The D.C. Circuit denied Anthropic’s petitions for review 2-1 on September 25, 2026 โ not because Claude was dangerous, but because a product that can refuse was treated as a supply-chain reliability problem.
Editorial notice: This article reports the ruling as decided. The vote was 2-1 โ Judge Katsas wrote for the court, joined by Judge Rao; Judge Henderson dissented. No next procedural step is established. No position is taken on the merits of the ruling, the Department’s decision, or Anthropic’s policy. This is not legal advice.
The D.C. Circuit’s opinion in Anthropic PBC v. United States Department of War, Nos. 26-1049 and 26-1162, argued May 19, 2026 and decided September 25, 2026, opens with a fact that most coverage has not foregrounded: the Department of War excluded Claude from its supply chain under the Federal Acquisition Supply Chain Security Act of 2018 “after Anthropic refused to relax contractual prohibitions on the use of Claude for lethal autonomous warfare or domestic surveillance.” The disposition is flat: “Accordingly, we deny the petitions for review. So ordered.” The logic behind it is more precise than that sentence suggests.
The majority, written by Circuit Judge Katsas and joined by Circuit Judge Rao, accepted the Department’s account of why the exclusion occurred. As the opinion states directly: “As Anthropic admits, the company encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent. On more than one occasion, these restrictions have stopped Claude from performing tasks requested by government users. And recently, a dispute arose over whether the contractual prohibitions barred the use of Claude in an ongoing overseas military operation, leaving the Department uncertain whether Claude would perform as needed and intended.” That passage โ resting on Anthropic’s own admission โ is the functional core of the majority’s supply-chain-risk determination.
Anthropic brought four challenges in all. It argued the exclusion was arbitrary and capricious, and that it exceeded the Department’s authority under the governing statute. The court rejected both, holding that the Department had ample support for its conclusion that continued integration of Claude into its information systems presented a statutorily covered national-security risk, and that the Secretary did not transgress any limit on his authority. Anthropic raised two additional constitutional claims. The First Amendment claim failed because, in the court’s words, “the Department excluded Anthropic from its supply chain based on the company’s refusal to assent to a contract term that the Department deemed essential, not based on the company’s support for greater governmental regulation of AI technology.” The due-process claim failed on procedural grounds: the Department had notified Anthropic of the exclusion and its rationale promptly and provided a fair opportunity to contest. Circuit Judge Henderson dissented โ her disagreement centers on whether Anthropic’s situation falls within the statute’s own definition of “supply chain risk” at all, which is a textual question entirely separable from whether the Department’s concern was operationally reasonable.
The key insight: The same property โ an encoded usage restriction โ reads as an ethics commitment in a product document and as delivery uncertainty in a procurement file. The court relied on Anthropic’s own admission that both readings describe the same fact. That is the structural novelty of this ruling, and it has nothing to do with whether the underlying policy is right.
The company lost on the statute, on the record, on process and on speech.
The Structural Read
The Permission Layer framework โ one of the core lenses in the Business Engineer Map of AI โ describes government and regulatory authority as the layer that controls which AI products actually ship into sensitive contexts. Most applications of that framework assume the permission question runs in one direction: a vendor seeks access, and the state grants or denies it.
This case inverts that assumption. Anthropic held the restriction. The buyer โ in this instance, a federal department operating under a supply-chain security statute โ could not simply override it contractually. When the constraint could not be removed, the instrument that remained was exit: the Department stopped being a customer. That exit, executed under section 4713 of the Federal Acquisition Supply Chain Security Act of 2018, did regulatory work without any rulemaking. It changed what Anthropic’s restriction costs commercially, without changing what Anthropic is permitted to encode.
That is a genuinely new category in AI procurement law โ not a new application of sabotage or defect doctrine, but a case in which a vendor’s policy architecture, compiled into the product and traveling with it, became the subject of the statutory inquiry. Supply-chain security law was built to ask: will this component perform when required? Asked of a network switch, that is a question about hardware integrity. Asked of a model with encoded refusals, it becomes a question about whose policy governs at runtime.
