AI Act and US Defense: What the D.C. Circuit Decision Changes

25 September 2026, before the D.C. Circuit

On 25 September 2026 the Court of Appeals for the District of Columbia Circuit decided case No. 26-1049. The docket is consolidated with case No. 26-1162.

The petitioner is Anthropic PBC. The respondents are the United States Department of War and Peter B. Hegseth, in his official capacity as Secretary of War. Oral argument was held on 19 May 2026, according to the text of the decision published by CourtListener^[1].

Jurisdiction is United States federal, at the appellate level.

The caption identifies the procedural route in precise terms: «On Petitions for Review of an Agency Action of the Department of War». Kelly P. Dunbar argued for the petitioner. Sharon Swingle, of the Department of Justice, argued for the government.

On 25 September 2026 CNBC^[2] also reported on the appellate proceeding between the Pentagon and the company.

From contract to administrative act

Until this point, the relationship between a frontier model provider and a public-sector customer was read as a contractual matter. Usage clauses, terms of service, negotiated remedies: the grammar was that of procurement.

A petition for review of agency action changes the register.

It asks the court to scrutinise the government's conduct under the standards of federal administrative law. The act becomes the pivot, in place of the promise. A claim of this kind requires a final agency action, a petitioner with standing, and a deadline met.

The practical consequences are immediate. The court looks at the agency record, the reasoning behind the act and compliance with procedure.

The provider thereby enters a public proceeding, with briefs available for inspection and reasoning capable of guiding future cases. For the compliance function this produces a new effect: a record that third parties can cite, outside the confidential perimeter of the contract.

The coalition that wrote to the court

The caption lists more than fifteen amicus curiae briefs in support of the petitioner. The composition of that group says a great deal about the nature attributed to the dispute.

• 149 former judges together with the Democracy Defenders Fund
• American Civil Liberties Union and Center for Democracy and Technology
• Former Secretary of Defense Leon Panetta with the Institute for Security and Technology
• Former Service Secretaries and retired general officers
• OpenAI and Google employees in their personal capacity
• Industry associations, the Foundation for American Innovation, Professor Alan Z. Rozenshtein

The figure of 149 former judges appears in the filed text. It is a number that measures the institutional weight attributed to the question, beyond the commercial interest of the parties.

Filing a brief carries a real legal cost. An alignment that brings together civil liberties organisations, retired military leadership, moral theologians and business associations points to constitutional stakes.

The briefs in support of the petitioner are numerous in the caption. This element describes the mobilisation, and remains distinct from the merits of the decision, which depend on the court's reasoning.

For a board, the useful signal is a different one: the relationship between an AI vendor and a federal department becomes a matter of public adjudication, with a record, deadlines and a judge.

The governance signal

The governance signal is this: the usage policy of a frontier model toward a government customer has entered an appellate courtroom as a question of administrative law.

Until yesterday that subject lived in two confidential places: the contract and the negotiation. Now it also lives in a court record.

For companies selling compute capacity and models to the public sector, the perimeter changes. Terms of use become documents with evidentiary significance in litigation. Their genesis, their version and the date of their adoption acquire probative value.

Here the underlying question of every framework returns: which named role inside the organisation answers for the usage policy applied to public-sector customers, by name, in writing, before deployment?

A control environment calibrated to contractual risk is now mis-tuned to the new context. The audit remains necessary; its perimeter changes. Legal functions that keep a version register for their policies cut the response time to a discovery request.

The European Union keeps defence outside the AI Act

Regulation (EU) 2024/1689, known as the AI Act, has been in force since 1 August 2024.

Article 2(3) excludes from its scope AI systems placed on the market or used exclusively for military, defence or national security purposes. The same question brought before the D.C. Circuit falls, in Europe, outside the regulation.

What remains is procurement law, national security law and the rules of individual Member States.

The European timetable for the rest of the perimeter proceeds in stages.

• Prohibitions applicable from 2 February 2025
• Obligations on general-purpose models from 2 August 2025
• High-risk regime applicable from 2 August 2026

The Digital Omnibus proposal, presented by the European Commission in November 2025, is still under negotiation. The text would push the high-risk obligations back to December 2027.

The comparison between the two jurisdictions produces an asymmetry worth putting on the record. In the United States the matter enters a courtroom by the administrative route. In Europe defence remains excluded from the text, and governance of military use depends on other instruments.

Organisations operating on both sides of the Atlantic keep two separate maps, with two lists of competent authorities.

The two available readings

A first reading sees in this development a broad principle: a federal department's choices on the use of frontier models become reviewable by the administrative route.

A second reading confines the effect to the specific case. The reach of an appellate decision depends on its reasoning, on the act challenged and on the administrative record.

This publication presents both readings and refrains from anointing one as correct. The full text of the opinion remains the only reference for measuring the breadth of the principle.

The US procedural framework then provides further avenues: a petition for panel rehearing, a request for en banc review, a petition for certiorari to the Supreme Court. A prudent board treats the principle as settled only once these steps are exhausted.

Until then the operational value of the ruling lies in the method rather than the holding: the administrative route works as the forum for this dispute. Risk functions updating the matrix are now working from a documented scenario rather than a forecast.

Three decisions for the board

The useful sequence starts with the General Counsel and ends at the risk committee.

1. Map usage policies as documents with evidentiary significance

The General Counsel checks which terms of use govern the public-sector contracts in force, with version, adoption date and the role that approved them. A version register turns a discovery request into a document-retrieval exercise. The absence of that register produces an after-the-fact reconstruction.

2. Add an «administrative litigation» line to the risk matrix

The Chief Risk Officer separates contractual risk from the risk of judicial review of a public act. These are two different exposures, with different timelines, counterparties and costs. A matrix that keeps a single line understates the second. Companies with revenue from public-sector customers quantify the exposure per contract and per jurisdiction.

3. Define the disclosure to the audit committee

The audit and risk committee decides what information enters periodic reporting: pending litigation with public-sector counterparties, usage policies applied to government customers, revenue dependence on public contracts. The CEO finds the strategic constraint here: choosing public-sector markets brings with it a regime of public exposure.

Regulatory horizon

Current status: the D.C. Circuit decision is dated 25 September 2026, following oral argument on 19 May 2026. The case is No. 26-1049, consolidated with No. 26-1162.

Jurisdiction: United States, federal court of appeals for the District of Columbia Circuit. Subject matter: review of agency action against the Department of War.

On the European side, Regulation (EU) 2024/1689 remains in progressive implementation, with defence excluded from its scope under Article 2(3). The Digital Omnibus proposal remains under negotiation.

Dates already reached include 2 August 2026 for the European high-risk regime. The next deadline set by the regulation falls on 2 August 2027, for high-risk systems embedded in the products listed in Annex I.

The question of where this dispute belongs has been answered. A second question has opened: which standard of review governs the merits.