How a Federal Supply-Chain Exclusion Reaches Your Project Calendar: 41 U.S.C. 4713 and the Bid-Protest Clock, in Days

Updated September 28, 2026. Every date, day count and statutory number below was read on that day from the primary sources listed at the end — the court's own opinion, the U.S. Code, and the Federal Acquisition Regulation. No vendor pricing or product benchmark is quoted here.

The Pentagon, May 15, 2023. Photo: U.S. Department of Defense via Wikimedia Commons, public domain.

An exclusion order is not a product review. It is a calendar. When a federal agency decides that a particular vendor may not sit in its supply chain, the thing that lands on an engineering team is not an opinion about model quality — it is a set of deadlines measured in days, and a set of work steps that have to happen inside those deadlines. This piece takes one real dispute, pulls the day counts out of the two statutes that govern it, and converts them into a single team's schedule.

The answer changed between August and September

The earlier version of this article reported a court win. That was accurate for August. It is no longer the current state of the dispute, and the correction matters more than the original headline did.

Date	Forum	Authority applied	Outcome
Aug 2026	N.D. California	10 U.S.C. § 3252	Earlier military designation set aside
Sept 25, 2026	D.C. Circuit, No. 26-1049	41 U.S.C. § 4713 (FASCSA 2018)	Petitions for review denied

In Anthropic PBC v. United States Department of War, No. 26-1049, decided September 25, 2026, the D.C. Circuit denied the petitions for review. Judge Katsas wrote for the majority, Judge Rao was on the panel, and Judge Henderson dissented. The majority held that a company's ability and willingness to restrict what an AI system can do can itself count as a covered supply chain risk under the procurement statute, without evidence of malicious intent. The court also explained why the earlier California ruling did not control: that case turned on the narrower standard in 10 U.S.C. § 3252, a different statute with a different test.

So two courts reached different results on the same underlying facts, and both can stand, because they were reading different statutes. That is the single most useful thing in the whole dispute for anyone planning a federal project: the statute cited in the notice tells you which test applies, and therefore which deadlines you are on.

What the procurement statute allows, in days

41 U.S.C. § 4713 is short, and almost all of its operative content is a schedule. Read directly from the U.S. Code:

Provision	Number	What it constrains
Written notice to the named source	required	Must describe the recommendation, the basis for it (consistent with national security), and how to submit opposing material
Time to submit opposing information	30 days after receipt of notice	The vendor's only guaranteed written window before the order
Urgent-circumstances exercise	within 60 calendar days of the determination	Lets the agency act first and paper it after
Notice to Congress	within 7 calendar days of the action	The earliest external record that an action happened
Review of determinations	not less frequently than annually	An order is not automatically permanent
Delegation floor	no lower than one level below Deputy Secretary / Principal Deputy Director	Signals how senior the sign-off has to be

The statute's own definition of supply chain risk is the risk that a person may "sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate" a covered article. The September ruling reads the final clause — "otherwise manipulate" — broadly enough to cover capability restrictions imposed by the vendor. Whether that reading is right is what the dissent disputes; either way, it is the reading now in force in that circuit.

The protest clock is a different calendar entirely

If your team's exposure is not an exclusion order but a contract award that someone challenges, you are on the bid-protest schedule in FAR 33.104. Those numbers are tighter and they are the ones that actually move delivery dates:

Step	Deadline	Effect on work
Copy of protest to the contracting officer	no later than 1 day after filing with GAO	Starts the agency's clock
Automatic suspension of performance	protest notice within 10 days of award, or 5 days after a debriefing date	Work stops. The contracting officer suspends performance or terminates the award
Agency report to GAO	30 days (or 20 days under the express option)	No delivery activity in the meantime
Comments on the report	10 days (5 days express)	Legal work, not engineering work
GAO recommendation	100 days from filing (65 days express)	The outer bound of the pause
Cost claim, if you prevail	60 days after the recommendation	Recovery is a separate filing with its own deadline

One hundred calendar days is roughly 14 weeks, or about 71 working days. The express option cuts it to 65 days, about 46 working days. Those two numbers are the difference between a slipped quarter and a slipped half-year.

Converting it to one team's schedule

Here is the scenario that turns the statute into engineering time. Take a six-person integration team on a twelve-month task order, delivering a document-processing pipeline that depends on one commercial AI vendor. Suppose the award is protested on day 6 after award — inside the 10-day window, so the automatic suspension applies.

