Under Section 4713, Congress defined "supply chain risk" in substantially broader terms. Rather than restricting risk to actions taken by a recognized "adversary," Title 41 expands the scope to encompass risks posed by "any person."
Specifically, Section 4713 defines supply chain risk as "the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement" of covered technology products or systems.
Furthermore, the statute specifies that such risk applies whenever an action could be taken "so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of" those products or the sensitive information stored on or transmitted through them.
The appellate court noted that by replacing the word "adversary" with "any person" and expanding the list of covered actions to include non-adversarial manipulations, data extractions, and operational disruptions, Congress intentionally created a legal framework under Section 4713 that does not depend on demonstrating bad faith, hostile origin, or malicious intent on the part of the technology developer.
Broader Implications for Technology Procurement
The D.C. Circuit’s ruling establishes an important legal precedent regarding executive branch authority over federal technology procurement and risk management. By confirming that Section 4713 does not require proof of an adversarial motive, the ruling provides federal procurement officials with a powerful regulatory tool to restrict software, artificial intelligence systems, or hardware components based on structural, operational, or systemic risk factors alone.
Under the appellate court’s interpretation, federal agencies acting under Title 41 do not need to prove that a technology vendor actively intends to harm government operations or that the vendor operates as an agent of a hostile foreign power. Instead, agencies can evaluate supply-chain risk based on the potential operational vulnerabilities, data extraction risks, or functional manipulations that could arise from deploying a particular technology within government networks.
The ruling also highlights the structural importance of Congress’s decision to concentrate legal review of Section 4713 procurement designations exclusively within the D.C. Circuit. By channeling legal challenges through a single appellate venue, the framework ensures consistent judicial interpretation of civilian federal procurement designations, preventing contradictory rulings across disparate federal district courts nationwide.
While Anthropic successfully demonstrated in the Northern District of California that it harbored no bad motive or adversarial intent under the defense-specific standards of 10 U.S.C. § 3252, the D.C. Circuit’s decision confirms that the federal government’s broader authority under 41 U.S.C. § 4713 remains legally viable. The decision leaves the executive branch with robust statutory backing to maintain supply-chain risk restrictions under civilian procurement law, illustrating the high degree of deference federal courts accord to agency risk assessments when grounded in broad statutory definitions enacted by Congress.
