A federal appeals court has ruled that the Pentagon may keep Anthropic on a supply chain risk list because its models have safety guardrails. The finding turns on the refusals themselves, not on any security flaw in the software.
I wrote three weeks ago that the Defense Department could not punish a usage policy. A different court has now looked at a different piece of the same fight and reached the opposite answer, and its reasoning is more portable than the case it decided.
On September 25 the D.C. Circuit upheld the Pentagon’s designation two to one. Judge Gregory Katsas, writing for the majority, accepted Defense Secretary Pete Hegseth’s contention that constrained models are an operational hazard, citing “the deeply sobering prospect of overly constrained AI models shutting down unexpectedly.” The designation itself dates to March 4, 2026 and was made under the Federal Acquisition Supply Chain Security Act, which as Lawfare laid out lets the department exclude a company’s products effective immediately. Anthropic says it disagrees and is weighing an en banc petition. This is one panel, on one statute, and it may not be the last word, so read it as a live precedent rather than a settled one.
To be precise about what changed: the ruling I covered on September 2 came out of the Northern District of California and concerned retaliation claims. This is the parallel FASCSA challenge, in a different forum, and it went the other way. Anthropic is now winning one and losing one on the same underlying conduct.
Refusal became a reliability defect
Supply chain risk law was built for a specific worry: compromised firmware, undisclosed foreign ownership, components you cannot attest to. It is a mechanism for excluding things that might fail in ways you cannot see.
The majority’s move is to fit a model’s refusal behavior into that frame. An overly constrained model, the reasoning goes, may stop working mid-mission, which makes it unpredictably unavailable, which makes it a reliability problem, which brings it inside the statute. The guardrails become the defect.
Read narrowly, that is about weapons systems and a department with unusual latitude on national security judgments. Read as engineering, it is a claim with no obvious boundary. Every production model refuses. Yours refuses right now, several thousand times a day, and you almost certainly cannot produce the number. Nothing in the argument that a refusal is an availability incident limits it to the Pentagon. It works just as well for a hospital system, a utility, a bank’s fraud operation, or any buyer who can describe an unexpected refusal as an outage.
I think the argument is wrong on the engineering. A model declining a task it was told to decline is doing the thing it was specified to do, which is the opposite of a defect. But my view of the engineering is not the point. A federal appeals court has now blessed the opposite framing, and procurement lawyers read appeals courts.
You are now squeezed from both directions
Three weeks ago I wrote about the European Commission sending its first AI Act enforcement requests to more than thirty providers, and about the AI Office’s power to order a model restricted or withdrawn from the EU market. Set that alongside this ruling and the two point in opposite directions.
Brussels can penalize a provider for insufficient safety mitigation. Washington has just been told it may exclude a provider for excessive safety mitigation. It is the same model, the same weights and the same refusal policy, drawing opposite signs in two of the three markets that matter. No single configuration satisfies both, which means your provider will eventually have to choose, or ship divergent behavior by jurisdiction, and you will inherit whichever they choose without a vote.
It also means the phrase “responsible AI vendor” has stopped being a procurement virtue and started being a jurisdictional bet. That is a genuinely new thing to have to price.
The part that reaches you
The commercial stakes here are large and mostly not yours. Anthropic has said the designation has cost it billions in lost revenue and reputational damage ahead of a planned listing. The Pentagon has demonstrated that FASCSA is a usable instrument against a software vendor on grounds that have nothing to do with the security of the software. Both of those will shape the next two years of how frontier labs negotiate with governments.
None of which matters to you unless you sell to the federal government. What matters is that a court has now written down, in a published opinion, that model refusal is a form of unavailability. That sentence will be quoted in diligence questionnaires, in enterprise MSAs, and eventually in an SLA you are asked to sign, and the first time you see it you will be negotiating against precedent rather than against an opinion.
Three things I would do about it.
Can you produce your refusal rate for last month? Most teams cannot, because refusals are logged as successful API responses. If a customer, a regulator, or a court ever characterizes your model’s refusals as downtime, the only defense is data showing what was refused, why, and whether the workflow recovered. Start counting now. Retroactive telemetry does not exist.
Does your vendor carry a government designation, and where is it in the appeals process? This is now a standard diligence item and almost no questionnaire asks it. You want to know about active designations, active challenges, and the procedural posture, because a designation that survives en banc review is a different risk from one that a panel just handed you two to one. A vendor that treats the question as adversarial has answered it.
What is your plan if the same model behaves differently in two jurisdictions? Not if the model is unavailable, which everyone has thought about. If it is available everywhere but refuses different things in Frankfurt than in Virginia. Your evals almost certainly run in one region. That is no longer a safe assumption, and the failure mode is quiet: the system works, the outputs differ, and nobody finds out until an auditor does.
For two years the industry has sold safety as a feature you pay extra for. A court just priced it as a liability, and the invoice goes to whoever built on top.
If you are working through an AI initiative and want a second technical opinion, or you want to talk through any of this, connect with me on LinkedIn or see the production side at coreagenticgroup.com.
