A divided D.C. Circuit panel has denied Anthropic's petitions for review, leaving in place the Department of War's section 4713 determination excluding Claude from that Department's supply chain

What did the D.C. Circuit decide?

It denied both petitions. This is a panel decision of the D.C. Circuit in a single case, and it leaves the Department of War's exclusion in place. Writing for the court, Judge Katsas framed the dispute in the opinion's opening paragraph: the Department decided to exclude Claude "from its supply chain under the Federal Acquisition Supply Chain Security Act of 2018" after Anthropic "refused to relax contractual prohibitions on the use of Claude for lethal autonomous warfare or domestic surveillance."

The holding, in the court's words, follows directly: "We reject these challenges. The Department had ample support for its conclusion that the continued integration of Claude into the Department's information systems, by the Department or its contractors, presented a statutorily covered national-security risk." That is the court's conclusion about the record before the Secretary, reviewed on the standard described below.

The court also rejected the constitutional claims. On due process, it said the Department "promptly notified the company of the exclusion and its supporting rationale, and then gave the company a fair opportunity to contest the exclusion." On the First Amendment, it held that the record showed the Department acted "not because of its advocacy, but because Anthropic refused to agree to a contract term the Department deemed essential to national security."

Judge Henderson dissented on the statutory question. Her opinion is summarised in its own section below.

What does section 4713 allow, and how did the Department use it here?

As the court describes it, 41 U.S.C. 4713 authorizes "covered procurement action[s]" to prevent agencies from using information technologies that pose a risk to national security. Those actions, the opinion says, include barring agency contracts with a particular supplier and subcontracts that use the supplier to perform work for the agency.

Before acting, the agency head makes a written determination that using the authority "is necessary to protect national security by reducing supply chain risk" and that "less intrusive measures are not reasonably available". Notice and an opportunity to respond normally come first, but the statute lets the agency head delay notice on an "urgent national security interest". Review runs to the D.C. Circuit on a petition filed within 60 days of notification, and the court reads 41 U.S.C. 1327(a) as barring other judicial review of action taken under section 4713.

The dates, all taken from the opinion: on 3 March 2026 the Secretary determined that use of Claude in Department systems "presents a significant supply chain risk", that no less intrusive measures were reasonably available, and that an urgent national security interest required immediate action. Notice was dated 3 March and emailed on 4 March. On 6 March the Department's Chief Information Officer ordered removal of Anthropic products "as soon as practical," and in any event within 180 days, and the court says that memo "further prohibited contractors from using Anthropic products in their work for the Department." Anthropic petitioned on 9 March. A supplemental notice followed on 19 March, the court denied a stay but expedited the case on 8 April, and the Secretary denied reconsideration on 3 June.

The court read the statute as allowing the determination and the covered procurement actions to happen at the same time, which is how it found its own jurisdiction secure from the 9 March petition.

How did the majority read "supply chain risk"?

Section 4713(k)(6) defines supply chain risk to include the risk that any person may "otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement" of covered articles "so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation" of them. Anthropic argued that the definition carries a requirement of hostility or bad motive. The majority disagreed.

It gave "manipulate" its ordinary meaning and concluded: "at least as applied here, the statutory definition of a "supply chain risk" turns on what Anthropic does, not why Anthropic does it." It added that section 4713 imposes no criminal or civil liability, describing it as "a procurement statute addressed to what goods and services the Department may buy".

The factual footing, as the court tells it, was that Anthropic's model training "does effectively enforce contractual usage restrictions", together with a dispute over whether those restrictions reached a military operation abroad. The opinion also states a limit. Anthropic told the court that once a model is delivered for use on the Department's classified systems, it cannot "access it, alter it, or shut it down", and the Secretary clarified that his determination "did not depend" on Anthropic's "real-time technical access to or control" of Claude after deployment. The majority upheld the exclusion anyway, because, in its words, "Anthropic can and does program Claude's behavior with each new model it delivers to Department contractors". The court was explicit about what it was not deciding: "the point here is not that these model or usage restrictions were arbitrary". Its conclusion was that "the Department reasonably feared that Anthropic might manipulate Claude's design to prevent it from performing national-security functions that the Department deems contractually authorized and necessary."

The court contrasted 10 U.S.C. 3252. It noted that a district court decision, Anthropic PBC v. U.S. Dep't of War, No. 26-cv-01996 (N.D. Cal. Aug. 27, 2026), had set aside a separate designation under section 3252, and said it had "no quarrel" with that court's reading that bad motive is required under section 3252's narrower definition. "But as explained at length above, no such bad motive is required to support a designation under the much broader definition set forth in section 4713." A footnote adds that the Northern District's judgment does not control review of the section 4713 action.

What standard of review did the court apply?

The opinion states the standard in its own terms, and we repeat it rather than characterise it. Under 41 U.S.C. 1327(b)(2), the court holds unlawful covered procurement actions it finds "arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law." On arbitrariness, it said it requires only that agency action be "reasonable and reasonably explained", and that review is "deferential".

Purely legal questions of statutory construction it reviews de novo, but "In construing statutes implicating national security, we resolve ambiguities against intruding on the national-security determinations of the Executive Branch." And "where a factual question turns on assessments of national security, we give the agency more deference, even if constitutional claims are at issue."

