A usage policy is now a procurement liability

I.The court ruled on the merits, and the merits went to the Pentagon

On 25 September 2026 the U.S. Court of Appeals for the D.C. Circuit decided Anthropic PBC v. Department of War, No. 26-1049, on a petition for review. It denied the petition and held the exclusion of Claude lawful under the Federal Acquisition Supply Chain Security Act, 41 U.S.C. § 4713. That is a merits ruling. The interim step came earlier: the same court had refused to pause the designation in April, according to Herbert Smith Freehills Kramer. Reports describing the court as merely declining to block the label understate what it did.

Judges Gregory Katsas and Neomi Rao formed the majority; Judge Karen LeCraft Henderson dissented, ABC News reported. The exclusion lets the Defense Department remove Claude from its systems, with 180 days as the outer bound, and bars contractors from using Anthropic products on Department work. The opinion addresses the Department only. It says nothing about civilian agencies, and contract lawyers read it as leaving them outside its scope.

The dispute began in February, when Anthropic refused to drop two limits on Claude: no fully autonomous lethal weapons and no mass domestic surveillance. President Trump then directed every federal agency to stop using Anthropic's technology. Anthropic sued in two courts. It won one and lost the other, under two different statutes.

II.Acceptable-use terms became a procurement variable

The core of the ruling is one word. Section 4713 defines supply-chain risk as the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate a covered system so as to deny or disrupt its function. The majority read manipulate in its ordinary sense and held that Anthropic's model training and contractual restrictions qualify, with no bad motive required. As one analysis of the opinion summarised it, the case turns on what Anthropic does, not why.

In California the result went the other way. Judge Rita Lin of the Northern District ruled in August that the parallel designation under 10 U.S.C. § 3252 was unlawful, finding First Amendment retaliation and a due-process failure. Section 3252 speaks of an adversary; section 4713 of any person. That difference lets both outcomes stand.

Meanwhile the competitive field reorganised. OpenAI, Google and xAI agreed to all-lawful-use terms. Google extended classified-network access in April with language against surveillance and autonomous weapons that may not be binding. The four labs had each received Pentagon awards worth up to $200 million in July 2025. Three now hold their place; one is excluded.

III.The honest read: narrower than the headlines, sharper than the facts

The skeptic case is strong. The majority did not rule that safety restrictions are illegitimate. On the First Amendment claim it found that the Department acted because Anthropic refused a contract term the Department deemed essential, not because of Anthropic's advocacy. Even Judge Lin, ruling for Anthropic, wrote that the Department is free to choose its AI vendor. On this reading the case is about a customer's right to walk away, plus a statute that lets it do so loudly.

The skeptic case also cuts against the idea that safety carried a heavy price. In April the D.C. Circuit noted record evidence that Anthropic had financially benefited from its refusal. Anthropic's run rate reportedly reached $65 billion by August, seven times its end-2025 level, after the blacklist took effect.

Now the other side. Henderson's dissent argued that the verbs around manipulate all describe hostile, covert acts, and that Congress wrote the 2018 law against foreign infiltration. On her reading, honest and upfront enforcement of restrictions the Department itself once accepted is not a supply-chain risk. The Computer & Communications Industry Association warned on 2 October that the majority's reading lets agencies use exclusion as leverage over ordinary licensing terms.

Both things are true at once. The ruling's reach is limited to one department. Its reasoning is not limited at all: nearly every frontier model ships with usage restrictions, and the majority's test does not ask why they exist.

IV.The direct cost is small; the contractor channel is not

Revenue. In March declarations, Anthropic's head of public sector said more than $150 million in expected recurring revenue tied to the Department was at risk, against a public-sector book projected above half a billion dollars for 2026. Set against the reported $65 billion run rate, the defence line is roughly 0.2% of revenue. That is our arithmetic on figures from different months, and it is an order-of-magnitude estimate only.

Market structure. The larger channel is indirect. The same declarations described a partner moving a deployment worth more than $100 million to a rival, about $180 million of disrupted negotiations with financial institutions, and a contract cut from $10 million to $5 million. Contractors that serve the Pentagon must now certify they keep Claude out of Department work, typically through FAR 52.204-30 clauses and contract modifications. Where one firm serves both defence and commercial clients, the cheapest compliance answer is often a single approved vendor. That shifts share toward labs on all-lawful-use terms, not by price or quality but by eligibility.

Prices and compliance cost. Contract counsel flag an unresolved question: whether back-office tools or third-party software with Claude embedded fall within contract performance. Until that is settled, contractors are advised to appoint a single point of contact for Anthropic certifications. Ambiguity is a tax, and it falls on every mid-sized integrator, not on the labs.

Capital and labour. Investors appear to have absorbed the exclusion; the revenue trajectory reported since March shows no visible dent. Labour effects are negligible in the near term. The effect worth watching is on terms: vendors with defence ambitions now have a documented reason to keep acceptable-use policies loose or to offer a separate government tier.

V.Second-order: every acceptable-use policy just acquired a defence reading

The first spillover is to other vendors. Under the majority's test, the question is whether a supplier can deny or disrupt functions the Department considers authorised. Model providers, open-weight licensors with use restrictions, and software firms with export or human-rights carve-outs all fit that description in principle. Whether the government uses the power again is a policy choice; the court has confirmed it exists.

The second is to non-US firms in defence supply chains. A European startup that embeds a model in tools sold to a US prime now inherits the prime's certification burden. Our judgment is that selling into US defence work will increasingly require a clean answer to two questions: which models sit underneath, and whose usage terms govern them.

The third is to the legal system itself. Two federal courts have reached opposite results on parallel designations. Anthropic said it is considering all options, including further review. A full-court rehearing, a Ninth Circuit appeal of the California ruling, or Supreme Court review could each change the map.

VI.Precedent: a statute written for adversaries, applied to a domestic lab

The dissent traced the 2018 Act to warnings from the intelligence community about hostile states and companies beholden to foreign governments infiltrating federal systems. The statute's language, she argued, tracks the vocabulary of covert breaches. The majority answered that Congress chose broad words, and courts apply the words chosen.

Whatever the merits, the trajectory is clear. A tool built to keep compromised foreign hardware out of federal networks now reaches a US company's published terms of service. That migration from foreign-threat statute to commercial-dispute instrument is the precedent that will outlast this case.

VII.How it plays out: three scenarios

Probabilities are our analytical judgment, not forecasts from a model, and they sum to 100%.