Compliance Alert · Status as of October 12, 2026
Using Claude on defense work?
Check your contracts.
The Department of War directed the removal of Anthropic products from its systems and the incorporation of restrictions into defense contracts. Then the courts split the outcome — and the headlines stopped telling the whole story. What you're actually bound by is narrower than the loudest version, and it depends entirely on your contracts.
We're not attorneys, and this page is not legal advice. It is a plain-English map of the public record, so your conversation with your contracting officer and counsel starts in the right place.
What happened
Eight months, two courts, one split decision
February 27, 2026 — The announcements
Public posts directed federal agencies to stop using Anthropic, and stated that no contractor doing business with the military may conduct "any commercial activity" with Anthropic. Those posts were not legal instruments — and that broad "no business at all" framing was later walked back in litigation and permanently blocked by a federal court.
March – April 2026 — The formal directives
The Secretary issued formal determinations under two different laws (10 U.S.C. §3252 and FASCSA, 41 U.S.C. §4713). The DoW CIO ordered Anthropic products removed from all DoW systems within 180 days — restarted by a second memo on April 2, setting a September 29, 2026 compliance deadline.
May – July 2026 — Flow-down hits contractors
Component implementing orders (the Air Force's among them) directed contractors to inventory all Anthropic products and services in their systems, remove them, and provide written compliance statements to their contracting officers. Some of these requests swept more broadly than the underlying rule — a pattern attorneys are still flagging.
August 27, 2026 — A federal court blocks the broad version
A federal district court permanently enjoined the §3252 supply-chain designation and the "no business with Anthropic at all" directive. What the government conceded in that litigation matters: the restrictions do not reach commercial work, other-agency work, or general-license use outside DoW contract performance.
September 25, 2026 — An appeals court upholds the narrow version
The D.C. Circuit upheld (2–1) the separate FASCSA exclusion. This is the operative rule today: where the clause is actually in your contract, Anthropic products may not be used in the performance of that contract. Further review remains possible — this is a live, moving situation.
What's actually binding
The rule is narrower than the headline
- !Prohibited: using Anthropic products as part of the performance of a DoW contract that contains the restriction clause (added by solicitation amendment or contract modification).
- ✓Not prohibited: commercial work, work for civilian agencies, and other non-DoW business — the government said so on the record in litigation.
- ?Gray zone: back-office and enterprise tools, and third-party software with Claude embedded inside it. Attorneys read the rule as not reaching these by itself — but many primes and contracting offices are asking for more than the rule requires.
That last gap is the real risk: certification requests landing in contractor inboxes don't always match the legal scope — and a written compliance representation that's broader than your facts is its own liability. Verify before you sign.
Before you certify anything
Four questions for your contracting officer
- 1Which contract(s) does this notice apply to?
- 2Which clause is being invoked — FAR 52.204-30, DFARS 252.239-7018, or neither?
- 3Is that clause actually in the contract — and as of what date?
- 4Does the notice's scope match the clause's scope, or is it broader?
Get the answers in writing, review them with counsel, and only then make a compliance representation.
Free contractor research packet
Get the source documents — not the headlines
We assembled the packet your compliance team actually needs:
- ✓The DoW CIO memorandum directing removal of Anthropic products from DoW systems.
- ✓A component implementing order showing how the directive reaches contractors — deadlines, written compliance statements, and all.
- ✓The Lionfish compliance briefing — full timeline, court status, which authority survived, the clause map (FAR 52.204-29/-30, DFARS 252.239-7017/-7018), the SAM.gov check, and the questions to ask before certifying.
Tell us where to send it. We'll email the packet, and if you want help applying it to your contracts, the Readiness Briefing is free and thirty minutes.
While you're checking
Your other obligations never moved
The CMMC Phase II suspension did not erase existing DFARS requirements. If you handle CUI, you must still implement the applicable safeguards, keep the documentation, and report your assessment results accurately.
The regulation's words: "The artifacts used as evidence for the assessment must be retained by the OSA for six (6) years from the CMMC Status Date." — 32 CFR § 170.16(c)(4). OSA is the Organization Seeking Assessment — that's you, the contractor. Underneath it, § 170.24(b)(1) allows a requirement to be assessed MET only when evidence supports every applicable objective. (A basic NIST SP 800-171 score posted to SPRS under DFARS is a distinct process — the six-year CMMC retention provision attaches to CMMC self-assessments.)
The Rapid Deployment Readiness Briefing — free
Thirty minutes. Straight answers.
We'll review where Claude and other AI tools sit in your environment, what your contracts and evidence actually support, and what needs attention to meet your DFARS and CMMC commitments — even if you never hire Lionfish.
Lionfish Cyber Security is an independent cybersecurity compliance firm. We are not affiliated with Anthropic, PBC or the Department of War, and nothing on this page is legal advice. Directives, court rulings, and contract clauses change — your contracts, applicable orders, and modifications control. Review the written requirements with your contracting officer and legal counsel before making any compliance representation. Status reflected here is as of October 12, 2026.