On August 27, the U.S. District Court for the Northern District of California ruled in favor of Anthropic in its lawsuit against the U.S. Department of Defense. It was the first substantive ruling on the merits to emerge from the dispute over how far Claude could be used for military purposes.
The dispute began with a single contractual clause. The Department of Defense demanded the ability to use Claude without restriction for any purpose permitted by law, while Anthropic sought to preserve safeguards preventing its use for mass domestic surveillance and fully autonomous weapons. The company also argued that its models were not yet reliable enough for such applications.
After negotiations broke down, Defense Secretary Pete Hegseth publicly announced on February 27 that Anthropic would be designated a supply-chain risk, and the Department of Defense formally issued the designation on March 3. Earlier, the president had ordered all federal agencies to stop using Anthropic products, and major contractors doing business with the Defense Department were also told not to use Claude in related work. Anthropic filed suit on March 9, arguing that the measures constituted unlawful retaliation.
Judge Rita Lin, who presided over the case, concluded that the supply-chain-risk designation and related measures violated the First and Fifth Amendments, the Administrative Procedure Act, and the underlying statutory authority. The government’s stated rationale did not fit the kind of supply-chain risk contemplated by the law, and the key risk-assessment document supporting the designation was not prepared until March 2, after the public announcement of sanctions on February 27.
Yet less than a week after the ruling, different signals emerged from within the administration.
On September 2, Commerce Secretary Howard Lutnick said in substance that the relationship with Anthropic had been restored. The following day, however, Emil Michael, the Pentagon’s Under Secretary of Defense for Research and Engineering, wrote on X that Anthropic was still regarded as a supply-chain risk to the Department of Defense and the defense industrial base. The two departments, however, were not dealing with exactly the same matter.
At first glance, it may seem contradictory for a company that prevailed in court to remain labeled a risk. In reality, two different issues overlapped.
First, the supply-chain-risk designation was not a single legal action. The Defense Department relied on two different statutes to restrict Anthropic. One was 10 U.S.C. §3252, which allows the Department of Defense to exclude certain suppliers from national-security systems and procurement networks on supply-chain-risk grounds. What Judge Lin found unlawful and set aside on August 27 was the designation and related actions taken under this provision.
But there was also a separate action under 41 U.S.C. §4713, part of the federal supply-chain-security framework known as FASCSA. Unlike §3252, this authority is not limited to the Department of Defense and provides a separate mechanism for excluding risky suppliers from federal procurement and supply chains more broadly. Anthropic challenged this action as well, but that case proceeded separately in the U.S. Court of Appeals for the D.C. Circuit rather than in the California district court. In April, Anthropic’s emergency request for a stay was denied, and oral argument was held on May 19.
The August 27 ruling therefore did not eliminate every supply-chain-related measure concerning Anthropic at once. The Defense Department’s §3252 designation was invalidated, but the separate dispute under §4713 was still proceeding in another court.
Second, and more importantly, the ruling did not resolve every question surrounding the military use of AI.
The court did not declare that Anthropic has a general right to restrict U.S. military policy. Nor did it decide whether using Claude for fully autonomous weapons or mass surveillance is itself appropriate. In fact, the ruling expressly acknowledged that the Department of Defense remains free to choose whichever AI supplier it prefers.
The central issue was different: whether the Department of Defense and the federal government complied with statutory and constitutional requirements when they responded to Anthropic’s usage restrictions and public criticism by imposing a supply-chain-risk designation and broad commercial restrictions.
The August 27 ruling therefore resolved a significant part of the government’s actions, but it left untouched the questions that had caused the dispute in the first place.
How far can an AI company refuse a government’s intended use?
How far should the government be required to accept that refusal?
And who should determine that boundary, and through what process?
It Began with “All Lawful Uses”
Anthropic was not originally a company at odds with the U.S. Department of Defense. On the contrary, the relationship between the two had become quite extensive, with Claude being used in classified U.S. government environments for intelligence analysis, modeling and simulation, operational planning, cyber operations, and other purposes. Anthropic itself had also publicly emphasized that it had actively supplied AI systems to U.S. defense and intelligence agencies.
The conflict began to intensify in the fall of 2025, when the parties were discussing the deployment of Claude on the Defense Department’s new AI platform, GenAI.mil.
