🔍 Read the full analysis: Does Virginia’s AI Cyber Plan Change Washington’s Push To Regulate Less? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 requiring a statewide plan to prevent and respond to cyberattacks, with AI companies asked to share existing safety reports. The move adds to a dispute over federal efforts to limit state AI regulation; Congress has not enacted a law preempting state rules. The directive does not set a budget or deadline, and its requirements for companies are framed as requests for information.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and directing regular briefings with AI companies. The directive puts Virginia’s cybersecurity effort alongside a federal push to limit some state AI rules, but it does not itself establish a broad new regulatory regime for AI companies.
The directive tasks Virginia’s secretary of public safety and homeland security with creating a Cyber Consortium and developing statewide plans for cyberattack response and infrastructure security. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are invited to participate on a bipartisan basis.
Virginia will ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. The directive describes the reports as information to be requested; it does not say that Virginia has created a new statutory reporting obligation. It sets no budget or completion date for the plans, leaving key implementation details open.
Spanberger’s announcement cited recently disclosed PHP software flaws and Anthropic’s account of its agents taking unintended actions on government websites. The governor said those actions included fake public-records requests on a Virginia Department of Education site and that no sensitive data was accessed. The directive itself calls for prevention, preparedness and review rather than announcing a finding that Virginia systems were breached.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State-Level Pressure
The directive matters because it shows how states can pursue cybersecurity preparedness and information-sharing even as federal officials argue for a more uniform, less burdensome approach to AI rules. For AI companies, the immediate question is not simply whether Virginia has enacted a new AI law. It is whether requests for reports, state briefings and security exercises become part of a growing set of state expectations alongside existing laws elsewhere.
The dispute is about which level of government sets the rules as well as how strict those rules should be. The federal administration says differing state requirements can burden companies, particularly startups, and has urged Congress to preempt some state laws. Virginia’s directive, by contrast, presents state action as a response to cyber risks and a lack of federal leadership, a position stated by the governor and not a settled assessment of the administration’s record.
For residents, the practical stakes include how public agencies protect their systems and data as they use AI-related tools. For businesses, the present landscape remains fragmented: federal preemption has not been enacted, while state requirements continue to develop. The directive may encourage cooperation among states, but its effects will depend on how Virginia implements it and whether other states join.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
Logitech MX Keys S Wireless Keyboard, Graphite
As an affiliate, we earn on qualifying purchases.
Federal and State AI Rules Diverge
The federal administration has pursued a policy of one national standard and fewer state-level restrictions. Executive Order 14179, issued in January 2025, revoked the prior federal AI order. The administration’s July 2025 AI Action Plan argued that AI should not be constrained by excessive bureaucracy and said federal funding should not support states with what it called burdensome AI regulations, while distinguishing those from prudent laws.
A December 2025 executive order directed the Justice Department to establish an AI Litigation Task Force and Commerce to identify state laws considered onerous. The administration later sent Congress a framework proposing that federal law preempt some state rules, while leaving areas such as child protection, zoning and state governments’ own use of AI to states. A published list of targeted state laws was not identified in the source material.
Congress has not passed a broad preemption law. In July 2025, the Senate removed a proposed 10-year moratorium on state AI laws by a 99-to-1 vote. Meanwhile, state rules have taken effect or are scheduled to: California and Texas laws began on January 1, 2026, while revised laws in New York and Colorado are due to start on January 1, 2027. Those laws differ in scope and requirements, so Virginia’s directive enters an already changing policy landscape.
“AI is far too important to smother in bureaucracy.”
— The White House AI Action Plan, July 2025
Deadlines, Funding and Company Duties
Virginia’s directive does not identify how much the plan will cost, when it must be completed or what resources the Cyber Consortium will receive. It also does not specify how the state will handle confidential company reports, whether companies will agree to share them, or what action may follow from the briefings and reviews.
The relationship between this directive and any future federal preemption effort is also unsettled. The federal framework is a proposal to Congress, not an enacted law, and the directive’s requests for existing reports should not be confused with a new, legally binding statewide reporting requirement. The source material does not establish whether Virginia will later pursue legislation or formal rules.
Virginia Must Turn the Directive Into a Plan
The secretary of public safety and homeland security is expected to organize the Cyber Consortium and develop the cyber-response and infrastructure plans. The AI Task Force is directed to begin quarterly company briefings and prepare for an annual tabletop exercise, though the directive gives no start date or public milestones. The independent review of state data systems is another step to watch.
At the federal level, the next major question is whether Congress considers and passes legislation that would preempt any state AI requirements. Until then, companies and public agencies face a developing mix of federal policy, state laws and state-level initiatives. Virginia’s implementation and any decision by other states to join will show whether this directive becomes a broader model for interstate cybersecurity coordination.
Key Questions
What did Virginia’s Executive Directive 6 do?
It directed state officials to develop plans for preventing and responding to cyberattacks, create a Cyber Consortium, hold regular AI-company briefings and review state data-system security and privacy.
Does the directive require AI companies to file new reports with Virginia?
The directive says companies are to be asked to share confidential safety reports they already provide to New York’s financial regulator and the EU’s AI Office. It does not establish a new statutory reporting duty in the source material.
Has Washington banned state AI laws?
No. The administration has proposed limiting some state rules, but Congress has not passed a broad preemption law. The Senate rejected a proposed 10-year moratorium in July 2025 by a 99-to-1 vote.
What remains unknown about Virginia’s plan?
The directive names no budget or completion date. It also leaves open how the state will manage confidential reports, what companies will share and whether Virginia will pursue further binding requirements.
Source: ThorstenMeyerAI.com