Calendar day	What happens	Engineering effect	Engineer-days consumed
0	Award	Onboarding, environment access requests	6 × 4 = 24
6–7	Protest filed; copy reaches the CO within 1 day	Suspension issued; work stops	0 billable delivery
7–36	Agency report period (30 days)	Team idle or redeployed; environment credentials often expire	0
36–46	Comments period (10 days)	Still stopped	0
up to 106	GAO recommendation (100 days from filing)	Restart: re-provision access, re-baseline the schedule	6 × 3 = 18 (pure rework)

Two things fall out of that table. First, the delivery schedule loses about 3.3 calendar months on a 12-month order — a little over a quarter of the period of performance — without a single line of code being wrong. Second, the measurable cost is not the pause itself but the 42 engineer-days at the two ends: 24 spent on onboarding that has to be partly redone, and 18 spent re-provisioning and re-baselining. Teams routinely budget for the pause and forget the restart.

If the exposure is an exclusion order rather than a protest, the shape is different: there is no automatic suspension, but there is a 30-day written window for the vendor, an annual review that can change the answer later, and — because Congress must be told within 7 days — an external signal that something happened, often before the customer tells the contractor anything.

Tip: Deadlines like the 10-day and 5-day windows above are the kind that get missed in a chat thread. Teams that track them on a shared physical calendar rather than only in a ticket queue tend to catch them, and a plain desk calendar planner is enough for a six-person team. (These are Amazon Associate links — we may earn a small commission on qualifying purchases.)

Two statutes, two answers, and how to tell which one you are on

The cheapest defensive step is also the least technical: read which statute the notice cites. A designation under 10 U.S.C. § 3252 and an exclusion under 41 U.S.C. § 4713 are not interchangeable, and the September ruling exists precisely because they are not. A team that assumes the California outcome applies to a § 4713 order will plan around a test that no longer governs.

Where do the sources actually conflict? The majority and the dissent in No. 26-1049 disagree about how far "otherwise manipulate" reaches — whether a vendor's self-imposed capability limits are a supply chain risk at all. This article does not take a side on that. It is worth noting which way the cheaper error runs: designing a pipeline so that the vendor can be swapped costs engineering time up front, while assuming the vendor cannot be excluded costs the whole 100-day pause plus the restart if it is.

What a team can do before any of this lands

1. Record the statutory citation in every notice, debriefing letter and modification. It determines which test and which clock apply.
2. Calendar the 10-day and 5-day windows at every award and debriefing. They are the only path to an automatic suspension, and they are short.
3. Assume the outer bound: plan for 100 days, not for the express option's 65. The express option is not yours to choose.
4. Budget the restart separately from the pause — in the scenario above it was 18 engineer-days.
5. Keep credential and environment provisioning documented so re-provisioning after a stop is a checklist, not a rediscovery.
6. Note the annual review in § 4713: a designation that blocks a vendor this year is reviewed, and the answer can move.

What this article could not confirm

The specific contracts, dollar values or delivery orders affected by the September ruling are not stated in the opinion and are not asserted here. Nor is the internal record behind the designation, which the statute allows an agency to withhold consistent with national security. The engineer-day figures in the scenario table are arithmetic on stated assumptions — six people, a twelve-month order, four days of onboarding and three days of restart each — not measurements of any real contract. Any number that depended on a vendor's pricing was left out entirely.

Related reading on this blog

• When rights holders sue an AI developer: what the filings actually claim
• Entry-level tech hiring, measured against published data

Sources

• U.S. Court of Appeals for the D.C. Circuit, Anthropic PBC v. United States Department of War, No. 26-1049 (decided September 25, 2026) — disposition, panel, the § 4713 holding, and the distinction from 10 U.S.C. § 3252.
• 41 U.S.C. § 4713 — 30-day response window, 60-calendar-day urgent exercise, 7-day notice to Congress, annual review, delegation floor, definition of supply chain risk.
• FAR 33.104, Protests to GAO — 1 day, 10 days after award, 5 days after debriefing, 30/20-day agency report, 10/5-day comments, 100/65-day GAO recommendation, 60-day cost claim.

This article summarizes public court and regulatory documents and performs arithmetic on stated assumptions. It is not legal advice and is not a substitute for counsel on a specific procurement. Jurisdiction is the United States federal system; effective dates are as stated above. Deadlines in FAR 33.104 and 41 U.S.C. § 4713 can be amended, and agency practice varies.