The key condition demanded by the Department of Defense was simple:
“All lawful uses.”
In other words, if a use was not prohibited by U.S. law or military regulations, Anthropic would not be allowed to impose additional restrictions on how the Department of Defense used Claude. On January 9, 2026, Defense Secretary Pete Hegseth directed that this principle be incorporated into Defense Department contracts for AI services. Anthropic agreed to remove most of its existing restrictions but insisted on keeping two: mass domestic surveillance of Americans and fully autonomous weapons that select and engage targets without direct human control.
The logic behind the two restrictions was somewhat different. On mass domestic surveillance, Anthropic emphasized civil liberties and democratic principles. On fully autonomous weapons, it also relied on a technical judgment: that current frontier AI systems are not yet sufficiently stable and reliable to be entrusted with lethal decision-making. The company also stated that it did not oppose partially autonomous weapons or military uses of AI more generally.
That distinction became important later.
“We oppose that policy” and “Our product is not yet safe enough for that use” are not the same claim. The first raises the question of how far a private company can draw boundaries around government policy. The second concerns how far a supplier may define the safe operating limits of the product it created.
But in the contract, both appeared in the same form: as restrictions on use.
On February 24, Hegseth met directly with Anthropic CEO Dario Amodei. According to the court record, Hegseth praised Claude’s performance but said that the Defense Department had other suppliers and that those companies were not attempting to exercise a “veto” over the department. He then warned that if Anthropic did not agree to permit all lawful uses by February 27, the company could be designated a supply-chain risk.
The situation deteriorated quickly from there.
On February 27, President Trump directed federal agencies to stop using Anthropic technology. Some agencies already using Claude were given up to six months to transition away from it. Roughly an hour later, Defense Secretary Hegseth also directed that Anthropic be designated a national-security supply-chain risk and announced that contractors, suppliers, and partners doing business with the U.S. military would be prohibited from engaging in commercial transactions with Anthropic.
On March 2, a key internal Defense Department assessment memo was prepared to explain the supply-chain risks allegedly posed by Anthropic. The court would later place considerable weight on this sequence of events: the public decision to impose sanctions came first, while the central administrative record supporting that decision was written afterward.
On March 3, Defense Secretary Hegseth formally determined under 10 U.S.C. §3252 that Anthropic’s products and services posed a supply-chain risk to Defense Department national-security systems. The statute provides the Defense Department with authority to exclude or restrict suppliers on supply-chain-risk grounds in national-security systems. Anthropic received the letter the following day, March 4. Around the same time, a separate supply-chain action was also taken under 41 U.S.C. §4713. That statute provides a separate legal basis for restricting products, services, or suppliers considered risky to the security of the federal government’s procurement and supply chains.
On March 9, Anthropic launched legal challenges along two tracks. In the Northern District of California, it challenged the president’s directive, the §3252 designation, and follow-on actions by federal agencies. The §4713 action, meanwhile, was challenged separately in the U.S. Court of Appeals for the D.C. Circuit under the direct-review procedure established by law.
On March 26, the California court issued a preliminary injunction, putting a halt to enforcement of the government’s actions.
Then, on August 27, the U.S. District Court for the Northern District of California issued a 59-page summary judgment ruling.
The decision dealt a major blow to the §3252 designation and related actions, but it did not resolve every supply-chain dispute involving Anthropic. The separate §4713 case was still proceeding through a different legal process in another court.
What the Court Recognized — and What It Did Not Decide
The August ruling rested on three principal findings.
The first concerned the First Amendment. The court concluded that Anthropic’s public criticism of the government’s AI policies and usage conditions constituted protected speech, and that the broad sanctions imposed afterward bore the character of retaliation for that speech.
The court paid particular attention to the chronology. During the extended period of private negotiations between Anthropic and the Defense Department, supply-chain risk had not been a central issue. Yet shortly after Dario Amodei publicly disclosed his disagreement with the government, the president and the defense secretary publicly criticized Anthropic’s position and announced sanctions. The risk assessment prepared later also cited Anthropic’s public conflict with the government through the media as a reason for mistrust. The court found that these circumstances supported the inference that the measures were intended, at least in part, to make an example of Anthropic for other AI companies.
