🔍 Read the full analysis: Is Virginia’s AI Cyber Plan Compatible With Washington’s Deregulation Strategy? on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering work on a statewide plan to prevent and respond to cyberattacks, with AI companies asked to share existing safety briefings. The move comes amid a federal push to limit state AI rules, but Congress has not enacted a law preempting them. How the Virginia plan will be funded, when it will be completed and whether companies will share confidential reports remain unclear.
Virginia plans to ask companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the European Union’s AI Office. The directive requests those materials; the source does not say companies are legally compelled to provide them. It also sets no budget or completion date, leaving the scope and pace of implementation open.
Spanberger’s announcement cited recently disclosed PHP flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed. The available material does not establish that the directive was prompted by a confirmed breach of Virginia systems.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets Federal Pushback
The development puts a practical question for businesses and public agencies in focus: which AI requirements apply across state lines while federal policy remains unsettled? Virginia’s directive is principally a cybersecurity planning order, not a broad AI law. Still, its requests for company briefings and safety reports could add reporting and coordination work for firms already responding to rules in several jurisdictions.The federal administration has sought to challenge what it calls burdensome state AI laws and to advance a single national approach. But Congress has not passed a law preempting state AI rules. Until that changes, Virginia’s directive and state laws elsewhere sit alongside federal policies, leaving companies to track different requirements and timelines rather than rely on a settled nationwide standard.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Patchwork of State and Federal Rules
The administration’s approach is set out in executive actions and policy documents. Executive Order 14179, issued in January 2025, revoked the prior administration’s AI order. The July 2025 AI Action Plan argued that AI should not be constrained by excessive bureaucracy and said federal funding should not go to states with burdensome AI regulations, while also recognizing “prudent laws.” A December 2025 order directed the Justice Department to establish an AI Litigation Task Force and the Commerce Department to identify state laws deemed onerous. The source says no such Commerce list had been published as of its reporting.In March 2026, the White House sent Congress a framework calling for preemption of state laws it considers undue burdens, while leaving areas such as child protection and states’ use of AI to state governments. The administration has also pursued AI cybersecurity measures: a June 2026 order established a cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source. Those actions complicate any simple description of federal policy as hands-off: the dispute is also about who sets the rules and what kinds of safeguards apply.
State measures continue to move on separate tracks. The source says California and Texas AI laws took effect on Jan. 1, 2026, while revised laws in New York and Colorado are due to start on Jan. 1, 2027. It also reports that 26 attorneys general asked Congress for federal safety rules and an explicit prohibition on preemption. A bipartisan House bill would preempt a narrower set of frontier-model rules, but the material does not say it has become law.
“The AI Task Force must hold briefings with AI companies “at least quarterly.””
— Virginia Executive Directive 6
Funding, Deadlines and Company Participation
The directive does not name a budget, completion date or implementation schedule. It is also unclear whether AI companies will agree to share confidential reports, how Virginia will handle sensitive material, and what security or privacy standards will govern the reviews of state systems. The source does not describe a legal mandate compelling companies to provide their existing reports.The broader legal picture is unsettled as well. Federal officials have challenged some state laws, but Congress has not enacted the proposed preemption framework. It is not clear whether future legislation or court decisions will change which state rules apply. The federal government’s security initiatives also show that the dispute is not simply whether to regulate AI, but how to divide authority and define safeguards.
State Officials Must Set Implementation
Virginia’s Secretary of Public Safety and Homeland Security is tasked with setting up the Cyber Consortium and preparing the statewide cyber and infrastructure plans. The AI Task Force is directed to schedule company briefings at least quarterly and a tabletop exercise at least once a year; the directive does not give dates for the first sessions or the plans’ completion.Further developments may come from Virginia’s implementation decisions, company responses to requests for reports, and congressional or court action on federal-state authority. For now, businesses operating across jurisdictions will need to follow applicable state requirements while the federal preemption debate continues.
Key Questions
What did Virginia’s new directive order?
It directs officials to establish a Cyber Consortium, develop statewide plans to prevent and respond to cyberattacks and strengthen infrastructure, and arrange recurring AI company briefings and reviews of state data systems.
Does the directive require AI companies to hand over confidential reports?
The state is to ask companies to share reports they already provide to New York’s financial regulator and the EU’s AI Office. The source does not say the directive compels companies to provide them.
Has Washington preempted state AI laws?
No. The source says Congress has not passed a law preempting state AI rules. The administration has advocated for a national framework and challenged some state laws, but the legal and legislative outcome remains unsettled.
When will Virginia’s plans be completed?
The directive gives no completion date or budget. State officials must establish the consortium and develop the plans, but the timeline has not been specified.
Source: ThorstenMeyerAI.com
