The ruling upholds the Defense Department’s designation, allowing the DoD to remove Claude from its systems and prohibit contractors from using Anthropic products on Defense Department work.

The U.S. Court of Appeals for the D.C. Circuit upheld the Department of Defense’s designation of Anthropic as a supply chain risk under the Federal Acquisition Supply Chain Security Act of 2018. The Department of Defense (DoD) designated Anthropic after the company refused to lift its contractual bans on using Claude for fully autonomous lethal weapons or mass surveillance of Americans. The DoD wanted permission to use Claude for any lawful purpose. Anthropic continued to allow other military uses.

The decision followed Anthropic’s August court win in a separate case. That ruling blocked broader orders telling federal agencies to stop using Anthropic products and defense contractors to stop all business with the company, including work unrelated to the military.

Why the court found a supply chain risk

The appeals court agreed with the DoD that Claude could refuse a military task the department considered lawful. Anthropic sets restrictions in Claude before delivery, and earlier versions had refused government requests, including questions from the Centers for Disease Control and Prevention about infectious disease research. Anthropic said those refusals involved commercial versions and were resolved with government users.

An Anthropic executive questioned a contractor’s use of Claude in an overseas military operation. The DoD said Anthropic’s contract allowed that use, but the exchange made the department and contractor worry that Claude might stop working during a mission. The court did not find that Anthropic stopped Claude or that the operation failed.

Anthropic said it cannot access, change, or shut down a version of Claude after a contractor installs it on the DoD’s classified systems. The appeals court accepted that point. Its concern was that Anthropic can set the behavior of each new version before delivery, and that advance tests might not reveal every situation in which Claude would refuse a task. The majority agreed that the DoD could remove Claude from all its systems. They said checking each contractor’s use of Claude separately would cause delays and still leave the department unsure whether the model would perform when needed.

How this differs from Anthropic’s August win

In August, the U.S. District Court for the Northern District of California ruled for Anthropic under a supply chain risk provision of the 2011 National Defense Authorization Act.

The court found that Anthropic’s insistence on contract limits did not make it an adversary trying to sabotage military technology. The court also found that the federal government punished Anthropic for publicly criticizing its demands and imposed the broader restrictions without first giving Anthropic notice and a chance to respond.

In September, the U.S. Court of Appeals for the D.C. Circuit reviewed the DoD’s separate designation under the Federal Acquisition Supply Chain Security Act of 2018.

The 2018 law defines supply chain risk more broadly. Unlike the 2011 law, it does not require the DoD to show that Anthropic intended to sabotage a military system. The D.C. Circuit said the California court’s conclusion under the narrower law still stood. It reviewed the DoD’s separate purchasing action, rather than an appeal of the California ruling.

Anthropic argued that the DoD excluded Claude because the company publicly advocated limits on military uses of AI. The appeals court rejected that claim, finding that the DoD acted because Anthropic refused to accept an “all lawful uses” contract term.

The D.C. Circuit also held that Anthropic had a fair opportunity to challenge the decision after receiving notice, and that earlier notice would not have changed the outcome.

What the ruling allows

The upheld supply chain risk designation permits the DoD to exclude Claude from its systems. A March memorandum ordered the removal of Anthropic products within 180 days and prohibited contractors from using them for Defense Department work. The appeals court’s decision does not authorize a ban on those contractors doing unrelated commercial business with Anthropic, and it does not itself set aside the separate California judgment.

Judge Karen LeCraft Henderson dissented. She said the purchasing law, read as a whole, addresses suppliers that deliberately interfere with government systems. In her view, Anthropic’s openly stated limits on Claude did not meet that standard. The appeals court denied Anthropic’s petitions for review; the California judgment remains a separate court order.