What a supply chain label on a U.S. AI vendor asked of agencies and contractors

The week

On February 27, 2026, after negotiations over military use of its models broke down, the President directed every federal agency to stop using Anthropic’s technology. Most supplier problems start inside the supplier, with an outage, a breach or a bankruptcy; this one started in Washington.

Anthropic makes a “foundation model”: a large, general-purpose artificial intelligence system that reads and writes text and that other software products are often built on top of. Agencies already using it, such as the Department of Defense, were given six months to phase it out.

The dispute was about limits. The company had sought limits on use of its models for mass domestic surveillance and fully autonomous weapons. The Department wanted use for all lawful purposes. When the two sides could not agree, the consequences moved quickly from the negotiating table to the whole federal marketplace.

The same day as the directive, the Secretary of Defense said the company would be designated a “supply chain risk,” a formal label the government can attach to a supplier it considers unsafe to rely on, and that contractors doing business with the military could not conduct commercial activity with it. That second statement was the one that made general counsels sit up, because it seemed to reach far beyond government offices into the private businesses that serve them.

GSA, the General Services Administration, which runs the government’s shared buying programs, said it was removing the company from USAi.gov and from its Multiple Award Schedule. The schedule is, in effect, the government’s pre-approved catalog: a list of vendors and prices that agencies can buy from without running a full competition each time. Being taken off it closes the easiest door into federal business.

Formal notice to the company followed in early March, under two statutes: 10 U.S.C. 3252, a defense procurement law, and the Federal Acquisition Supply Chain Security Act, 41 U.S.C. 4713, which reaches contractors through the clauses in their contracts. On March 9 the company sued in federal district court in California and petitioned the D.C. Circuit, the appeals court that hears many challenges to federal agency actions.

So within ten days, federal agencies and thousands of contractors faced a headline, a directive, two legal notices and two lawsuits, each pointing in a slightly different direction. They had to decide what to switch off, where, and on whose say-so, without knowing how any of it would end.

We take no side here on the merits of the dispute, which the courts were still weighing seven months later. The OpenAI board crisis of November 2023 framed model choice as a supplier-concentration risk, managed through portability: the ability to move from one AI provider to another without rebuilding everything. This episode raised a different problem: a government instrument, rather than a supplier’s own failure, set out to exclude a domestic software provider. Its reach was disputed from the first day.

Two groups had to act first. Federal agencies, including civilian ones, had been buying the company’s models through GSA vehicles, cloud marketplaces and contractor-run systems. Many organizations also hold Defense work alongside everything else, among them health systems, universities and technology firms. For both, three questions decided how much had to change: which instrument applied, whom and which contracts it reached, and which uses of the model it covered. They are separate questions, and answering them in that order kept the response proportionate.

Models, catalogs and contract clauses

Much of the confusion that week came from people using the same words to mean different things, so the vocabulary comes first.

A foundation model is a large AI system trained on vast amounts of text so that it can draft, summarize, answer questions and write code. Few organizations use one in its raw form. More often it sits underneath something else: a chatbot on an intranet, a feature in a document editor, a coding assistant. If the model is excluded, every product built on it is affected, whether or not its users know the model is there.

A supply chain risk designation is the government’s way of saying that a particular supplier, or its products, should not be trusted inside certain government systems. Until this episode, the tool was associated mainly with foreign technology. Using it against a domestic software company was new, which is part of why its reach was argued over so fiercely.

A GSA schedule, formally the Multiple Award Schedule, is a standing catalog of pre-negotiated contracts. An agency that needs software can buy from the schedule quickly rather than running its own competition. A cloud marketplace is the online store run by a large cloud provider, where an agency or company can switch on a third party’s product and pay for it on its existing cloud bill. Both are convenient, which is exactly why AI tools spread through them without much central record-keeping.

FAR clauses are standard paragraphs from the Federal Acquisition Regulation, the rulebook for federal buying. They are copied into government contracts and become binding promises. SAM, the System for Award Management, is the government’s official registry of contractors and the place where certain exclusion orders are published. A contracting officer is the government official with legal authority to sign, change and give binding direction on a contract. If you want to know what your contract actually requires, the contracting officer’s written word counts; a press release does not.

Finally, CMMC, the Cybersecurity Maturity Model Certification, is the Defense Department’s program for checking that contractors protect sensitive information. Many contractors prepared for it by drawing a boundary, sometimes called an enclave, around the systems that handle controlled unclassified information: government data that is not secret but still must be protected. That boundary turned out to matter a great deal.

Which instrument applied

The first week produced statements on social media, then a presidential directive, then formal notices under two different statutes. Each binds different parties in different ways, and the most useful thing a leadership team could do was to stop treating them as one event.

A directive to agencies governs what agencies buy and use. It does not, by itself, rewrite a private company’s contracts. A designation under Section 3252 of Title 10 lets the Department exclude a source from certain procurements involving national security systems. An order under the Federal Acquisition Supply Chain Security Act reaches contractors through contract clauses, notably FAR 52.204-29 and 52.204-30.

