🔍 Read the full analysis: Virginia’s AI Cyber Plan: How It Fits With Washington’s Call To Regulate Less on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering state officials to develop a plan to prevent and respond to cyberattacks, with AI companies invited to share safety reports. The move comes as the federal government promotes a lighter national AI framework and seeks to limit some state rules; Congress has not enacted a law preempting them.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including threats involving artificial intelligence. The directive calls for regular briefings with AI companies and reviews of state systems, adding a state-level security initiative as the federal government presses for a lighter, more uniform approach to AI regulation.
The directive assigns the Secretary of Public Safety and Homeland Security responsibility for establishing a Cyber Consortium and developing plans for cyberattack response and infrastructure protection. Virginia’s AI Task Force must hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. The directive also invites other states to participate on a bipartisan basis.
Virginia officials are to ask companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the EU’s AI Office. The directive does not name a budget or set a deadline for completing the plans. It does not describe the requested reports as newly required filings.
The governor’s announcement cited recently disclosed software vulnerabilities and Anthropic’s account of unintended actions by its AI agents on government websites, including fake public-records requests submitted through a Virginia Department of Education site. Spanberger said no sensitive data was accessed. The source material does not provide an independent account of those incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds a State Security Track
The directive illustrates that the dispute over AI policy is not simply about how much regulation to impose. It is also about which level of government sets the rules, and whether cybersecurity measures can proceed at the state level while Washington seeks to curb parts of the state-by-state system.
For companies, the immediate practical question is what obligations apply in each jurisdiction. The source says California and Texas laws took effect in January 2026, while revised laws in New York and Colorado are due to start in January 2027. Virginia’s directive asks companies to share reports already prepared for other regulators; it does not establish a new statutory reporting mandate in the material provided. Businesses still need to track applicable state requirements and prepare for incident-reporting deadlines where those rules apply.
The split also matters to residents who rely on state services. Virginia has ordered an independent review of state data systems and an exercise to test cyber response, but the directive does not identify specific vulnerabilities, allocate funding or set a completion date. Its practical effect will depend on how the plans are developed and carried out.
Products Worth Considering
DJI Osmo Mobile 8 Gimbal with Mic Mini Transmitter, Infinity Black
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Anker SOLIX C200 DC Portable Power Station, 192Wh, 200W
As an affiliate, we earn on qualifying purchases.
Federal Policy Meets State Action
The White House has advocated a single, lighter national standard and challenged some state AI laws. Executive orders and a July 2025 AI Action Plan described certain state rules as burdensome and argued that a patchwork can complicate compliance, particularly for smaller firms. A December 2025 order directed the Justice Department to create an AI Litigation Task Force and Commerce to identify state laws deemed onerous. The source reports that no such Commerce list had been published as of its October 27 account.
In March 2026, the White House sent Congress a framework calling for federal preemption of state rules it considers undue burdens, while leaving areas such as child protection and states’ own use of AI to state authorities. That framework is a policy proposal, not an enacted law. Congress has not passed a broad preemption measure; the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025, according to the source.
Federal policy is not limited to deregulation. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release review for the most capable models, the source says. The same source reports that the Commerce Department briefly restricted foreign access to two Anthropic models that month. These steps sit alongside the administration’s effort to constrain some state requirements, leaving the federal approach mixed rather than wholly hands-off.
Funding, Deadlines and Scope
Virginia’s directive does not specify how much the work will cost, when the statewide plans must be finished or what powers the Cyber Consortium will have. It also does not say how companies’ confidential reports will be handled, whether firms will agree to share them or what protections would govern their use.
The broader federal-state dispute remains unresolved. The White House has proposed preemption and pursued legal challenges, but the source identifies no enacted congressional law that broadly displaces state AI rules. The legal status and future reach of individual state laws may change through legislation or court decisions.
The source also describes competing views of the security risks and the federal response. An opinion essay arguing that weak US AI regulation could pose a greater security risk than China’s progress is an argument, not a settled finding. The specific circumstances and technical consequences of the incidents cited by Virginia are not fully detailed in the material available.
How Virginia’s Plan Takes Shape
The next steps under Executive Directive 6 are for Virginia officials to establish the Cyber Consortium, begin quarterly AI-company briefings and develop the cyberattack and infrastructure plans. The AI Task Force is also directed to conduct at least one tabletop exercise each year and arrange an independent review of state data systems. The directive sets no public completion date, so the timing of those steps remains open.
At the federal level, Congress could take up legislation addressing AI standards or state authority, while courts may rule on challenges to state laws. Neither a comprehensive federal preemption law nor a final resolution of the state-federal dispute is established in the source. For now, Virginia’s directive and existing state requirements remain part of a changing policy landscape.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger’s October 23 directive ordered officials to establish a Cyber Consortium and develop statewide plans for preventing and responding to cyberattacks and protecting infrastructure. It also requires regular AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
Does the directive create a new reporting law for AI companies?
Not according to the source material. Virginia officials are to ask companies to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The directive does not describe this request as a new statutory filing requirement.
Has Washington banned state AI laws?
No broad federal preemption law is identified in the source. The White House has proposed limiting some state rules and the Justice Department has challenged a state law, but Congress has not enacted a comprehensive measure overriding state AI laws.
When will Virginia’s plan be completed?
The directive sets no completion date or budget. It requires ongoing work, including quarterly company briefings and an annual exercise, but the timing for the statewide plans remains unclear.
Source: ThorstenMeyerAI.com
