The D.C. Circuit upheld the Pentagon’s exclusion of Claude on September 25, 2026 — not because the model was compromised, but because its refusal behavior worked exactly as designed. Nothing in this article is legal advice.
This article is not legal advice. The decision was 2–1 with a substantive dissent. An earlier version of this piece described a Northern District of California ruling as an opposite conclusion on the same question; that was wrong, and the passage has been corrected below. This piece now quotes the opinion itself.
On September 25, 2026, the D.C. Circuit denied Anthropic’s petitions for review in Anthropic PBC v. United States Department of War, No. 26-1049, upholding the Department’s classification of Anthropic’s products as a supply-chain risk under the Federal Acquisition Supply Chain Security Act of 2018 — reported as Section 4713. Judge Gregory Katsas wrote the majority opinion, joined by Judge Neomi Rao. Judge Karen LeCraft Henderson dissented. The Pentagon prevailed in this court. Holdings and quotations below are taken from the opinion itself (51 pages; argued 19 May 2026, decided 25 September 2026; Nos. 26-1049, consolidated with 26-1162).
The majority held that the Department had adequate support for its national-security conclusion, that less intrusive measures were not reasonably available, that procedural deficiencies in notice did not prejudice the company, and that the exclusion violated neither the Fifth nor the First Amendment. As reported, Judge Katsas wrote: “The Department had ample support for its conclusion that the continued integration of Claude…presented a statutorily covered national-security risk.” The evidence cited was not a breach, a backdoor, or foreign interference. It was that Claude’s encoded restrictions had, on more than one occasion, stopped tasks requested by government users.
A Northern District of California decision of 27 August 2026 did set aside a designation of Anthropic as a supply chain risk — but under 10 U.S.C. § 3252, a different provision whose definition is, in the majority’s words, “much narrower” than the one at issue here. The D.C. Circuit was explicit that the two are not in conflict: it had “no quarrel” with the Northern District’s conclusion that bad motive is required under section 3252, and “no quarrel” with its conclusion that Anthropic has acted with no such bad motive — holding only that no bad motive is required under section 4713’s broader definition. What remains genuinely open is the dissent’s statutory reading, and rehearing en banc or Supreme Court review, both discretionary. Anthropic responded: “We respectfully disagree with the court’s decision…We remain confident in our position.”
The key insight: The majority made no finding of malice, foreign control, compromise, or sabotage. What it identified was a capability — a working, deliberate, documented product decision that stopped government-requested tasks exactly as it was designed to. The safety feature is the finding.
What the court did not find is the part worth holding onto: no malice, no foreign control, no compromise.
The Structural Read
The standard commercial logic about AI safety controls runs like this: document them, enforce them, make them visible to customers, and you are the defensible choice. The D.C. Circuit’s majority applied a different frame entirely. Under FASCSA, the question is not whether a control is disclosed or deliberate — it is whether it constitutes a supply-chain risk to the acquiring entity. A procurement statute has no vocabulary for the difference between a control that protects and a control that obstructs. The same refusal behavior an enterprise buyer treats as the reason to choose one vendor over another is, to a buyer who needs the task completed, an availability failure with a corporate cause rather than a technical one.
That is an observation about the category, not a claim that the court decided wrongly. The legal version of that argument belongs to Judge Henderson’s dissent, which is substantive and worth stating precisely.
Judge Karen LeCraft Henderson — Dissent
“I cannot agree that this is the scenario the Congress had in mind when it enacted FASCSA”
Judge Henderson argued the statute was “explicitly passed to protect against sabotage by malignant foreign powers” — not against safety guardrails built by American companies. The dissent is a structural statutory argument, and it is alive in the courts.
There is an asymmetry embedded in the majority’s reasoning that is worth stating carefully. The evidence cited against Anthropic was that its restrictions had actually fired — that they had stopped requested tasks on more than one occasion. Which means, structurally, that the more enforceable a usage policy is, the stronger the evidentiary record for a finding against it under this frame. A policy that exists on paper and never fires generates no incidents to cite. A policy encoded in the model and observed stopping requests generates precisely the record described here. That relationship between enforceability and evidentiary record cuts against the ordinary assumption that documented, working controls are the commercially safe choice — at least in procurement contexts governed by supply-chain security statutes.
