Supply chain risk designation upheld: Anthropic’s loss in the D.C. Circuit

Anthropic has had mixed results in challenging its designation as a supply chain risk by the U.S. government. It defeated one such designation in a California court, but a court in Washington, D.C., just ruled against it on another. Unfortunately for Anthropic, the AI industry, and the end users of AI tools based on Anthropic models, the government only had to win once to create risks for all involved. Anthropic has challenged this latest adverse ruling, but unless and until Anthropic prevails, contractors and subcontractors for the U.S. federal government that rely on Anthropic models are exposed to legal risk and operational disruption. 

Background

In March, the federal government declared Anthropic a supply chain risk under two different statutory regimes because Anthropic insisted on maintaining certain limited contractual guardrails on the use of its models by the government and spoke out publicly about its concerns. This designation meant that the government could prohibit government contractors, subcontractors and other vendors and affiliates from using Anthropic products. 

Anthropic immediately challenged these designations in two separate proceedings, one in a California federal district court and the other in the D.C. Circuit, a federal appellate court in Washington, D.C. See our prior coverage of the dispute here. 

In August, the California court ruled for Anthropic, finding the designation under 10 U.S.C. § 3252 not only was invalid under the statute but was an unconstitutional effort to retaliate against Anthropic for exercising its right to speak out publicly about public policy related to the use of AI. This was a clear win for Anthropic and the AI industry as well as for businesses that rely on Anthropic to service federal contracts and subcontracts.

DC Circuit’s decision

At the end of September, the D.C. Circuit, in a two-to-one split decision, affirmed Secretary of War Pete Hegseth’s designation of Anthropic as a supply chain risk under the Federal Acquisition Supply Chain Security Act (FASCSA). 

Anthropic challenged factual findings made by Secretary Hegseth. It disputed his finding that it was a supply chain risk and argued that designation under FASCSA required a finding of maliciousness by Anthropic, which the secretary did not make. Anthropic also questioned his finding that an immediate supply chain risk designation was the only reasonably available option. Finally, Anthropic argued that Secretary Hegseth’s decision violated its free speech and due process protections under the U.S. Constitution. The D.C. Circuit rejected each of those challenges. 

The D.C. Circuit upheld Secretary Hegseth’s findings that Anthropic posed a national security risk because, according to the government, its software was “subject to manipulation” by Anthropic. Although the government abandoned the claim that Anthropic could manipulate ClaudeGov after it was deployed, the D.C. Circuit found it sufficient that Anthropic trained the model and could in theory push updates to the software, all of which the court used to find that Anthropic could influence the model. It also cited instances where supposedly the model had refused to perform tasks requested by the government, notwithstanding the fact that those issues were later resolved by Anthropic. And the court found it significant that Anthropic had expressed concerns about the government’s “AI-first” strategic claim, as if the disagreement itself created a national security risk.

The court also rejected the argument that a supply chain risk designation under FASCSA requires the secretary to find Anthropic acted maliciously. Anthropic noted that FASCSA refers to the risk that a person “may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate” the software. Thus, it argued, for the secretary to find Anthropic could “manipulate” the software, he also had to find malicious intent by Anthropic, which he did not do. The D.C. Circuit disagreed with this construction of the statute, holding that FASCSA did not require any finding of maliciousness for a supply chain risk designation. It also distinguished the California court’s ruling, noting that the statute in that case used different language than FASCSA. 

The D.C. Circuit also quickly dismissed Anthropic’s arguments that the secretary was wrong to find that the immediate supply chain risk designation was the only reasonably available option. It also rejected the argument that Anthropic was prejudiced by being denied a meaningful opportunity to respond to the designation, emphasizing that Anthropic actually did get to respond even though its answers did not change the secretary’s findings.

Anthropic’s constitutional arguments fared no better. The D.C. Circuit excused the lack of process by citing the need for urgency in the national security context, pointing to the fact that the Iran War began within days after this dispute arose. The D.C. Circuit found it unpersuasive that the government continued to use ClaudeGov and continued to work with Anthropic after this designation, arguing (seemingly counterfactually) that the government’s work with Anthropic was limited. 

The court also rejected Anthropic’s free-speech arguments. It agreed that Anthropic had engaged in protected speech and it faced materially adverse action. But it concluded that there was “no causal connection” between Anthropic’s public concern about AI use and its supply chain risk designation, arguing that the secretary’s actions were in response to contract negotiations failing, not Anthropic’s speech. This is inconsistent with the findings of the California district court that the designation was retaliation against Anthropic for speaking out in a way the government did not like. 

What’s next?

Anthropic has filed a petition for rehearing by the full D.C. Circuit, reraising every one of its arguments. Typically, a petition for rehearing is a long shot. But in this case, given the novelty and significance of the issues for the AI industry, government contractors and free speech, as well as the presence of a dissenting opinion and a conflict with the California court, a different outcome on a full rehearing may be more likely.

In the meantime, while this decision stands, it poses a real risk for contractors and subcontractors to the U.S. federal government. For contracts and subcontracts that incorporate the FASCSA restrictions from FAR 52.204-29 and -30, the contractor and subcontractor may face obligations to identify where Anthropic products are used for government work (directly or indirectly), report on its use to the government, and potentially cease use of those products if directed to do so by the Department of War on work performed “as part of the performance of the contract” for the government. Whether that extends to administrative business functions outside of the specific work for the government will be a case-by-case assessment.

Beyond Anthropic, the D.C. Circuit decision opens the door to more aggressive moves by the government with disfavored contractors. For example, if the mere ability to “manipulate” a tool, product or service before or after deployment constitutes a supply chain risk, that opens a can of worms. If a logistics contractor refuses to deploy its employees to a war zone without sufficient protection, is it a supply chain risk? What if a cloud service provider says it will shut down access to a service if the government doesn’t pay the bills? These are open issues that reach far beyond whether an AI company can place technical or contractual guardrails on its models. That’s not to mention the risk that merely criticizing the government might be enough to render a company a supply chain risk under this decision. 

Navigating these complex decisions in a way that protects contractors and subcontractors requires caution and counsel. But in the meantime, businesses that perform work for the U.S. government, directly or indirectly, inside or outside the U.S., should make sure they are aware of how Anthropic fits into their work, carefully review contracts for FASCSA-related requirements, and centralize interactions with the government on this topic as much as possible to employees who are fully cognizant of these challenging developments in U.S. public contracting.