Written by: Wiktor Stefański, Head of People & Operations, Digital Colliers
A federal judge has vacated the Trump administration's designation of Anthropic as a supply-chain risk. That single ruling changes the advice you gave a federal client last quarter, this quarter, and possibly next week. If your matter files still store vendor risk status as a static field, you're already behind the reader who built a versioned model six months ago.
This isn't a hypothetical. Vendor status on federal AI procurement is now a moving target with real litigation attached. The firms that will be pulled into the next round of advisory work are the ones who can answer, on demand, what a vendor's status was on the exact date advice was given, and what changed since.
The ruling and why it matters for advisory work
The court's vacatur doesn't just clear Anthropic. It sets a pattern. Executive-branch designations of AI vendors can be challenged and reversed, sometimes quickly, and the timing of a designation matters as much as its existence. That's a data problem before it's a legal one.
If you advised a federal contractor in July that a given model provider was off-limits, and that designation is vacated in November, you need three things at your fingertips: the memo you wrote, the vendor status snapshot on the memo date, and the delta between then and now. Most matter management systems will give you the first. Very few give you the second and third without a paralegal opening ten tabs.
Matter-level vendor status, not annual reviews
The annual vendor risk review is a relic of pre-2023 procurement. In 2024 alone, court cases involving AI-fabricated citations went from 87 to over 1,300 in eleven months. The pace of AI-related legal events is not slowing, and vendor status is downstream of that pace.
What a matter-level model actually looks like, in plain terms:
- Every vendor gets a status record keyed to a date range, not a current-value field.
- Every matter references vendor statuses by the date advice was rendered, not by whatever the row says today.
- Status changes (designations, vacaturs, settlements, procurement guidance updates) create new records, never overwrite old ones.
- A vendor status query always answers two questions: what was true then, and what is true now.
This is basic temporal data modelling. It's the same shape that financial services firms use for point-in-time reporting. Legal has largely skipped it because vendor lists used to change once a year. That era is over.
What regulators would expect if pressed
The UK Solicitors Regulation Authority issued its AI guidance in November 2023, and the direction of travel is clear: solicitors are responsible for the tools they use and the advice they give on those tools. The ABA's Formal Opinion 512, issued in 2024, tightened this further in the US, and while it focuses on billing, the underlying principle is the same. You own the provenance of your advice.
If a regulator or a client asks why you told them Vendor X was blacklisted on a date when the designation was already under judicial review, the acceptable answer is a timestamped audit trail. The unacceptable answer is a Word document nobody's opened since June.
A few things regulators tend to look for, based on published guidance patterns:
- Evidence that advice was based on the vendor status current at the time.
- A documented process for monitoring status changes on active matters.
- A defined trigger for reissuing advice when status changes materially.
- Retention of prior status records long enough to defend historical advice.
None of this requires new software. It requires a data model that treats vendor status as an event stream.
The left-behind risk
The firms building this now will be the ones federal clients call after the next vacatur, the next designation, the next executive order. The firms that don't will spend the next two years reissuing memos manually and hoping nobody audits the workflow.
Around 95% of enterprise AI projects fail to reach production. The ones that succeed in legal tend to solve narrow, boring problems like this one. A vendor status log with proper versioning isn't glamorous. It's the kind of infrastructure that quietly decides which firms are still doing federal AI advisory work in 2027 and which ones got quietly dropped from the panel.
The reader who's already built this doesn't need to hear it. The reader who hasn't should probably block out a Friday afternoon.