That standard shaped the two remaining statutory points. On less intrusive measures: "The Secretary reasonably concluded that less intrusive measures were not reasonably available, and we cannot override that fact-based, national-security assessment." On urgency, the court did not decide whether the Secretary's finding was right. It assumed for argument that the finding was reviewable and wrong, applied a harmless-error rule, and held that "Anthropic has suffered no prejudice" because the post-exclusion process had already run and the Secretary had maintained the exclusion after considering Anthropic's full submission.

What did Judge Henderson's dissent say?

The dissent turns on one phrase. Judge Henderson wrote that whether the Secretary lawfully invoked the statute turns on whether Anthropic falls within its definition of supply chain risk, and that the answer depends on the residual clause "or otherwise manipulate." She concluded: "Because I believe that the context decidedly favors the narrower reading, I respectfully dissent."

Her reading draws on the surrounding words. Applying noscitur a sociis, ejusdem generis and the series-qualifier canon, she read "maliciously" as reaching "extract data" as well as "introduce unwanted function", and read the verbs around "manipulate" as connoting intentionally hostile or clandestine acts. In her view the majority's reading leaves much of the definition's "motive-infused language" as surplusage.

She then described what she saw as the consequence of the majority's reading for suppliers generally: "It matters not if the restrictions are ones the Department has already agreed to. And it is immaterial if the contractor enforces the restrictions based on a good faith and legally correct interpretation of them." Of a future supplier asked to change its AI-use policies, she wrote: "According to today's decision, that contractor will have a choice: Agree to the Secretary's demands or risk being designated a national security threat under FASCSA."

Relying on the 2018 Senate report and pre-enactment agency material, she wrote: "I cannot agree that this is the scenario the Congress had in mind when it enacted FASCSA." That history, in her words, "refutes the view that "manipulat[ion]" of a covered article encompasses anything like the conduct that, under today's holding, gives rise to a supply chain risk", which she described as "a contractor's honest and upfront enforcement of restrictions on a covered article's use disfavored by the government." The majority, for its part, said the dissent's arguments "have some force, but we are ultimately unpersuaded", and declined to use legislative history to fix the ordinary meaning of the definition's verbs.

What does this mean for contracting officers and contractors?

What follows is our interpretation, not the court's. The opinion decides one Department's determination about one supplier, on a deferential standard, and it is a panel decision that could still be the subject of further review we have not checked. It does not exclude Claude from other agencies' procurement and does not purport to.

With that limit stated, three points from the text transfer. First, the majority treated a supplier's ability to enforce usage restrictions through the product itself as within section 4713's definition, without any need to show bad motive, "at least as applied here". Second, the court weighed the agency's choice of section 4713 over conventional contract-termination authorities and did not disturb it, observing that Anthropic "has not explained why it would suffer any less of a stigma" under those other authorities. Third, the court accepted that a section 4713 action can reach subcontracts, and it reports that the Department's implementing memorandum prohibited contractors from using Anthropic products in their work for the Department.

For contractors, on our reading, the practical question is how a model provider's usage policy, model-level restrictions and update cadence map onto the work a customer agency expects to do, and who resolves a dispute about scope. The court called the contested restrictions "hardly self-defining". The opinion does not tell contracting officers how to draft any clause, and we do not either.

What we did not verify

What we opened: the full text of the D.C. Circuit opinion in No. 26-1049 as extracted from the court's PDF (media.cadc.uscourts.gov), including the opinion for the court by Judge Katsas and the dissent by Judge Henderson. Every date, number and quotation on this page comes from that text. Straight quotation marks and apostrophes replace the court's typographic ones; no words were changed.

What we did not open: the appendix and record materials the opinion cites, the Secretary's 3 March 2026 determination, the 6 March 2026 memorandum, the 3 June 2026 reconsideration decision, the briefs and amicus briefs, the April 8 stay order, and the Northern District of California decision in No. 26-cv-01996. Where we describe those documents, we describe them only as the opinion does. We did not check the docket for any petition for rehearing or rehearing en banc, any mandate, or any petition for certiorari, and we did not confirm whether the opinion is designated for publication.

What we refuse to claim: we do not say the decision bars Claude across the federal government; it concerns one Department's determination. We do not say the court found Claude unsafe, defective or unreliable, or that it ruled on the merits of Anthropic's usage restrictions; the court said its point was "not that these model or usage restrictions were arbitrary". Every national-security conclusion on this page is attributed to the Secretary or to the court reviewing his determination under the statute. We do not characterise Anthropic, Claude or the Department beyond the opinion's own words, and we make no claim about how often section 4713 has been used.

One drafting point in the source: the dissent's text cites the definition as 10 U.S.C. 4713(k)(6) and in places as sections 4173 and 4716, while the majority cites 41 U.S.C. 4713(k)(6). We follow the majority's citation and have not checked whether a corrected version has been issued.

Disclosure: this page was drafted with the assistance of an AI model developed by Anthropic, a party to this case. For that reason it quotes the court's holding and the dissent verbatim, attributes every conclusion, and adds no assessment of the merits.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• GSA GSAR LLM data safeguarding clause for federal contractors
• OMB gates federal LLM buys on AI neutrality rules
• Court of Federal Claims upholds NGA SEQUOIA AI data-labeling award
• North America AI regulation
• AI Regulation News hub