared personnel, systems and enterprisewide technology platforms.
Given this ambiguity, some contractors may opt to eliminate Anthropic products entirely.
Respond carefully to certification requests.
Contractors across the defense industrial base have received certification requests in varying forms asking them to confirm nonuse of Anthropic products or to provide removal plans. These requests have featured different deadlines, scopes and certification language, and some invoke the False Statements Act.[2]
Contractors should designate a single point of contact to receive, assess and coordinate all Anthropic-related certification responses, carefully review each certification, and confirm the scope of the certification is appropriate. For example, if a certification covers companywide Anthropic use rather than use "in the performance of" a covered contract, contractors should raise that discrepancy with the contracting officer.
Anticipate contract modifications.
Contractors should expect to receive contract modifications incorporating the Anthropic ban. Under FAR 52.204-30(b)(4), a FASCSA order issued after the date of solicitation applies to a contract "only if added by an amendment to the solicitation or modification to the contract."
Watch for potential en banc review.
As discussed above, Anthropic has signaled it is considering further review, which could include seeking rehearing en banc before the full D.C. Circuit. En banc review could prompt reconsideration of the panel majority's broad interpretation of supply chain risk, and a reversal would fundamentally alter the compliance landscape.
"What Anthropic Security Ruling Means for Gov't Contractors," by Justin A. Chiarodo, Robyn N. Burrows, and Michael J. Montalbano was published in Law360 on October 1, 2026. This article was originally posted as a Government Contracts Navigator blog post.