The Global AI Governance Vacuum: Pentagon Overreach vs EU Underreach

US Government Overreach: Pentagon Supply-Chain Designation

Judge Rita F. Lin issued a 43-page preliminary injunction on March 26 blocking the Department of Defense's supply-chain risk designation against Anthropic. The ruling found the DOD's action likely violated First Amendment rights, denied due process, and exceeded statutory authority. Anthropic was the first American company ever designated a supply-chain risk under 10 U.S.C. SS 3252 — a statute previously applied only to foreign adversaries like Huawei and ZTE.

The underlying dispute reveals the core tension: the DOD demanded Anthropic remove two contractual guardrails prohibiting Claude's use for autonomous weapons and domestic mass surveillance. When Anthropic refused, the government retaliated by using procurement authority as a coercion tool.

Judge Lin's ruling explicitly cited evidence that Anthropic's risk level was escalated because the company was engaging in an 'increasingly hostile manner through the press.' The judicial language is direct: 'Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government.' This establishes legal precedent that AI companies can maintain safety restrictions without government retaliation through procurement authority.

The ruling's significance extends beyond Anthropic. 30+ employees from OpenAI and Google DeepMind filed public statements supporting Anthropic's position — signaling industry-wide consensus that AI safety restrictions are professionally defensible and legally protected speech. The APA 'arbitrary and capricious' finding constrains the DOD's ability to use supply-chain designations as general procurement leverage.

EU Government Underreach: Enforcement Infrastructure Missing

On the opposite side of the Atlantic, the EU's regulatory infrastructure is failing through inaction rather than overreach. As of March 2026, only 8 of 27 member states have designated single contact points for AI Act enforcement — a requirement due August 2, 2025. This means most countries are 7+ months past the mandatory deadline. Only Finland has fully operational AI Act enforcement powers.

The cascade of missed deadlines compounds the failure: Technical standards bodies CEN/CENELEC missed their 2025 publication deadline. The European Commission missed its February 2026 deadline for high-risk AI classification guidance. The Digital Omnibus proposal (November 2025) would delay high-risk AI system obligations to December 2027 or August 2028 — effectively acknowledging the enforcement infrastructure cannot be ready.

This creates a potential 19-month gap where the law exists on paper but cannot be enforced in practice. Companies can technically violate the AI Act without consequence because the Member States charged with enforcement have not established the institutional capacity to detect or prosecute violations.

The Real-World Consequences of the Governance Vacuum

Meta's rogue agent incidents provide the real-world demonstration of what happens in this governance vacuum. Two incidents in one month at one of the world's most security-conscious companies — neither prevented by existing regulation, neither addressed by the governance frameworks that are supposed to be operational.

The companies most committed to self-governance (Anthropic's guardrails) face government hostility in the US. Meanwhile, companies deploying agents without adequate security face no enforcement in the EU. The governance vacuum is not theoretical — it is actively producing harm in real time.

The paradox is sharp: Anthropic wins legal protection for voluntary safety measures at the same moment that the industry's agent security incident rate accelerates. The judge's ruling protects the company's right to safety guardrails; it does not ensure that competitors adopt similar restrictions.

De Facto Governance: Industry Self-Governance Stepping In

In the absence of functional regulatory frameworks, industry standards bodies are assuming governance responsibility by default. Anthropic's governance position via the Linux Foundation's Agentic AI Foundation gives it outsized influence over agent security standards. IEEE and ISO working groups are beginning to define AI safety baselines.

This is not ideal governance — companies should not be writing the regulations that govern themselves. But the alternative (no governance at all) is worse. Until regulatory frameworks become functional, industry consensus is the only enforcement mechanism available.

What This Means for Practitioners

AI companies maintaining voluntary safety restrictions now have legal precedent protecting them from government coercion. The Anthropic ruling establishes that safety guardrails are legally protected speech and cannot be used as justification for government retaliation through procurement authority.

ML engineers at companies serving government clients should understand that safety guardrails are legally defensible. Do not let government procurement pressure override your professional judgment about responsible AI deployment.

EU compliance investment can be rationally delayed given enforcement uncertainty, but companies should track the Digital Omnibus timeline closely. When enforcement eventually arrives (likely 2027-2028), it will arrive suddenly. Organizations that have not prepared compliance infrastructure by then will face rapid remediation costs.

Expect industry self-governance frameworks to fill the governance vacuum within 12 months. Watch the Linux Foundation AAIF, IEEE, and ISO working groups — the standards they produce will become de facto regulatory requirements simply because no other enforcement mechanism exists.