The first of those clauses asks offerors, meaning companies bidding for work, to make a reasonable inquiry before representing that they will not provide or use covered articles. The second bars using covered articles in contract performance, requires periodic checks of SAM for applicable orders and requires reporting any covered articles found. Look before you promise, keep checking the official list, and tell the government if you find something on it. Law firm commentary noted that, for contracts already awarded, a new order generally binds once the contract is modified to include it.

The practical step was a short register, owned by the contracts team, listing each instrument, its date, its legal basis, its stated scope and its current status in court. Statements of intent went on the register as signals, not as obligations. Obligations came from contract clauses and from written direction by a contracting officer. The register decided whether a firm acted on what it was legally required to do or on what it read in the news, and it gave counsel a record to review.

A register like this sounds bureaucratic. In practice it is a one-page table, and it changes the tone of the conversation in the boardroom. Instead of “Are we banned?”, the question becomes “Which of these five items binds us, and through which contract?”, and lawyers can answer that one.

Whom and which contracts it reached

For agencies, the directive was the operative instrument, and GSA’s removal of the company from its schedule closed the usual buying route at once. An agency had to find where the models were in use: licensed directly, bought through a cloud marketplace, or running inside a system a contractor operates for it. It then had to plan a phase-out that kept the records and work products those tools had produced. Because the directive was in litigation from the second week, each step needed to be recorded so it could be reversed cleanly if a court said so.

For contractors, the scope dispute was explicit. The Secretary’s statement described a ban on any commercial activity with the company by firms doing business with the military. The company, and many government contracts lawyers, read the statutes as reaching the company’s products only as used in Defense contract work. Until a court or a contracting officer said otherwise, contractors had to work between those readings.

That made contract segmentation the core task. Segmentation simply means sorting: knowing which of a firm’s contracts were with the Department or flowed down from a Defense prime, which contained the relevant FAR clauses, and which systems and teams performed them. (A “prime” is the company that holds the contract directly with the government; a “flow-down” is the set of obligations the prime passes on to its subcontractors.)

Firms that had already drawn a boundary for other reasons had a head start. A defense supplier that had scoped a controlled unclassified information enclave for CMMC already knew which environment touched Defense data. A university with a Defense research award knew which lab and which systems performed it. Firms that ran all work on one undifferentiated corporate estate faced a harder choice: remove the tool everywhere, or build the boundary under time pressure.

Removing a widely used tool across a whole enterprise is the safest reading and the most expensive one. It disrupts commercial and civilian work that no instrument clearly reached. Keeping it outside a defined boundary preserves that work but depends on the boundary holding, and on documenting why the firm believed it was enough. Either choice should be made by the general counsel and the executive who owns federal business, not by the IT department alone.

Agencies face a version of the same trade-off when a contractor-run system they rely on uses the model: they can direct a change through the contract or accept a documented exception while the courts decide.

Which uses it covered

Within a contract’s scope, use came in four forms, and naming them is half the work.

• Direct use was a model the firm licensed itself, through the provider or a cloud marketplace.
• Embedded use was a model behind another vendor’s feature, such as a document tool or coding assistant that routes some requests to a third-party model.
• Performance use was a tool that helped produce a deliverable without being part of it, such as code written with an assistant.
• Corporate use was everything unrelated to the contract, such as marketing drafts or HR queries.

Direct use was easy to find and to switch off. Embedded use was the blind spot. Many software products now pass some of their work to an outside AI model through an API, an application programming interface, a standard way for one program to send a request to another and get an answer back, much as a waiter carries orders to a kitchen the diner never sees. A customer using the product may have no idea which kitchen is cooking.

Vendor questionnaires had asked about hosting regions and encryption, not about which foundation model sits behind a feature. Commentators also noted that the FAR clauses speak of covered articles used in contract performance, and that it was unclear whether back-office systems or embedded third-party tools fell within that phrase. The answer was to ask every software supplier serving the contract boundary, in writing, which models their features call and whether that can be disabled for a tenant (a single customer’s account within a shared service).

The output of this work is an AI dependency register: each tool, the model provider behind it, the contracts it touches and whether it can be disabled. It is the same register an organization needs for incident response, for data-handling reviews and for any future exclusion of a supplier, foreign or domestic. Building it once, against a deadline, was expensive. Keeping it current costs far less.

Three anxious emails on a Monday

Suppose a mid-sized engineering firm earns roughly a third of its revenue from a subcontract under a Defense prime, and the rest from state transportation agencies and commercial clients. Its staff use an AI writing assistant licensed directly, a project management tool with an AI summary feature, and a coding assistant used by its software team.

On the Monday after the announcement, the chief executive receives three anxious emails: one from the Defense prime asking for confirmation of compliance, one from the head of IT proposing to switch off every AI tool that afternoon, and one from a commercial client asking whether the firm’s deliverables are affected.