When a safety property is read through a statutory frame it was not designed for, the builder’s intent is not the operative input. The frame with legal authority sets the meaning. Anthropic built a control; FASCSA classified it as a risk. Both statements can be simultaneously true — that is the structural tension this ruling exposes, and it applies to any AI vendor selling into procurement environments governed by supply-chain security law.
Three Implications
IMPLICATION 1 — THE ENFORCEABILITY PARADOX
The very property that makes a refusal policy credible to commercial buyers — that it actually fires — is the property that generates an evidentiary record under a supply-chain security review. AI vendors designing usage controls now face a structural tension: enforceability is simultaneously a product asset and a procurement liability in certain regulated contexts. Nothing here predicts how any vendor will respond to that tension; that would require evidence that has not been published.
IMPLICATION 2 — THE LEGAL QUESTION IS GENUINELY OPEN
The two decisions construe different statutes and are not in conflict — the majority said so directly. What is open is the meaning of section 4713(k)(6)’s residual clause, “or otherwise manipulate”, on which the whole case turns. The dissent in the D.C. panel is substantive — a statutory interpretation argument about congressional intent that courts of higher authority may find compelling. Rehearing en banc and Supreme Court review remain available, though both are discretionary. Anyone reading the D.C. Circuit ruling as the final word on FASCSA’s reach should also read Judge Henderson’s dissent and Judge Lin’s ruling.
IMPLICATION 3 — THE PROCUREMENT FRAME IS THE COMPETITIVE FRAME
For any AI company selling into U.S. government procurement, the relevant competitive dimension is no longer purely capability or price — it is how the model’s behavioral properties map onto the vocabulary of supply-chain security law. A disclosed, deliberate, working control is not inherently safe from classification as a risk. That is a productdesign and go-to-market question, not only a legal one, and it applies to the category regardless of how this specific case resolves.
Business Engineer Framework
The Permission Layer: Government Controls Which AI Ships
The Permission Layer framework maps the regulatory and procurement constraints that determine which AI products can reach which buyers — independent of capability. The Anthropic ruling is a live case study in how that layer operates: the model’s behavior is not evaluated on its own terms, but through the statutory frame the acquiring authority applies. Understanding where that layer sits in the AI stack is now a first-order businessdesign question for any vendor with government ambitions.
The D.C. Circuit did not find that Anthropic was hostile, foreign-influenced, or compromised — it found that Claude’s refusal behavior, built deliberately, disclosed transparently, and functioning exactly as designed, constituted a supply-chain risk under federal law. Whether that interpretation is what the Congress intended is the live question, and it turns on a single residual clause. That disagreement is not a footnote; it is the live legal question. The structural fact the ruling surfaces sits underneath that question rather than waiting on it: in procurement environments governed by supply-chain security statutes, a working safety control and a disqualifying product characteristic are not mutually exclusive categories — and the builder does not get to decide which frame applies. Nothing in this article is legal advice.
Nothing above is legal advice.The decision was 2–1, and Judge Henderson’s dissent is substantive.A Northern District of California decision of 27 August 2026 set aside a designation under the narrower 10 U.S.C. § 3252; the D.C. Circuit held that provision distinct and had “no quarrel” with it, so the two rulings are not in conflict. Rehearing en banc and Supreme Court review are both discretionary and remain available, and nothing above forecasts whether either happens or how it would come out. Holdings and quotations above are taken from the opinion itself (51 pages; argued 19 May 2026, decided 25 September 2026; Nos. 26-1049, consolidated with 26-1162). Correction: an earlier version of this piece said a Northern District of California ruling had reached the opposite conclusion on the same determination, leaving the question unsettled between two courts. That was wrong. That decision construed 10 U.S.C. § 3252, a narrower provision requiring bad motive, and the D.C. Circuit expressly had “no quarrel” with it or with its finding that Anthropic acted without bad motive.The court made no finding of malice, foreign control, compromise or sabotage, and nothing above suggests otherwise. Contract values and dollar figures, the number of affected users or programmes, which specific tasks were refused, the date of the original determination, any stated intention to appeal, and comparisons to determinations against other vendors are not established and do not appear. Nothing above predicts further review, the California case, or any company’s behaviour.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
