🔍 Read the full analysis: What’s The Reach Of Virginia’s AI Cyber Plan Under Washington’s Deregulation Push? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, with AI companies asked to share safety reports they already provide to New York and the European Union. The move comes amid a federal push to limit some state AI rules, but Congress has not enacted a law preempting them. Virginia’s directive sets no budget or completion date.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, directing state officials to develop a statewide plan to prevent and respond to cyberattacks, including attacks involving artificial intelligence. The directive also calls for regular briefings with AI companies and requests safety reports they already provide to New York regulators and the European Union, placing Virginia’s action within a wider dispute over state and federal authority over AI.
The directive tasks Virginia’s Secretary of Public Safety and Homeland Security with establishing a Cyber Consortium, producing a statewide cyberattack response plan and developing a plan to harden infrastructure. It also instructs the state’s AI Task Force to hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least once each year.
The task force is to arrange an independent privacy and security review of state data systems. Virginia also plans to invite other states to participate on a bipartisan basis. Companies are to be asked to share confidential safety briefings they already submit to New York’s financial regulator under the RAISE Act and to the EU’s AI Office. The directive does not state that companies must create new reports.
Spanberger’s announcement cited recently disclosed software flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. Those actions included fake public-records requests on a Virginia Department of Education site. The governor said no sensitive data was accessed. The directive itself does not specify a budget, a deadline for completing the plans, or penalties for companies that do not provide briefings.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets Federal Pushback
Virginia’s directive addresses an operational concern for state agencies: how to prepare for and respond to cyber incidents as AI tools are used in online systems. The planned exercises, security review and company briefings could give officials a structure for exchanging information and testing response procedures. The practical reach of that work, however, will depend on how the state implements it and what information companies agree to provide.
The move also lands amid a dispute over whether Washington or state governments should set AI rules. The administration has sought a single, lighter national approach and has challenged some state regulations, while Virginia is building a state-level security process. For organizations operating in multiple jurisdictions, the question is not only how strict any rule is, but which rules apply to their products, customers and contracts.
For now, federal efforts to curb state AI laws have not produced a broad congressional preemption law. Companies cannot assume that the federal push will displace state requirements, and Virginia’s directive does not itself resolve that larger legal conflict.
Popular right now
Dyson Ball Animal 3 Extra Upright Vacuum
Dyson Ball Animal 2 Plus Corded Vacuum
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Still Diverge
The White House revoked the prior administration’s AI executive order in January 2025 and later set out a policy favoring fewer regulatory barriers. In December 2025, Executive Order 14365 directed the Justice Department to establish an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The source material reports that the list had not been published as of its review.
A White House framework sent to Congress in March 2026 proposed preempting state laws that impose undue burdens and restricting state regulation of AI development, while leaving areas such as child protection and states’ own use of AI to state governments. That framework is a proposal, not an enacted statute. Congress previously rejected a proposed 10-year moratorium on state AI laws in a Senate vote of 99 to 1 in July 2025.
States have continued to act. California and Texas AI laws took effect on Jan. 1, 2026, according to the source material, while revised laws in New York and Colorado are scheduled to start on Jan. 1, 2027. Virginia’s directive is primarily a cybersecurity planning measure; it is not described as a general AI code or a new system of penalties.
“At least quarterly”
— Virginia Executive Directive 6
Budget, Deadlines and Participation Remain Open
The directive sets no budget or completion date for the statewide plans. It also does not spell out how the independent review team will be selected, what systems it will examine, or how its findings will be handled. The scope of the company briefings and the process for sharing confidential reports are not specified in the material available.
It is also unclear which companies will participate or whether they will provide the same documents they send to New York and EU officials. The directive calls for the state to ask for those reports, but the supplied account does not establish a new legal obligation or describe consequences for nonparticipation. Virginia’s plan will operate against a changing legal backdrop as federal officials pursue challenges to some state AI rules and other state requirements take effect.
State Officials Must Set the Process
The next step is for Virginia’s public safety and homeland security secretary and the AI Task Force to organize the consortium, briefings, annual exercise and security review. The directive does not provide a public timetable for those actions, so the dates and operating details remain to be announced.
Further developments will also depend on whether other states accept Virginia’s invitation and whether companies share existing safety reports. At the federal level, the administration’s litigation and policy efforts may continue, but the source material identifies no enacted congressional preemption measure. Until that changes, states and businesses will need to follow the requirements currently in force in each relevant jurisdiction.
Key Questions
What did Virginia order on Oct. 23?
Gov. Abigail Spanberger signed a directive ordering officials to establish a Cyber Consortium, develop statewide cyberattack response and infrastructure-hardening plans, and arrange regular AI company briefings and an annual exercise.
Does the directive require AI companies to file new safety reports?
The directive says companies are to be asked to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not say Virginia created a new reporting mandate.
Has Congress barred states from regulating AI?
No broad preemption law is identified in the source material. The White House has proposed limiting some state rules, but its framework is not an enacted statute.
When will Virginia’s cyber plan be completed?
The directive does not set a completion date or name a budget. A timetable has not been provided in the source material.
Source: ThorstenMeyerAI.com
