Anthropic Prevails On Claims In The Northern District Of California

A federal district court in California ruled that the U.S. government violated Anthropic’s free speech and due process rights when it labeled Anthropic a supply chain risk in response to Anthropic speaking out about AI policy and refusing to allow certain uses of its products for military purposes. The court’s decision should give comfort to AI vendors, and federal contractors more broadly, that they don’t leave their free speech and due process rights at the door when negotiating deals with the government. But it’s not the final word, as the government may appeal this decision and there is another pending case in the U.S. Court of Appeals for the D.C. Circuit where the court may reach the opposite conclusion. In fact, the D.C. Circuit already denied Anthropic’s emergency motion to stay the supply chain risk designation, citing deference to military decisions during an active conflict with Iran.

Background

The government’s dispute with Anthropic concerns the company’s product Claude Gov, which is a large language model based on Claude but with additional limits on Anthropic’s access to the model. For example, the commercially available Claude can be monitored by Anthropic in real time, and Anthropic may intervene if harmful activity is detected. Claude Gov records risks, but Anthropic cannot access it nor intervene. Claude has a usage policy where users agree not to use Claude for “applications for which Claude has not been developed or is not ready,” but for Claude Gov, and specifically for the Department of War (DoW), there are fewer limitations. One limitation in the period leading up to the dispute was that Claude Gov may not be used for “mass surveillance of Americans and lethal autonomous warfare.” 

In fall 2025, stretching into early 2026, the DoW insisted that Anthropic change its terms concerning mass surveillance and lethal autonomous warfare. The DoW began to insist that Claude must allow the DoW, and its contractors and subcontractors, to use Claude Gov “for all lawful uses.” Claude—through its CEO, Dario Amodei—objected, reasoning that as a tool, AI could lead to untold levels of information on Americans if used for mass surveillance and that Claude Gov could not carry out “lethal autonomous warfare” reliably enough given the extreme consequences of a mistake. The court characterized the negotiations over the limit as respectful, and Anthropic even offered to assist in offboarding Claude Gov from DoW systems. 

Amodei also went public with his concerns. In January 2026, he published an essay addressing the risk of using AI for surveillance or autonomous weapons and advocated for “red lines” on these topics. At a meeting in February, Secretary of DoW Pete Hegseth did not voice concerns about Claude Gov being “unsafe, insecure, or subject to compromise,” but he did raise objections to Anthropic’s proposed limitations. He noted that if Anthropic would not agree to the government’s formulation of “all lawful uses,” the DoW would designate Anthropic a supply chain risk and prevent anyone affiliated with the government from partnering with Anthropic. Secretary Hegseth also stated that the DoW may invoke the Defense Production Act, which would compel Anthropic to provide Claude Gov without restriction. After that meeting, Amodei issued a public statement for Anthropic defending its restrictions and stated Anthropic would not comply with the request. 

The next day, the President issued a statement on Truth Social, in which he directed every federal agency to cease using Anthropic. He also stated Anthropic was putting “AMERICAN LIVES at risk, our Troops in danger, and our National Security in JEOPARDY.” Secretary Hegseth also issued a statement on X, where he directed the DoW to designate Anthropic a supply chain risk and stated “[e]ffective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic.” While this was ongoing, Amodei continued to work with employees at the DoW to try to work out the dispute over the limitations. Additionally, the government expressed interest in using a new and vastly more powerful model from Anthropic, Mythos, for cyber security and other applications throughout the government. 

Anthropic promptly sued the federal government in both California and D.C. federal courts to enjoin these orders, arguing that the orders violated its freedom of speech and due process rights and that the government failed to follow governing administrative procedures.

The California decision 

The California court broke down these government actions into three challenged actions: (1) the President’s order that all agencies using Anthropic products cease doing so; (2) Secretary Hegseth’s directive to government contractors to refrain from dealing with Anthropic; and (3) the designation by the federal government of Anthropic as a supply chain risk. The court then ruled these actions violated Anthropic’s First Amendment free-speech protections and Fifth Amendment due process rights, and that the government failed to comply with the Administrative Procedures Act.

Starting with the First Amendment right to freedom of speech, to prove a violation, Anthropic had to show that “(1) it engaged in constitutionally protected activity; (2) the defendant’s actions would ‘chill a person of ordinary firmness’ from continuing to engage in the protected activity; and (3) the protected activity was a substantial motivating factor in the defendant’s conduct.” The court found Anthropic had proved all three of these elements. 

