What a supply chain label on a U.S. AI vendor asked of agencies and contractors

The week

On February 27, 2026, after negotiations over military use of its models broke down, the President directed every federal agency to stop using Anthropic’s technology. Agencies already using it, such as the Department of Defense, were given six months to phase it out. The same day, the Secretary of Defense said the company would be designated a supply chain risk and that contractors doing business with the military could not conduct commercial activity with it. The company had sought limits on use of its models for mass domestic surveillance and fully autonomous weapons. The Department wanted use for all lawful purposes. GSA said it was removing the company from USAi.gov and its Multiple Award Schedule. Formal notice to the company followed in early March, under two statutes: 10 U.S.C. 3252 and the Federal Acquisition Supply Chain Security Act, 41 U.S.C. 4713. On March 9 the company sued in federal district court in California and petitioned the D.C. Circuit.

We take no side here on the merits of the dispute, which the courts were still weighing seven months later. Earlier in this series, the OpenAI board crisis of November 2023 framed model choice as a supplier-concentration risk, managed through portability. This episode raised a different problem. A government instrument, not a supplier’s own failure, set out to exclude a domestic software provider. Its reach was disputed from the first day.

Two groups had to act first. Federal agencies, including civilian ones, had been buying the company’s models through GSA vehicles, cloud marketplaces and contractor-run systems. Many organizations also hold Defense work alongside everything else, among them health systems, universities and technology firms. For both, three questions decided how much had to change: which instrument applied, whom and which contracts it reached, and which uses of the model it covered. They are separate questions, and answering them in that order kept the response proportionate.

Which instrument applied

The first week produced statements on social media, then a presidential directive, then formal notices under two different statutes. Each binds different parties in different ways. A directive to agencies governs what agencies buy and use. It does not, by itself, rewrite a private company’s contracts. A designation under Section 3252 of Title 10 lets the Department exclude a source from certain procurements involving national security systems. An order under the Federal Acquisition Supply Chain Security Act reaches contractors through contract clauses, notably FAR 52.204-29 and 52.204-30. The first asks offerors to make a reasonable inquiry before representing that they will not provide or use covered articles. The second bars using covered articles in contract performance, requires periodic checks of SAM for applicable orders and requires reporting any covered articles found. Law firm commentary noted that, for contracts already awarded, a new order generally binds once the contract is modified to include it.

The practical step was a short register, owned by the contracts team, listing each instrument, its date, its legal basis, its stated scope and its current status in court. Statements of intent went on the register as signals, not as obligations. Obligations came from contract clauses and from written direction by a contracting officer. It decided whether a firm acted on what it was legally required to do or on what it read in the news, and it gave counsel a record to review.

Whom and which contracts it reached

For agencies, the directive was the operative instrument, and GSA’s removal of the company from its schedule closed the usual buying route at once. An agency had to find where the models were in use: licensed directly, bought through a cloud marketplace, or running inside a system a contractor operates for it. It then had to plan a phase-out that kept the records and work products those tools had produced. Because the directive was in litigation from the second week, each step needed to be recorded so it could be reversed cleanly if a court said so.

For contractors, the scope dispute was explicit. The Secretary’s statement described a ban on any commercial activity with the company by firms doing business with the military. The company, and many government contracts lawyers, read the statutes as reaching the company’s products only as used in Defense contract work. Until a court or a contracting officer said otherwise, contractors had to work between those readings.

That made contract segmentation the core task. A contractor needed to know which of its contracts were with the Department or flowed down from a Defense prime, which contained the relevant FAR clauses, and which systems and teams performed them. Firms that had already drawn a boundary for other reasons had a head start. A defense supplier that had scoped a controlled unclassified information enclave for CMMC, as discussed earlier in this series, already knew which environment touched Defense data. A university with a Defense research award knew which lab and which systems performed it. Firms that ran all work on one undifferentiated corporate estate faced a harder choice: remove the tool everywhere, or build the boundary under time pressure.

Removing a widely used tool across a whole enterprise is the safest reading and the most expensive one. It disrupts commercial and civilian work that no instrument clearly reached. Keeping it outside a defined boundary preserves that work but depends on the boundary holding, and on documenting why the firm believed it was enough. Either choice should be made by the general counsel and the executive who owns federal business. Agencies face a version of the same trade-off when a contractor-run system they rely on uses the model: they can direct a change through the contract or accept a documented exception while the courts decide.

Which uses it covered

Within a contract’s scope, use came in four forms. Direct use was a model the firm licensed itself, through the provider or a cloud marketplace. Embedded use was a model behind another vendor’s feature, such as a document tool or coding assistant that routes some requests to a third-party model. Performance use was a tool that helped produce a deliverable without being part of it, such as code written with an assistant. Corporate use was everything unrelated to the contract, such as marketing drafts or HR queries.

Direct use was easy to find and to switch off. Embedded use was the blind spot. Vendor questionnaires had asked about hosting regions and encryption, not about which foundation model sits behind a feature. Commentators also noted that the FAR clauses speak of covered articles used in contract performance, and that it was unclear whether back-office systems or embedded third-party tools fell within that phrase. The answer was to ask every software supplier serving the contract boundary, in writing, which models their features call and whether that can be disabled for a tenant.

The output of this work is an AI dependency register: each tool, the model provider behind it, the contracts it touches and whether it can be disabled. It is the same register an organization needs for incident response, for data-handling reviews and for any future exclusion of a supplier, foreign or domestic. Building it once, against a deadline, was expensive. Keeping it current costs far less.

None of this replaces legal advice. Obligations depended on the specific clauses in each contract and on written direction from contracting officers, and organizations should check with counsel before deciding what an exclusion requires of them. But the sequence held regardless of the eventual ruling: identify the instrument, map whom and which contracts it reached, then classify the uses.

With hindsight

The legal picture split rather than settled. On March 26, Judge Rita Lin of the Northern District of California preliminarily enjoined the directive and the Section 3252 designation, and GSA then restored the company’s offerings to their status before February 27. On August 27, she made that relief permanent. She found the Section 3252 designation unlawful as First Amendment retaliation and arbitrary decision-making, and barred the named agencies from enforcing the directive. Defense officials publicly disputed the ruling. On September 25, a divided D.C. Circuit panel upheld the separate designation under the Federal Acquisition Supply Chain Security Act and briefly stayed its judgment to allow a petition for rehearing en banc. Law firm alerts noted that, as of late September, no order under that act naming the company appeared in SAM.

So by October 2026, one instrument had been set aside by one court and another upheld by a different one, and both agencies and contractors still faced a moving target. Organizations that had scoped by instrument, reach and use could treat each ruling as a change to a register. Those that had reacted to the first headlines were left either over-complying at commercial cost or unsure what they had actually changed.