Fifty-nine pages of opinion rest on a four-page memorandum. That asymmetry is the whole story. When the Department of War finally produced the administrative record justifying its decision to designate Anthropic a supply chain risk, ban every federal agency from using its products and bar defense contractors from doing business with it, Judge Rita F. Lin found that the entirety of the government’s rationale fit in a single memo that, as she wrote in the August 27 summary judgment opinion, “post dates two of the three challenged actions.” Her assessment of it was three words long: “The record is slim.”
The practitioner takeaway is not that Anthropic won, though it did, on four of five counts. It is that procurement designation has been converted from an administrative lever into a constitutional question. Designation was attractive to agencies precisely because it demanded nothing: no notice, no hearing, no published findings, no evidentiary threshold a court would ever see. The Northern District of California just attached a First Amendment retaliation analysis and a Fifth Amendment pre-deprivation process requirement to that lever, and vacated the underlying action for exceeding the statute. Any agency contemplating punishment of a model vendor over its usage policy now has to assume the record will be read out loud.
What the court actually held
The order of final relief in Anthropic PBC v. U.S. Department of War, No. 26-cv-01996-RFL (N.D. Cal.), is specific, and the specificity matters more than the headline. The court declared the challenged actions unconstitutional retaliation for protected expressive activity (Count II), declared that they deprived Anthropic of protected liberty interests “without sufficient pre-deprivation notice or opportunity to be heard” (Count IV), and held the supply chain designation “arbitrary, capricious, and in excess of statutory jurisdiction, authority, or limitations under 10 U.S.C. § 3252,” vacating and remanding it under 5 U.S.C. § 706(2). It entered a permanent injunction against implementing or giving effect to the actions, and directed defendants to rescind the guidance that carried them out.
It also handed the government two wins that an honest read has to include. Anthropic’s ultra vires separation of powers claim (Count III) was rejected outright. And judgment went to defendants as to a list of agencies that took no relevant action or only interim measures, including HHS, Commerce, VA, SEC and NASA on the Section 558 count. The court was explicit about what it was not doing: “Though the Department of War is undisputedly free to select the AI vendor of its choice, the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless.” Nobody won a right to sell to the Pentagon here.
The retaliation finding is built on the government’s own conduct
What makes the First Amendment holding durable rather than rhetorical is that Judge Lin did not rely on inference about motive. She relied on the sequence. A few days before the challenged actions, Secretary Hegseth proposed applying the Defense Production Act to Anthropic, “which would mean the company was essential to national security rather than a threat to it.” Immediately afterward, the department kept pursuing a contract, telling the company “we are very close here.” And the government was still discussing collaboration on Anthropic’s Mythos model. As the opinion puts it: “None of that is consistent with a genuine fear that Anthropic is a saboteur who would poison its software to harm national security.”
The record’s stated basis for the designation, once the government abandoned its claim that Anthropic had backdoor access to deployed models, reduced to one word: trust. Defendants asserted that because of Anthropic’s “increasingly hostile manner through the press” and its criticism of the department’s views on AI use, they “cannot trust Anthropic to ensure the integrity of its models.” The court’s answer is the sentence that will get quoted for years: “Neither the Constitution nor the federal statute invoked by Defendants allows them to impose sweeping penalties based principally on Anthropic’s critique of the Administration’s views.”
Buyers should notice how the court treated national security deference, because that is the load-bearing wall. Lin granted it and then applied Holder v. Humanitarian Law Project, 561 U.S. 1, 34 (2010): “concerns of national security and foreign relations do not warrant abdication of the judicial role.” When government counsel was asked at argument whether terminating a contract for the sole purpose of stopping public criticism of the President would violate the First Amendment, counsel was “reticent to offer” an answer. The court’s response: “But the argument is already foreclosed.” That passage is reasoning inside the holding, not a stray aside, and it is the part an appellate panel will have to engage.
The statutory holding may outlast the constitutional one
For anyone evaluating vendor political risk, the Section 3252 analysis is the more portable finding. Congress defined supply chain risk as the risk that an adversary may “sabotage, maliciously introduce unwanted function, or otherwise subvert” a national security system, under 10 U.S.C. § 3252(d)(4). The court held that a vendor does not enter that category by being difficult: “An IT vendor does not become a potential adversary of the United States whenever it asks probing questions or stubbornly insists on particular contracting terms, even if doing so causes DoW to doubt its trustworthiness.” Permitting the Secretary to affix the label to suppliers “simply because he deems them too arrogant or difficult to ‘trust'” would, in the court’s words, “effectively gut that statutory requirement.”
That holding does not depend on proving retaliatory motive, which is the hard part of any First Amendment claim. It says the statute has an evidentiary floor. NPR and TechCrunch both led with the constitutional finding when they covered the decision on August 28. The APA holding is quieter and probably more useful.
Do not overstate this
Three limits, stated plainly.
First, this is one district judge in one district. It binds these parties. It is persuasive authority everywhere else and binding precedent nowhere, and the government’s appeal of the earlier preliminary injunction sits at the Ninth Circuit.
Second, a different designation is still alive. As the National Law Review’s analysis of the ruling notes, Lin addressed the § 3252 designation; the separate FASCSA designation under 41 U.S.C. § 4713 remains in effect pending D.C. Circuit review in No. 26-1049. AO Shearman’s contractor guidance spells out why that distinction has teeth: the FASCSA exclusion runs through FAR 52.204-30 across covered procurements, with reporting obligations measured in business days. A contractor reading only the headline would draw exactly the wrong operational conclusion. And Under Secretary of War Emil Michael told the Washington Examiner on September 3 that “Anthropic is still a designated Supply Chain Risk at the [Department of War] and for the Defense Industrial Base.”
Third, on appeal: as of today, September 21, no notice of appeal from the August 27 judgment appears on the publicly reachable docket. Treat that as unconfirmed rather than settled, since the public mirror of the docket lags. The government’s window under Fed. R. App. P. 4(a)(1)(B) runs 60 days from entry of judgment, to roughly October 26. The court already denied a request to administratively stay the permanent injunction for seven days, noting that defendants had been complying with the preliminary injunction “for more than five months and had ample opportunity to identify any harms caused by it.” An appeal is likely. It has not visibly happened yet.
The buyer’s read
The commercial stakes were never small. Anthropic held one of the Pentagon’s $200 million frontier AI agreements awarded in July 2025, and The Register reported that more than 100 enterprise customers contacted the company with concerns and that Anthropic put potential 2026 revenue losses in the billions. That contagion, commercial buyers fleeing a vendor because of a federal label rather than any product defect, is what made designation such an efficient weapon.
The ruling raises the cost of using it, without eliminating it. Nothing here stops an agency from declining to buy a model, cancelling for convenience, or writing usage terms a vendor will not accept. What it disrupts is the cheap version: a label applied on a thin record for expressive reasons, with no hearing, and the private market doing the enforcement. EFF’s September 1 analysis makes the right complaint from the other direction, that a regime where surveillance limits depend on a vendor’s discretion is a fragile one, and that Congress, not corporate policy, should set the floor. Both things are true. The ruling protects the vendor’s right to say no. It does not make the answer to the underlying question turn on anything other than that vendor’s choice.
If you are scoring political risk across model vendors, the question changed shape this month. It is no longer only whether a vendor’s safety posture could get it punished. It is whether a punishment, once delivered, will now generate a public record. On this record, it did, and the record was four pages.
This site is not offering legal advice. If a designation touches your contracts, ask counsel about your specific facts.