A calm response follows the three questions. The contracts lead builds the instrument register and confirms which documents actually bind the firm: so far, only what flows down through the Defense subcontract, and only once that contract is modified or the contracting officer gives written direction. The IT lead maps which teams and systems perform the Defense subcontract; because the firm prepared for CMMC, that work already runs in a separate environment. The software team checks which of its tools call which models, and writes to the project management vendor asking which model powers its summary feature.

The result, documented and reviewed by outside counsel, might be to remove the affected model from the Defense environment immediately, pause the embedded feature there until the vendor answers, and leave commercial and state work alone for now, with the register updated as rulings arrive. The firm has a written rationale it can show the prime, its board and, if needed, a court. Compare that with the alternative: a blanket switch-off that halts commercial work for weeks, or a shrug that leaves the Defense environment exposed.

Costs that landed across the business

A firm that guessed wrong paid either way: pull a tool too early and it bore the switching costs; leave a covered article in contract performance and it faced contract remedies.

Money. Ripping out a tool that hundreds of people use every day costs licenses, retraining, lost productivity and sometimes rework of deliverables. Doing it twice, once under the order and again if a court reverses it, doubles the bill. A proportionate response protects revenue from the parts of the business no instrument clearly reached.

Risk. Under-reacting carries its own danger: a false representation to the government, or a covered article left in contract performance, can expose a firm to contract remedies and reputational damage with its most demanding customer.

Customers. Primes, agencies and commercial clients all want the same thing: a clear, credible answer. A firm that can say what applies to it, what it changed and why keeps their confidence.

Staff. Employees who had built AI tools into their daily work need to know what they may still use, where. Silence breeds shadow use, which is worse than either answer.

Regulators and courts. Because every instrument was being litigated, the record of what was done, and why, mattered as much as the decision itself.

Five mistakes in handling a model exclusion

The sound response in this episode was undramatic: a short register of instruments, a map of contracts and the systems that perform them, an inventory of AI dependencies including those buried inside other vendors’ products, and a decision signed off by the general counsel and the business owner rather than improvised by IT.

The errors were equally recognizable:

• Treating a statement as a rule. Acting on a social media post or a press briefing as if it were a contract clause, which tends to produce over-compliance that is costly to undo.
• Treating a rule as a rumor. Waiting for certainty when a clause or a contracting officer’s written direction already required action.
• Forgetting embedded use. Switching off the obvious tool while a dozen vendor features continue to call the same model in the background.
• Leaving no trail. Making changes without recording them, so that a later court ruling cannot be applied cleanly in either direction.
• Drawing the boundary in a panic. Inventing a new perimeter under deadline when a CMMC enclave or research-security boundary already existed and could be reused.

Before the next exclusion, not during it

A chief executive, board member or general counsel can put these to the contracts, legal and technology leads.

1. Which of our contracts contain the supply chain clauses, and who owns the list?
2. For any exclusion we hear about, which document actually binds us, and has a contracting officer told us anything in writing?
3. Do we have a boundary around our federal or Defense work, and do we trust it?
4. Which of our software vendors send our data to an outside AI model, which model, and can we turn that off for our account?
5. If a court reversed the order next month, could we put things back cleanly?

The answers do not replace legal advice. Obligations depended on the specific clauses in each contract and on written direction from contracting officers, and organizations should check with counsel before deciding what an exclusion requires of them. But the sequence held regardless of the eventual ruling: identify the instrument, map whom and which contracts it reached, then classify the uses.

With hindsight

The legal picture split rather than settled. On March 26, Judge Rita Lin of the Northern District of California preliminarily enjoined the directive and the Section 3252 designation. A preliminary injunction is a court order that pauses a government action while the case is decided. GSA then restored the company’s offerings to their status before February 27.

On August 27, she entered final relief. She declared the challenged actions unlawful First Amendment retaliation and a denial of due process, vacated the Section 3252 designation as arbitrary and beyond the statute, vacated the order barring military contractors from commercial activity with the company, and permanently enjoined most named agencies from giving them effect. “Vacated” means the court wiped those actions off the books.

On September 25, a divided D.C. Circuit panel upheld the separate designation under the Federal Acquisition Supply Chain Security Act, with further review still possible. Law firm alerts noted that, as of late September, no order under that act naming the company appeared in SAM, the official registry contractors are required to check.

By October 2026, one instrument had been set aside and another upheld. Organizations that had scoped by instrument, reach and use could treat each ruling as a change to a register: update a line, adjust the affected boundary, record the decision. Those that had reacted to the first headlines were left over-complying or unsure what they had changed.

Three conclusions follow. First, the distinction between a statement and a binding instrument separated a response that could follow the courts from one that could not. Two courts reached different conclusions about two different instruments, and only organizations that had kept them separate could act on both results.

Second, the AI dependency register outlived the dispute. The same list of tools, providers, contracts and off-switches answers questions about data handling, security incidents and any future supplier exclusion. Organizations that built it under pressure in March now own an asset; those that did not are still exposed to the next surprise.

Third, AI providers are now suppliers like any other, subject to political, legal and commercial shocks. Treating model choice as a supply chain decision, with an exit plan, is ordinary prudence.