🔍 Read the full analysis: Virginia’s AI Cyber Plan Raises Questions About Washington’s Deregulation Push on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering state agencies to develop a cybersecurity plan that addresses AI-driven threats and calls for regular briefings with AI companies. The move highlights a dispute over who should set AI policy: Washington is seeking a lighter, more uniform federal approach, while states continue to develop their own rules. The directive names no budget or deadline, and Congress has not enacted a law preempting state AI regulations.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to prepare a statewide plan to prevent and respond to cyberattacks, including threats involving artificial intelligence. The directive calls for regular briefings with AI companies and a review of state data systems, as Washington pursues a lighter national regulatory approach and challenges some state AI laws.
The directive tasks Virginia’s Secretary of Public Safety and Homeland Security with establishing a Cyber Consortium and developing a statewide cyber response plan alongside a plan to strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise, and arrange an independent privacy and security review of state data systems.
Virginia plans to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. The directive also invites other states to participate on a bipartisan basis. It does not name a budget or set a completion date for the plans.
Spanberger’s announcement cited cybersecurity concerns, including vulnerabilities disclosed that week and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said the activity included fake public-records requests on a Virginia Department of Education website, but that no sensitive data was accessed. The source material does not provide independent confirmation of that assessment.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets Federal Pushback
The directive could give Virginia agencies a framework for coordinating cyber preparedness and seeking information from companies about model safety. Its requirements also put the state among the governments trying to address AI risks through local policy while the boundaries of federal authority remain contested.
For businesses, the immediate issue is regulatory uncertainty across jurisdictions. Virginia’s request for reports already shared with New York and EU authorities suggests that companies may face overlapping expectations even as the White House argues for a more uniform national standard. The directive, however, does not establish a new state reporting mandate for companies; it says they are to be asked to share existing reports.
The wider dispute could affect whether states retain room to regulate AI or Congress creates a federal framework that overrides some state requirements. Until that is settled, companies and public agencies must account for rules and obligations in the places where they operate, rather than assume federal preemption is imminent.
Popular right now
Dreame L40 Ultra Gen 2 Robot Vacuum and Mop
Philips 5500 Series Fully Automatic Espresso Machine with LatteGo
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
How Washington Seeks One Standard
The Trump administration’s stated approach favors a single, lighter national framework and challenges state rules it considers burdensome. Executive Order 14179, issued in January 2025, revoked the previous administration’s AI order. A July 2025 AI Action Plan said AI should not be “smother[ed] in bureaucracy” and opposed using federal funding to support states with what it called burdensome AI regulation, while distinguishing those laws from “prudent” ones.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The supplied source reports that no such list had been published as of its account. In March 2026, the White House sent Congress a framework proposing to preempt some state laws while preserving state authority over areas such as child protection and government use of AI. That proposal is not itself a law.
Federal and state actions have also taken different forms. The administration has pursued legal challenges to state rules, while states continue to enact their own measures. According to the source material, California and Texas laws took effect in January 2026, and revised laws in New York and Colorado are scheduled to start in January 2027. Congress has not passed a broad preemption law; the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025.
Funding, Deadlines and Legal Reach
Virginia’s directive does not specify how much the plan will cost, when it must be completed, or what staffing and technical resources will support the Cyber Consortium and the reviews. It also does not state whether companies will agree to share their confidential safety reports, or how Virginia would handle information they provide.
The limits of the federal government’s effort to override state AI rules are also unsettled. The White House framework requires congressional action to become law, and the source material says Congress has not enacted broad preemption. Legal challenges may clarify some boundaries, but their outcomes and timing remain uncertain. The administration’s characterization of certain state laws as burdensome is its position, not a settled legal conclusion.
Spanberger’s criticism that Washington has not provided leadership is likewise a political claim. The federal government has taken actions on AI cybersecurity and model oversight, according to the source material, though the extent to which those measures meet Virginia’s concerns is disputed. The reported website activity and the claim that no sensitive information was accessed are attributed to the governor’s announcement.
State Agencies Begin Planning
Virginia’s public safety and homeland security secretary is directed to establish the Cyber Consortium and produce the state plans, while the AI Task Force is to arrange quarterly company briefings and at least one annual exercise. The directive provides no published schedule for those steps, so the first briefing, exercise and review milestones are not yet clear.
At the federal level, the central next step is whether Congress acts on the White House’s proposed framework or considers a different approach. Further agency actions and court rulings could also shape how federal and state requirements interact. Until there is a clearer legal outcome, Virginia’s directive adds a state-level planning effort to a policy landscape still being contested.
Key Questions
What does Virginia’s directive require?
It directs state officials to establish a Cyber Consortium and prepare plans to prevent and respond to cyberattacks and strengthen infrastructure. It also calls for quarterly AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
Does the directive create a new mandatory reporting rule for AI companies?
The directive says Virginia will ask companies to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not describe this as a new legal reporting mandate.
Has Congress passed a law overriding state AI rules?
No broad federal preemption law has been enacted, according to the source material. The White House has proposed a framework, but that proposal would need congressional action.
What details about Virginia’s plan are still unknown?
The directive does not identify a budget, a completion deadline, or the resources that will support the work. It is also unclear when the first company briefings and annual exercise will take place.
Source: ThorstenMeyerAI.com