First, it agreed Anthropic had engaged in constitutionally protected speech. It rejected the government’s position that speech related to contract negotiations was not protected, noting that speech related to contract negotiations may give rise to issues of public importance, which is in the heartland of protected speech. It also found the government’s conduct could have a chilling effect, pointing to amicus briefs submitted by various individuals and organizations that noted a hesitancy to engage in the debate over the future of AI. And it found the government’s action was clearly meant to punish Anthropic’s speech, which is impermissible.

That finding shifted the burden to the government to show that it would have taken the action regardless of Anthropic’s speech. It failed to meet that burden. The court found the government’s conduct was specifically targeted at Anthropic’s “rhetoric and ideology,” not its products or contract negotiations. It also rejected the government’s arguments that its actions were contractual in nature, reasoning that the actions against Anthropic—such as designating it as a supply chain risk—were “an exercise of sovereign power, not contractual power,” because they “extend far beyond the limited scope of preparing to terminate a government contract.” 

Second, turning to Anthropic’s due process claims, the court ruled that Anthropic had a protected liberty interest that had been violated. A plaintiff has a liberty interest protected by due process if they demonstrate reputational harm and the denial of a benefit to which they have some legal right. The court ruled Anthropic was stigmatized by the government’s actions, including the social media posts by the President and Secretary of War that labeled Anthropic a threat to national security. It rejected the government’s argument that the lack of stigma was demonstrated by Anthropic’s revenue growth, finding any reasonable person would conclude that a label from top government officials as a threat to national security or an adversary would put the target’s good name at stake. And it found that Anthropic was deprived of a benefit to which it had a legal right: in this case, its existing government contracts and the right to be considered for additional government contracts. 

After finding Anthropic had a protected liberty interest, the court easily concluded that due process was not provided, as the challenged actions were taken without “any meaningful notice or pre-deprivation process.” The court further found a serious risk of an erroneous deprivation, which was proven because the government’s stated reasons for the need to act quickly were based on a misunderstanding about how Anthropic’s AI models work. That is, the government wrongly assumed Anthropic could modify its models after implementation, which was untrue. 

Third, Anthropic also prevailed on its APA arguments for the final two challenged actions. The court reasoned that the directive from Secretary Hegseth prohibiting any government contractors from working with Anthropic was a final agency action, and the government conceded there was no statutory authority that could support the directive. The court concluded Secretary Hegseth’s order to designate Anthropic a supply chain risk was also unlawful, reasoning that Anthropic was not, as the statute requires, a “potential adversary” of the United States. The court also discussed several alternative holdings, including that the government failed to follow the proper procedures for such a designation and that the reasons provided were insufficient to survive arbitrary and capricious review. At base, the court held the government’s proffered justifications for the designation as a national-security risk were pretextual, and that instead the government sought to punish Anthropic for its public disagreements with the administration’s handling of AI.

After reaching a conclusion on the merits, the court granted Anthropic injunctive and declaratory relief and vacated the challenged actions. 

What it means

The Anthropic ruling demonstrates that even in matters of national security, where the government is afforded maximum deference, there are still meaningful guardrails to prevent unlawful acts. A few key points for AI companies (and all federal contractors) to bear in mind:

1. Businesses should generally be able to safely speak about government practices and public policy, even if they are in the midst of negotiations with the government. But this does not mean contractors have carte blanche to discuss specific contracts or material subject to confidentiality agreements, or that doing so is wise even if it is legal.
2. Merely insisting on limitations in how a product is used, such as by requiring contractual limits and built-in technical guardrails, does not make a company a supply-chain risk. But those guardrails do need to be open to the government customer.
3. The government should not be able to defame a contractor, terminate its contracts, and exclude it from contracting based on the company’s policy perspective, and certainly not without due process. But the bar may be much lower for non-U.S. companies or companies with non-U.S. ownership.

It’s also important to bear in mind that the California ruling will likely be appealed to the Ninth Circuit Court of Appeals, and there is a similar action pending in the D.C. Circuit Court of Appeals, where the judges seemed at least initially more sympathetic to the administration’s point of view. If the government wins in Washington, D.C., then it may not matter what happened in California, unless the Supreme Court were to step in. We will continue to monitor these cases and keep you updated. Please reach out to our Artificial Intelligence and Litigation and Public Procurement practice groups for more information.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.