I'm not sure that "supply chain risk" is even the right term to be discussing.

What Hegseth/Trump want to do is not just stop Anthropic models from being used by any military supplier pursuant to goods/services they are providing to the military, but rather say that if you do business with the military then you must not use Anthropic at all, even if that usage is entirely unrelated to your military contracts.

This is explicitly not what they have done, not how government contractors ever interpret this designation, nor something they could do even if they wanted to do.

It is also common corporate doctrine to use a subsidiary for government contracting to avoid having to evidence that a commercial vendor is utilized for government, so this won't even be 'annoying' for contractors.

ITAR and compliance frameworks (e.g. FedRAMP and CMMC) already mandate this for any non-US company, yet AWS commercial still has offerings in other countries and from non-US vendors, Palantir still has an IG business, etc.