Federal AI projects built on Claude need a second model after a 2-1 DC Circuit ruling

Somewhere at a federal contractor, a product lead has a Claude call wired into a tool an agency uses every day, and a contracting officer wants to know whether it can stay. Techdirt's reading of the DC Circuit ruling says it cannot stay at any agency ^[5].

Anthropic's win in California does not change that. Pete Hegseth claimed the power to label Anthropic a supply chain risk under two statutes, 10 U.S.C. section 3252 and 41 U.S.C. section 4713 ^[2]. The California case turned on the first. Challenges under the second go straight to the DC Circuit, so Anthropic had to fight in two courts ^[4]. The majority wrote that "because the Department's designation authority is much broader under section 4713 than it is under section 3252, the issues flagged by Anthropic are not the same in both cases" ^[6].

For a buyer, the reasoning matters more than the vote count. The Secretary credited a joint recommendation from two senior department officials that Claude might be "subject to manipulation" by Anthropic "in such a manner as to inhibit the DoW's use thereof" ^[9]. In Techdirt's summary, the court accepted that Anthropic keeps control of its model after deployment. That control gives it the power to manipulate the model, and the court treated that as a supply chain risk ^[10]. The panel read the statutory definition broadly, saying it covers any person and so cannot be read to reach only foreign entities ^[8].

Techdirt argues that reading would make most AI models, and potentially all software, a supply chain risk ^[11]. It also calls the designation selective and punitive ^[12]. The ruling itself covers only Anthropic's designation ^[1]. Even so, a second hosted model from a vendor that also controls its model after deployment fits the description the court accepted ^[10].

Teams selling into government tend to call themselves model-agnostic because the API call sits behind a wrapper. In the codebase, prompts get tuned to one model's habits and the eval suite grades against that model's old outputs. Neither moves when the wrapper points at a new endpoint.

If I were delivering Claude to an agency, I would qualify a second model now. That means a second round of evals and a second security review, spent on a model that falls under the same statutory definition as the first ^[8]. Techdirt's account does not say whether Anthropic will seek further review.

Two questions sort the decision. The first is federal exposure: whether any customer is an agency, either directly or through a prime contractor. The second is swap time: how long the team needs to run the same workload on another model and pass the customer's acceptance tests. Teams with federal customers and a slow swap are hit hardest by the ruling, and the abstraction and eval work comes before anything else. Teams with federal customers and a fast swap should run the second model in parallel and pay for duplicate evals. With no federal customers and a slow swap, this is ordinary single-vendor risk, and nothing in this case forces a move. With no federal customers and a fast swap, all that is left is to follow the docket.