A US federal judge has struck down the Pentagon’s sweeping effort to blacklist Anthropic across the federal government and the defence supply chain. The ruling, filed on 27 August, does not require the Department of Defense to buy Anthropic’s technology. It does prevent a procurement dispute about AI safety restrictions from being turned into a wider penalty affecting unrelated federal and commercial work.
Developing story — last checked 28 August 2026, 06:06 BST: The decision is a 59-page district-court order and may be appealed. A separate challenge to a related Pentagon designation is also continuing. This article will be updated if the government files an appeal or either court materially changes the position.
The dispute arose after Anthropic refused to remove restrictions concerning lethal autonomous weapons and mass surveillance of Americans from the terms governing military use of its models. According to the Northern District of California’s order, the government then designated the company a national-security supply-chain risk, directed federal agencies to stop using its products and sought to bar defence contractors from doing business with Anthropic even on work unrelated to the military.
Judge Rita Lin ruled that those broader measures were unlawful. The court found First Amendment retaliation, a failure to provide the process required by the Fifth Amendment, and violations of the statute governing supply-chain risk determinations. It also concluded that the designation was arbitrary and capricious under administrative law. Reuters reported that the order blocked the blacklist while preserving the Pentagon’s freedom to choose a different AI supplier. Axios described the judgment as a major legal victory for Anthropic and reported that the government is expected to appeal.
What the court established
The order separates two decisions that had become entangled. One is an ordinary procurement choice: which model provider the Pentagon should use for a particular capability. The other is a government-wide and market-wide sanction: whether disagreement with one department justifies cutting a supplier off from federal customers and defence contractors more broadly.
The judge did not question the Pentagon’s authority to select the technology it considers suitable for military missions. The department may decide that a provider’s contractual restrictions make its product a poor fit. What it could not do, the court found, was use the supply-chain-risk mechanism as punishment for the company’s public position and refusal to relax those restrictions, without the evidence and process the law requires.
The factual record was central. The order describes the government’s stated concern about “trust” in Anthropic and connects it to the company’s criticism of the administration. It found the formal supply-chain rationale unsupported by the kind of technical vulnerability, foreign-control or operational-security evidence the statute is designed to address. The problem was therefore not merely that the consequences were broad. The legal route used to impose them did not fit the evidence.
The court granted Anthropic summary judgment on almost all of its claims. Some narrower claims were not resolved in its favour, including an ultra vires separation-of-powers theory and claims involving agencies that had taken no final action or only interim steps. Those distinctions matter: the order is a powerful rejection of the blacklist, not a declaration that every government interaction with Anthropic was unlawful.
What the ruling does not decide
The judgment does not settle the substantive policy debate over autonomous weapons, domestic surveillance or the appropriate limits on military AI. It does not endorse Anthropic’s safety rules as the correct rules for every defence use. Nor does it require the Pentagon to accept contractual limits that it considers incompatible with a mission.
It also does not end every legal route connected to the dispute. Reuters and Axios both report that a separate challenge concerning a Pentagon designation is proceeding in Washington, and an appeal from this California order could change or delay the remedy. Until the final orders and any appellate timetable are clear, federal agencies and contractors will need to distinguish what has been legally blocked from what remains under review.
The operational and governance consequence
The immediate lesson for public-sector AI procurement is that safety conditions must be handled as explicit, reviewable contract boundaries. A buyer should define the intended uses, operational authority and unacceptable constraints before selection. A provider should state what its system may and may not support. If the two positions cannot be reconciled, the procurement can end. That is different from converting a contractual incompatibility into a claim that the supplier is a general security risk.
For government, the decision reinforces the need to preserve the evidence behind consequential supplier actions: the statutory power being used, the technical or security facts that trigger it, the alternatives considered, the notice given to the supplier and the route for challenge. The same discipline applies when moving quickly in defence. Our analysis of the UK–Ukraine defence AI partnership argues that speed still requires named decision owners, bounded purposes and a documented route for pausing deployment.
For AI developers, the ruling is not a guarantee that publishing safety red lines will preserve access to every customer. Restrictions can make a model unsuitable for a mission, and public buyers retain legitimate discretion. The practical requirement is to make those boundaries precise enough to test. Terms such as “human control” or “mass surveillance” need operational definitions, escalation routes and evidence. As our examination of human oversight as a workflow explains, a safeguard is credible when a person has timely evidence and actual authority to change an outcome.
The wider governance principle is simple: procurement power and security power are not interchangeable. Security designations can carry effects far beyond one contract, including access to customers, partners and capital. They therefore need evidence tied to the legal test, procedural fairness and a proportionate scope. A disagreement about acceptable model use may be serious, but seriousness does not remove those requirements.
What to watch next
The first question is whether the government appeals and seeks to pause the effect of the order. The second is how agencies and defence contractors unwind or revise instructions issued under the blacklist. The third is the separate Washington litigation, which may address a related designation through a different statutory and procedural route.
Beyond the case, watch for changes in military AI contract language. The most useful response would be clearer use restrictions, mission-specific exceptions, independent escalation and an agreed process for resolving disputes before they become supply-chain sanctions. Public authorities also need criteria that distinguish an inconvenient contractual limit from a genuine security vulnerability.
The court has not chosen an AI safety policy for the Pentagon. It has drawn a governance boundary around how the government may respond when a supplier will not abandon its own. That distinction will matter wherever powerful AI systems, national-security missions and corporate safety commitments meet.