Permission Layer โ Inverted
The vendor held the permission; the buyer held the exit
In the standard Permission Layer model, the platform or state holds access and the agent requests it. Here the vendor held the restriction, and no contract term could remove it. Exit by a buyer of sufficient scale does regulatory work without any formal rulemaking โ it reprices the vendor’s constraint without touching the vendor’s legal right to encode it. That asymmetry is what the statute, applied this way, made visible.
Henderson’s dissent operates on a different axis. She would ask whether Anthropic meets the statute’s own textual definition of a “supply chain risk” before reaching any question of the Department’s operational judgment. That is not a disagreement about what happened; it is a disagreement about whether the words Congress chose cover what happened. A panel can agree entirely on the facts and split on that โ which is roughly what occurred here, in a 2-1 vote.
Three Implications
IMPLICATION 1 โ PROCUREMENT DOCUMENTS NOW READ PRODUCT ARCHITECTURE
A usage restriction that an AI vendor encodes for ethical reasons becomes a performance specification in a federal procurement file. The court drew no distinction between the two readings โ it relied on Anthropic’s own admission that the restriction exists and operates. Any AI vendor selling into government contexts now has a documented example of how encoded constraints interact with supply-chain security statutes.
IMPLICATION 2 โ THE FIRST AMENDMENT LINE IS NOW DRAWN IN PROCUREMENT LAW
The majority separated speech about a policy from refusal to contract on a term โ two acts that can express the same conviction, with procurement law reaching the second and not the first. That is a line that did not exist as a D.C. Circuit holding before September 25, 2026. Whether it is a persuasive line is a separate question; that it is now a holding is the fact.
IMPLICATION 3 โ HENDERSON’S DISSENT KEEPS THE STATUTORY DEFINITION OPEN
The 2-1 split means the definitional question Henderson raises โ whether a vendor whose product has encoded refusals actually meets the statutory definition of a supply-chain risk โ was not resolved unanimously. That question, which turns on the words Congress chose in the Federal Acquisition Supply Chain Security Act of 2018, remains live as a matter of legal argument even though Anthropic lost this case on this record.
Business Engineer Framework
The Permission Layer โ Where Government Controls What Ships
The Permission Layer is one of nine layers in the Business Engineer Map of AI. It maps how government authority, procurement law, and regulatory action determine which AI products reach which contexts โ and what happens when that authority intersects with vendor-encoded constraints rather than state-imposed ones. The Anthropic ruling is the first D.C. Circuit case to test the layer from the inside out.
A product that can refuse is now on record as a supply-chain reliability question under federal statute โ not by analogy, but by holding, 2-1, in the D.C. Circuit. The structural novelty is not the outcome but the category: the same encoded restriction that functions as a safety commitment in one document functions as delivery uncertainty in another, and a supply-chain security statute resolves the conflict not by deciding which reading is correct, but by letting the buyer exit. That is how procurement law does regulatory work without rulemaking. Whether the same reasoning reaches any other vendor or any other product is not something this ruling decides, and nothing here forecasts it.
The court denied Anthropic’s petitions for review. The decision was 2–1, with Circuit Judge Henderson dissenting. Quotations above are taken from the slip opinion. This is analysis of a procurement and administrative-law outcome. It is not legal advice.No position is taken here on whether the ruling, the Department of War or Anthropic’s usage policy is right, and nothing above comments on the underlying questions of lethal autonomous weapons or surveillance policy or attributes a motive to any judge. No next procedural step is established — nothing above states whether any party will seek further review, and nothing above predicts an outcome. Comment from Anthropic, the Department of War or the White House, the status of any other litigation, contract values, revenue effects, the agencies involved, any consequence for a public offering, and the identity of the overseas military operation referred to in the opinion are not established and do not appear above.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur, HackerNoon and Search Engine People. Find him on LinkedIn and Substack. See how we source.
Scroll to Top
Discover more from FourWeekMBA
Subscribe now to keep reading and get access to the full archive.