The second issue was due process under the Fifth Amendment. The government broadly restricted Anthropic’s contractual and commercial relationships without first providing sufficient notice or an adequate opportunity to respond. In practice, several federal agencies had already begun implementing restrictions before Anthropic received formal notice.
The third concerned the statutory basis for the §3252 supply-chain-risk designation. The kinds of risks contemplated by the statute are closer to situations in which an adversary compromises a system, inserts malicious functionality, or disrupts its design, integrity, or operation. By contrast, the government’s principal objection was that Anthropic had insisted on maintaining contractual usage restrictions.
The court found it difficult to treat these as the same kind of risk. It also confirmed that Anthropic could not remotely access models already deployed in national-security networks and arbitrarily alter or shut them down after deployment.
Still, the court did not accept every argument Anthropic made. Its separate separation-of-powers claim that the president’s directive itself plainly exceeded presidential authority was not accepted, and the government prevailed on some claims involving individual federal agencies.
More important, however, is what the ruling did not decide.
The court did not declare that Anthropic has a general right to refuse lawful military uses of AI. It did not decide whether the use of AI for fully autonomous weapons or mass domestic surveillance is substantively justified. Nor did it hold that the government’s demand for “all lawful uses” in an AI procurement contract is itself unlawful.
On the contrary, the ruling proceeded from the clear premise that the Department of Defense remains free to choose the AI supplier it wants. If the government did not wish to accept Anthropic’s conditions, it could simply have chosen another supplier.
What the court objected to was not the decision not to choose Anthropic, but the way the government expanded the consequences of a contractual disagreement and public criticism across the federal government and the private defense-industrial network.
It would therefore be an overstatement to summarize the ruling as “the court recognized an AI company’s right to refuse military use.”
The Government’s Argument Is Not Trivial Either
Looking only at the two restrictions Anthropic insisted on keeping, the company’s position can sound more intuitively persuasive. Mass domestic surveillance and fully autonomous lethal weapons are both deeply contested applications.
But it would also be inaccurate to reduce the Defense Department’s position to simply wanting to “use AI however it wants.”
The first issue is procurement sovereignty. If a private AI system is integrated into a core national-security system, yet the supplier continues to determine through its own policies which missions the system may or may not support, the government acquires a new form of dependency. If a use permitted today can be prohibited tomorrow by a change in corporate policy, the issue shifts from model performance to the stability and predictability of the supply chain.
The second is democratic legitimacy. In principle, the limits on the use of military force are determined through public institutions: the Constitution, laws enacted by Congress, executive policy, military law, and rules of engagement. Executives at AI companies, by contrast, are not elected. If such a company can say, “This use is lawful, but our model may not be used for it,” an additional gatekeeper is effectively created outside the existing public framework.
That is why Defense Secretary Hegseth described the issue as a “veto.” In his meeting with Anthropic, he argued that the Defense Department had other suppliers and that a private AI company should not have a de facto veto over military operational decisions.
The third issue is operational reliability. In peacetime, it may sound easy to say that the military can simply switch to another AI system. In practice, however, a new model may have to be integrated into military systems, validated in classified environments, and supported by retraining personnel and reconfiguring related infrastructure. If those switching costs are high, the possibility of a supplier changing its policies can itself become an operational risk.
There is also the question of precedent. If it becomes normal for AI companies to restrict government purposes through their own policies, the same question could extend to cloud providers, satellite operators, telecommunications companies, and data-center firms.
The government’s central question, then, is this:
In an era when much of the national-security infrastructure is provided by private companies, how far may those companies choose the government activities in which their technologies will participate?
That is a serious question. The court’s conclusion, however, was that even if such concerns are real, they do not by themselves justify the manner in which Anthropic was designated a “supply-chain risk” under §3252.
Must a Company Do Whatever the Government Demands?
The question on the other side is equally difficult to avoid.
The fact that the government considers an activity lawful does not automatically absolve a technology supplier of all responsibility. In particular, Anthropic’s argument against fully autonomous weapons was not merely an ethical objection. It was also a claim about product reliability.
Anthropic argued that today’s frontier AI systems are not yet sufficiently stable or reliable to be entrusted with the full process of identifying human targets and engaging them directly.
