DC Circuit Upholds Pentagon's Anthropic Designation 2-1── Because a vendor's contractual limits can be overridden by procurement, the buyer must hold its own alternatives and its own record of why it chose that vendor

On 25 September 2026 the US Court of Appeals for the DC Circuit upheld, by two votes to one, the Defense Department's designation of the AI developer Anthropic as a supply-chain security risk. How far do a vendor's own contractual limits survive the buyer's procurement judgement? They do not override it. The court treated those limits themselves as a reason to doubt reliability, and the duty to verify fell back on the organisations that had been relying on them.

01A procurement decision can strip an AI vendor's safeguards of effect

The appeals court settled one point: a buyer may treat the usage limits an AI vendor writes into its contracts as evidence of unreliability. Judge Katsas wrote for the majority and Judge Rao joined him. Judge Henderson dissented.

The designation itself held that continued integration of Claude into the department's information systems amounted to a national-security risk of the kind the statute covers. The ruling found ample support for that conclusion. The risk identified was neither capability nor accuracy. It was the set of restrictions the vendor had imposed on itself.

Any organisation built on a vendor's safeguards now has reason to re-read those safeguards. Limits a vendor wrote for itself can become, in a buyer's hands, the ground for cutting supply off. Here that happened in Defense Department procurement. Leave the operation of those limits with the vendor, and what remains on the day supply stops is not yours to decide.

0241 U.S.C. §4713 was drafted against hostile states

The limits were read as unreliability. So where did the power to convert that reading into exclusion come from? The statute is 41 U.S.C. §4713, which gives the head of an executive agency authority to exclude a supplier on supply-chain risk grounds. Exclusion is decided by the head of the buying organisation, not by a court.

Judge Henderson's dissent went to the statute's reach. Section 4713 was drafted for cases where a hostile state or a bad actor works its way into a supply chain, she argued, not for a contractor that candidly honours its own stated limits. The statutory language is broad. On the dissent's reading, that broad language reached a party nobody had in mind when it was written.

The dissent did not change the outcome. The point about reach remains. If the same authority carries the same breadth, then the set of suppliers that can be excluded is wider than the drafters assumed.

03In medicines manufacture the duty to assess suppliers sits with the buyer

Under §4713 the government is the party that removes a supplier. In medicines manufacture the roles are reversed: the regulated party assesses the suppliers it uses.

EU GMP Annex 11 requires a formal agreement setting out responsibilities whenever a third party is used. It states that a supplier's capability and reliability are central to selection, and that the need for an audit follows from a risk assessment. An organisation that builds generative AI into a computerised system used in medicines manufacture does not step outside that assessing role.

Annex 11 is guidance for computerised systems in medicines manufacture, and it does not govern the material review process itself. What the comparison shows is narrow: which side of the transaction carries the duty to assess.

04The vendor that states its limits up front loses ground in procurement

Grant that the buyer assesses. What happens once that assessment is conducted in the language of reliability? This negotiation answers the question. The department demanded access for all lawful purposes. The company asked for an assurance that its model would not be used for fully autonomous lethal weapons or for domestic mass surveillance. Neither side gave way.

The majority placed that unresolved dispute alongside Claude's built-in restrictions and concluded that the combination could make the system unreliable for military operations. The party that disclosed its limits first was penalised for the disclosure.

That direction of travel cuts against the vendor's own interest. A provider that writes out its permitted uses and publishes them lets buyers read how far they extend. The more specific those limits, the more confidently a buyer can find the point at which the product stops. A provider that publishes nothing hands over no such material. So long as procurement uses reliability in this sense, the provider that states no limits is the one that gets through. The content of the negotiation here comes from press reporting, not from the litigation record.

05Another federal court has held a parallel designation unlawful

Disclosure counted against the vendor. Yet this is not the only ruling in this area. In August a federal district court in San Francisco held a parallel government designation unlawful. Read together with a two-to-one split on appeal, the lawfulness of related designations varies by court and by level. The case name and whether that August ruling is final were not verified here.

What a buyer can count is not the number of rulings. It is the set of things that can be moved on the day supply stops.

Of the three, the record is the one that cannot be produced later. Reasons written after supply stops are reasons written by someone who already knows it stopped; they do not reconstruct the earlier judgement. The same holds for the alternative. An untested alternative is an alternative first tested on the day everything is already down.

06Procurement, legislation and records each shift responsibility

One court has held a parallel designation unlawful while another upholds this one. Where responsibility sits is not yet settled. The movement runs along three lines.

The first is procurement. A design that leaves AI safeguards in the vendor's hands collapses at the buyer's decision. Here it was not a technical failure that caused the collapse but a single administrative judgement. Redesigning therefore starts with whose hands hold the safeguards, not with how strong they are.

The second is what legislation actually rewards. If disclosing limits costs a vendor in procurement, disclosure will thin out. Judge Henderson noted that §4713 was not written with candid contractors in mind. Leave a broad authority pointed at parties it was never aimed at, and the rational vendor response becomes silence.

The third is the route by which outsiders verify anything. The courts disagree. Meanwhile at least six senators have co-sponsored a bill to protect employees of AI companies who report legal violations or safety failures. Alongside the courts, that bill would set up reporting from inside as a second route.

07Internal reporting is becoming the main route for outside verification

Of those three lines, the one whose shape is still to be settled is the bill protecting employees who report. The bill has co-sponsors. One of them said that innovation and accountability have to go hand in hand, and that employees should be able to raise concerns without risking their careers or being silenced by a non-disclosure agreement.

If it passes, one more route for outside verification exists. The timing of any vote is not set. Whether reports would reach anyone beyond the company has not been written down either. What is established is that co-sponsors have signed on.

What the courts have settled is also narrow. One ruling holds that a buyer may treat a vendor's own limits as a reliability problem. Nothing states that other buyers will do the same. Whether the company appeals is undecided. Narrow as it is, an organisation whose internal documents cite a vendor's limits as the basis for safety now has that sentence to re-read, and cannot itself decide when it stops holding.

Meanwhile the working days of organisations that have put AI into their processes carry on. What they can hold is the list of dependencies, the alternative they have already run once, and the record of why they chose. None of the three waits on a judgment.

An AI vendor's contractual limits do not override the buyer's procurement judgement. The mere fact that the limits were still in place became material for exclusion.

So the buyer's work does not end with reading the vendor's safeguards. It ends with holding, in-house, the list of dependencies, the alternative already tested, and the record of the selection. The tested alternative and the record can only be made before supply stops.