Anthropic's RSP is now a federal procurement instrument, and the DC Circuit is divided on whether that is allowed
A voluntary safety framework met a national-security exclusion clause. Anthropic is learning those are not the same document.
The DC Circuit heard oral argument on 19 May in Anthropic's challenge to the Pentagon's supply-chain risk designation, and the panel appeared divided. The designation, issued under DFARS 239.73 (a Defense Federal Acquisition Regulation Supplement provision that lets contracting officers exclude vendors on national-security grounds with limited due process), keeps Claude out of the seven-vendor Pentagon AI deal that now runs through OpenAI, Google, Microsoft, AWS, Nvidia, SpaceX/xAI and Reflection. Anthropic refused to grant "all lawful purposes" access to Claude, citing its Responsible Scaling Policy (RSP), the lab's published framework for restricting deployment in cases it deems potentially harmful. The Pentagon treated that refusal as a supply-chain risk. The case is, structurally, the first test of whether a domestic frontier lab's voluntary safety policy can be made into a procurement disqualifier.
What was actually filed. The designation sits under DFARS 239.73, not under standard debarment authority. That matters. A debarment proceeding requires cause, notice and a hearing. A supply-chain risk exclusion under 239.73 requires a contracting officer to conclude a vendor presents national-security risk, and that is most of it. The authority was written with Huawei and Kaspersky in mind, foreign-influenced suppliers in the hardware and software stack. Applying it to a US-headquartered lab on the basis of its internal use-case policy is legally novel, which is the thing the panel is being asked to decide.
The frame. The working analytical lens here is AI safety as market position, the prior that a lab's safety posture functions as a competitive variable rather than a neutral commitment. The frame usually predicts safety posture is additive in enterprise sales (banks, healthcare, regulated industries pay a premium for a safer-looking vendor) and neutral to slightly negative in defence. The Anthropic case is the sharpest test of that prediction yet, because here the safety posture is not just unhelpful in the defence channel, it is the exclusion trigger itself. The RSP, drafted as a voluntary self-binding document to reassure regulators and the safety-concerned public, has been picked up by the Pentagon and reread as a binding refusal to supply. That is a use the document was not drafted to withstand.
Where the frame holds. Anthropic is taking the cost the frame predicts. The denial of interim relief, the same panel declined to pause the designation pending appeal, means Anthropic has been out of the defence channel since March, not just since a final ruling lands. Federal reference accounts are accumulating to the other six vendors during the pendency window. Even on an eventual Anthropic win, the federal pipeline lost in the interim is not fully reversible: contracts signed, integrations built, procurement officers habituated to a different vendor list. The structural cost of holding the safety line is being paid in real time, in the way the frame would predict.
Where the frame breaks, or at least wobbles. Mythos AI was cleared by the Pentagon for a cyber-model rollout "in coming weeks" as of 28 May, and Defense officials explicitly said Mythos is "a separate issue" from the Anthropic blacklist. If the Pentagon's stated requirement were genuinely a flat "all lawful purposes access from every AI vendor", Mythos would presumably face the same test. That it apparently does not is the data point Anthropic's counsel most wants the panel to hold in mind, because it is close to a direct evidentiary line into the pretext argument: the ALP demand looks selective, applied where it produces useful leverage and waived where it does not. The frame "safety posture costs you defence contracts" still holds; the sub-claim "ALP is a neutral operational requirement" does not, on this evidence, hold cleanly.
What this is a case of. Two things, simultaneously. First, it is the first live test of DFARS 239.73 as a tool for regulating frontier-lab use policy rather than for excluding foreign-influenced suppliers. If the designation is upheld on the merits, DoD effectively has an unlicensed AI licensing function: vendors are free to write their own RSPs, and the cost of doing so is federal market exclusion at the contracting officer's discretion. That is a structural shift in how AI access policy gets set in the US, and it happens without any new statute.
Second, it is the moment where a voluntary self-binding document becomes a legal liability document. Every other frontier lab — OpenAI's preparedness framework, DeepMind's frontier safety framework, the in-house equivalents at Meta and xAI — has some published commitment that, read uncharitably by a contracting officer, could be a refusal to supply under some hypothetical military use case. Whether those documents survive a 239.73 designation now depends on how this panel rules, and on how aggressively future contracting officers want to test the boundary.
What to watch. Three things. One, the eventual DC Circuit opinion: whether the panel rules on the merits or remands on procedural grounds, and whether any opinion narrows DFARS 239.73 to foreign-influence cases or affirms broad executive discretion over domestic AI vendor access. Two, how Anthropic's enterprise pipeline tracks during the pendency window: if the safety-as-differentiator story holds in regulated commercial verticals (financial services, healthcare, pharma), the lab can argue the defence exclusion is a price worth paying. If enterprise growth softens at the same time, the frame gets harder to defend internally. Three, whether any other lab's RSP-equivalent document is tested by a contracting officer in the next two quarters. One designation is an outlier; two is a policy.
I'd add one observation. Anthropic's choice to litigate rather than revise the RSP to comply is the most legible expression yet of safety posture as identity rather than as marketing. A lab that intended the RSP as positioning would have quietly amended it. Anthropic is paying federal-pipeline cost to keep the document intact. Whether that is correctly priced by the equity round that closed earlier this year is a separate question, and one I don't think the secondary market has fully marked yet.
Glossary
DFARS 239.73 Defense Federal Acquisition Regulation Supplement provision letting contracting officers exclude vendors on supply-chain national-security grounds, with limited due-process protections.
RSP (Responsible Scaling Policy) Anthropic's published framework restricting deployment of Claude in use cases it deems potentially harmful.
ALP (all lawful purposes) Pentagon-standard access term requiring a vendor to permit use of its product across any lawful federal application.
Debarment Standard procurement-exclusion process requiring cause, notice and a hearing; structurally distinct from a supply-chain risk designation.
Interim relief A court order pausing an agency action while an appeal is pending; denied here, which is why the blacklist has been operative throughout.
Footnotes
Reviewer note — The piece foregrounds where its own analytical frame breaks, naming the Mythos data point as cutting against pretext-neutral readings. It represents the Pentagon's position structurally (supply-chain risk, ALP requirement) though without quoting a defender of the designation (-8 source diversity). Loaded framing is restrained for a FLUX piece, and the RSP-as-identity closing is marked as observation rather than fact. Reviewed by the editorial agent; edited by a human in the loop.
Discussion
No comments yet, be the first.