The Department of Defense already has internal safety rules governing autonomous weapons. DoD Directive 3000.09 (Autonomy in Weapon Systems, the official Defense Department directive governing how autonomous and semi-autonomous weapon systems are developed, approved, and operated) requires such systems to function as intended under realistic operational conditions and to possess sufficient safety and reliability to reduce the likelihood and consequences of failure. Certain autonomous weapon systems also require separate senior-level review and approval before development or deployment.
In other words, the government itself does not operate on the simple principle that “if it is lawful, it can be used immediately.” Questions of safety and reliability also have to be considered.
That raises another question: if a model developer says, “Our product has not been validated for this use,” is that an improper intrusion into national policy, or an ordinary responsibility of the supplier that built the product?
The issue becomes less clear in the case of mass domestic surveillance. Here, Anthropic’s reasoning rests less on technical reliability and more on value judgments concerning democracy and civil liberties. The company has argued that even where existing law permits certain activities, AI systems capable of combining vast amounts of data could enable surveillance at a scale and in forms that were previously impossible.
At that point, the government’s counterargument becomes stronger again.
Should a private company be allowed to impose on the state a standard stricter than the law itself?
But reverse the question, and the answer becomes difficult again.
Simply because the government demands it, must a company provide its technology for uses it believes are dangerous?
The underlying problem is that it is difficult to treat either the government’s judgment or the company’s judgment as absolute.
The Same Negotiation, but Unequal Power
The government and Anthropic wanted different contractual terms. But the tools available to each side were not symmetrical.
Anthropic’s most direct option was to refuse the conditions demanded by the government and decline to enter into the contract. It could also publicly explain why it had made that decision.
Nor could Anthropic remotely alter or shut down Claude models that had already been deployed within national-security networks. The court record confirmed that it did not possess such control.
The government, by contrast, had tools extending far beyond simply declining a particular contract.
The president’s February 27 directive applied across all federal agencies, while Hegseth’s action was designed to affect private companies doing business with the U.S. military as well. The restrictions extended even to commercial activity unrelated directly to military work, and the court noted that the Department of Defense had failed to identify an adequate legal basis for such a sweeping ban on private transactions.
Several federal agencies in fact began blocking access to Claude or moving to terminate existing projects and contracts.
In court filings, Anthropic argued that if the measures remained in place, it could lose 50–100 percent of its revenue from defense contractors and Defense Department-related customers, with total losses in 2026 potentially reaching several billion dollars.
This disparity was also relevant to the court’s First Amendment analysis.
A government decision not to contract with Anthropic is not the same as broadly excluding a company from the federal government and the private defense-industrial network because it publicly criticized government policy.
The ruling did not place corporate contract terms above the judgment of the state. Rather, it questioned the procedures and legal grounds under which the government may exercise its far greater procurement and administrative powers.
Are AI Companies Really Becoming “Private Regulators”?
Taking one step beyond the immediate dispute raises another question.
If an AI company sets usage conditions and refuses to supply its model, does that mean a private company is effectively limiting what the state itself can do?
In other words, is it becoming a private regulator?
The possibility exists. But the Anthropic case alone does not show that we have already reached that point. The main reason is the existence of alternative suppliers.
OpenAI, Google, xAI, and other frontier AI companies are also participating in the government market. Defense Secretary Hegseth himself said during his meeting with Anthropic that the department had other options. If genuinely substitutable models exist and the government can switch suppliers, then a company saying “we will not contract under these conditions” looks more like a commercial choice than a regulatory act.
But that could change. If a performance gap emerges in which only one model can perform a necessary mission, or if the integration and certification process for replacing a model becomes so lengthy that switching costs become prohibitive, the incumbent supplier’s bargaining power would increase. And if major frontier AI companies adopt similar restrictions on areas such as autonomous weapons or surveillance, individual corporate policies could begin functioning as an industry-wide standard.
The more these conditions overlap, the more a private AI company’s choices could move beyond ordinary contract terms and begin to influence the actual implementation of public policy.
Yet in the present case, the actor that exercised the broader power of exclusion was the government.
Although the August ruling halted the §3252 designation and related actions, on September 3 Under Secretary of Defense for Research and Engineering Emil Michael said that Anthropic was still regarded as a supply-chain risk to the Department of Defense and the defense industrial base. That statement should not be read to mean that the §3252 designation invalidated by the court somehow remained legally intact. Rather, it signaled that the Department of Defense’s policy-level distrust of Anthropic had not disappeared despite the judicial ruling.
