🔍 Read the full analysis: AI Rules In Virginia And Washington: Where Does The Cyber Plan Fit? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Governor Abigail Spanberger signed a directive on October 23 ordering a statewide cyber plan and regular engagement with AI companies. The move comes as the Trump administration seeks a lighter federal AI framework and challenges some state laws, but Congress has not enacted a law preempting state rules. For now, companies must track requirements across jurisdictions while the federal-state dispute continues.
Virginia Governor Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including those involving artificial intelligence. The directive lands amid a dispute over whether Washington or individual states should set AI rules: the Trump administration is seeking a more uniform, lighter federal framework, but Congress has not passed a law overriding state AI requirements.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop a statewide cyberattack response plan, alongside a plan to strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states may be invited to join the effort.
Virginia plans to ask AI companies to share confidential safety reports they already submit to New York’s financial regulator and the European Union’s AI Office. The directive does not specify a budget or a deadline for completing the plans. The governor’s announcement cited recently disclosed PHP software flaws and Anthropic’s report that its agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education website. Spanberger said no sensitive data was accessed.
The broader policy divide is about both the stringency of AI rules and which level of government has authority to set them. The administration has taken steps to challenge state requirements and promote federal preemption. At the same time, a separate federal order described in the source material established a cybersecurity clearinghouse and a voluntary pre-release review for the most capable AI models. The available account does not provide enough detail to assess how that federal process will operate alongside Virginia’s plan.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds a State Cyber Layer
The directive could give Virginia agencies a formal process for coordinating cyber response and reviewing risks linked to AI systems, while creating a channel for state officials to hear directly from companies. Its requests for existing safety reports may also show how states can draw on disclosures already made to other regulators rather than create an entirely separate reporting process.
For businesses, the immediate issue is that state obligations remain in force unless changed by law or court action. A federal effort to challenge or preempt some state requirements does not, by itself, establish a single national rule. Companies operating across state lines may need to track where their models are developed and used, where customers are located, and which regulatory or contractual reporting duties apply. The directive itself does not impose a specified new reporting deadline on companies; it says Virginia will ask them to share existing reports.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push, State Rules
The administration’s approach began with Executive Order 14179 in January 2025, which revoked the previous administration’s AI order. Its July 2025 AI Action Plan argued that AI should not be held back by excessive bureaucracy and opposed federal funding for states with burdensome AI regulations, while allowing for what it called prudent laws. A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and instructed the Commerce Department to identify state laws considered onerous. The source material reports that no such Commerce list had been published as of its account.
In March 2026, the White House sent Congress a framework proposing that federal law preempt state rules that impose undue burdens, while leaving areas such as child protection and states’ own use of AI to state authority. A federal challenge to Colorado’s AI law followed. The source says the law was later replaced by a narrower disclosure-focused measure scheduled to take effect on January 1, 2027. It also reports that California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are set to begin in 2027.
Virginia’s action is one part of that unsettled landscape, not a resolution of it. The source also reports that 26 attorneys general urged Congress to set federal safety rules and explicitly bar preemption, while a bipartisan House proposal would preempt only a narrower group of frontier-model rules. Those proposals reflect competing approaches; the material does not say that either has become law.
“We have seen no leadership from this President and his allies in Congress.”
— Virginia Governor Abigail Spanberger
Funding, Deadlines and Federal Reach
Virginia’s directive gives no budget, completion date or detailed operating procedures for its plans. It also does not explain what information companies will be asked to provide, how confidential reports will be protected, or whether companies can decline a request. Those details will matter in determining the directive’s practical reach.
The federal-state conflict remains unresolved. The source material describes executive actions, a White House framework and proposed legislation, but does not establish that Congress has enacted a general preemption law. Nor does the available account clarify the status or results of the federal cybersecurity clearinghouse and voluntary model review. A separate opinion arguing that weak U.S. AI regulation poses a security risk is an argument, not a settled finding about the relative threats from the United States and China.
Virginia’s Plans and Federal Action
Virginia’s next steps are to establish the Cyber Consortium, develop the statewide response and infrastructure plans, and begin the AI Task Force’s company briefings and annual exercises. The directive calls for quarterly briefings but does not give a start date. Further state announcements should clarify the timetable, participating agencies and the process for handling company reports.
At the federal level, the key milestones are whether Congress advances legislation defining the boundaries between federal and state authority, and whether federal agencies publish or implement the actions described in the executive orders. Until then, the regulatory picture remains state by state, and the effect of any future federal action will depend on its final terms and legal status.
Key Questions
What did Virginia order?
Governor Abigail Spanberger signed a directive on October 23 requiring officials to create a Cyber Consortium and develop statewide plans for responding to cyberattacks and strengthening infrastructure. It also directs the AI Task Force to hold company briefings at least quarterly and conduct an annual tabletop exercise.
Does the directive require AI companies to submit new reports?
The directive says Virginia will ask companies to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not describe a new mandatory reporting deadline or say what happens if a company does not share a report.
Has Congress overridden state AI laws?
No federal preemption law is identified in the source material. The administration has advocated for a national framework and challenged some state requirements, while proposals in Congress remain distinct from enacted law.
When do other state AI laws take effect?
According to the source material, California and Texas laws took effect on January 1, 2026. Rewritten laws in New York and Colorado are scheduled to start on January 1, 2027.
Source: ThorstenMeyerAI.com