The case therefore does not show that companies already regulate the state. Instead, it illustrates how the contractual conditions imposed by an AI supplier could begin to resemble public power if that supplier becomes sufficiently important.
The Gap Lies Between the Rules
It is easy to say that this dispute arose because there are no rules governing AI. But relevant rules already exist.
Autonomous weapons are governed by DoD Directive 3000.09. Federal procurement is governed by the FAR and supply-chain statutes, including §3252 and §4713, which provide authority and procedures for restricting suppliers on supply-chain-risk grounds. Government actions are subject to the Administrative Procedure Act, while retaliation for criticism of the government and failures of due process implicate the First and Fifth Amendments.
Those rules actually operated in this case. The problem is the gap between the areas they regulate.
The autonomous-weapons directive addresses the safety and approval process for weapon systems, but it does not directly answer what uses a supplier of a general-purpose AI model such as Claude may refuse at the contracting stage.
Supply-chain laws were designed primarily around risks such as system compromise, malicious functionality, and threats to integrity. They were not principally designed to govern negotiations when a company’s product-safety or ethical policies conflict with the government’s intended uses.
Constitutional and administrative law can review whether government action was lawful after a dispute has already occurred. But they do not specify in advance how far the government may go in demanding particular uses, or on what grounds a company may refuse them.
That is how a dispute over a contractual phrase — “all lawful uses” — was able to expand into a supply-chain designation and a constitutional lawsuit.
What this case reveals is not necessarily the need for one massive new AI law, but the existence of a gap that existing institutions do not easily address.
There is still no sufficiently settled standard for how far the government may use frontier AI, on what grounds a company may refuse a particular use, or who should review such conflicts and through what process.
That uncertainty is particularly significant in areas such as fully autonomous lethal systems and mass domestic surveillance, where the consequences are too broad to be comfortably determined through negotiations between a single company and a single government agency. At the same time, leaving every decision either to corporate policy or to government discretion creates a different set of problems.
What the court focused on in this case was ultimately the basis and procedure for the government’s decision. The public announcement that Anthropic would be treated as a supply-chain risk came first, while the central risk assessment intended to support that conclusion was prepared afterward. The court viewed it as significant that the government appeared to decide on sanctions first and construct the supporting rationale later, rather than first determining whether Anthropic’s usage restrictions genuinely created a national-security risk.
At least one principle emerging from this case is therefore clear:
A risk assessment should not become a document written after the fact to justify a sanction already decided upon.
Can the State Use AI Without Limit, and Can Companies Refuse at Will?
There are two easy conclusions to draw from this case.
One is that national security is the responsibility of a democratically constituted government, and therefore private companies should permit any use that is lawful. The other is that the developer understands the risks of its technology best and should therefore have the final right to refuse a particular use.
Neither position is easy to accept without qualification.
If the government is effectively granted unlimited rights of use, companies may be required to provide their models whenever the state demands them, even where the developer believes the system is not sufficiently safe for a particular application. On the other hand, if companies are given a unilateral veto, a small number of unelected technology firms could end up determining the practical boundaries of national-security policy.
The central question, then, is not which side should hold absolute authority, but what standards and procedures should govern conflicts between a government demand and a company’s refusal.
This case illustrates why that question matters. The government was free to reject Anthropic’s conditions and choose a different supplier. Anthropic was likewise free to refuse terms it found unacceptable. The conflict escalated when a contractual disagreement expanded into a supply-chain-risk designation and sweeping commercial restrictions.
On August 27, the court halted that form of government action. But it did not tell us which military uses of AI should ultimately be permitted, or how far a company should be allowed to refuse them.
That is why it is not enough to see this simply as a case in which Anthropic defeated the government.
What the court established was that national security does not place the government’s procurement and administrative powers beyond the constraints of law and due process. How far an AI company’s own usage restrictions may legitimately extend, however, remains unresolved.
As AI becomes part of national-security infrastructure, model performance will not be the only thing that matters. The structure of control — who may use the technology, under what conditions, and for what purposes — will matter just as much. And that structure cannot easily be reduced either to a single corporate policy or to a single government directive.
The question that remains is this:
What uses should be restricted, by whom, on what grounds, and through what process?
