🔍 Read the full analysis: Washington’s Less-Regulation Message And Virginia’s AI Cyber Plan: What To Know on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23, 2026, ordering a statewide plan to prevent and respond to cyberattacks, including risks linked to AI. The move comes as the Trump administration advocates a lighter federal AI framework and seeks to limit some state regulations, while Congress has not enacted broad preemption. For now, companies face a changing mix of state and federal requirements.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including those involving artificial intelligence. The directive sharpens a dispute with the federal government over who should set AI rules: the Trump administration has argued for a lighter national approach and challenged some state laws, while Virginia and other states continue building their own safeguards.
The directive tells Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create plans for cyberattack response and infrastructure protection. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise, and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or deadline for completing the plans. Spanberger’s announcement cited recently disclosed software flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said no sensitive data was accessed in the Virginia Department of Education incident she referenced.
The federal position is not simply an absence of security measures. The source account describes a June 2026 executive order creating an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. At the same time, the administration has pursued limits on state regulation and asked Congress to preempt some state laws. Congress has not passed a broad preemption law; a proposed 10-year moratorium was removed from a Senate bill by a 99-to-1 vote in July 2025.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
The Rules Companies Face Now
The immediate consequence is that organizations cannot treat the dispute over federal preemption as settled. With state requirements still in force or scheduled to begin, companies may need to track the locations of their customers, operations, models and contracts rather than rely on a single national standard. Virginia’s directive adds a state-level planning and information-sharing initiative, although it does not itself set a new general licensing regime for AI companies.
The divide also concerns the scope of government oversight, not just how strict a particular rule should be. The administration argues that multiple state systems can burden innovation and create conflicting obligations. State officials and supporters of stronger safeguards point to risks that may require local preparation, including cyber incidents and the handling of sensitive data. Those are competing policy arguments; the source material does not establish that either approach alone will produce better security or economic results.
For residents, the issue is practical as well as political: state agencies are preparing for cyber incidents involving AI tools while federal and state authorities debate which rules will remain. The directive’s planned exercises and reviews could help state agencies identify gaps, but the order does not yet show what resources will be available or what specific protections will follow.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Policy and State Rules
The Trump administration’s approach began with Executive Order 14179 in January 2025, which revoked the previous administration’s AI order. A July 2025 AI Action Plan described AI as too important to “smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.
In December 2025, Executive Order 14365 directed the Justice Department to form an AI Litigation Task Force and Commerce to identify state laws considered onerous. The administration’s March 2026 framework asked Congress to preempt state rules it considers undue burdens and to bar states from regulating AI development, while leaving areas such as child protection and state use of AI to the states. The source account says a list of targeted state laws had not been published as of its reporting.
State measures have continued on separate timelines. California and Texas AI laws took effect on January 1, 2026, according to the source material; revised laws in New York and Colorado are due to start on January 1, 2027. The Colorado law was replaced after a federal challenge and a pause in enforcement. The source also reports that 26 state attorneys general asked Congress for federal safety rules and an explicit bar on preemption, while a bipartisan House proposal would preempt a narrower set of frontier-model rules.
The other headline in the source material is an opinion essay by Stephen Collins, a Kennesaw State University professor, first published by The Conversation on September 25. Collins argues that an underregulated U.S. AI sector could pose a greater security risk than China’s AI development. His argument draws on an estimate by Carnegie Endowment fellow Matt Sheehan that China has about one-tenth of U.S. computing power. That estimate and Collins’s conclusion are attributed claims, not settled findings.
“America’s success in the AI race will depend on removing barriers to innovation.”
— Assistant Attorney General Brett Shumate
Funding, Deadlines and Federal Reach
Virginia’s directive provides no budget or completion date, and the source material does not identify when the consortium or statewide plans will be operational. It also remains unclear which companies will share existing confidential reports, what information Virginia will receive, and how the state will protect or use it.
The federal-state legal dispute is unresolved. Congress has not enacted broad preemption, and the source account reports that the administration’s proposed list of targeted state laws was not publicly available. Court challenges and proposed legislation could change the rules, but their outcomes and timing are not established. The source material also gives no independent assessment of the security incidents cited by Virginia beyond the governor’s account that sensitive data was not accessed.
Virginia’s Plans and the Legal Fight
Virginia’s public-safety and homeland-security secretary is tasked with establishing the Cyber Consortium and preparing the statewide cyber response and infrastructure plans. The AI Task Force is directed to begin regular company briefings and arrange an annual exercise. The directive also calls for an independent review of state data systems and invites other states to join, but it does not set dates for those steps.
At the federal level, the administration’s legal and policy efforts may continue through agency actions, litigation and negotiations with Congress. State laws already in effect, and those scheduled for 2027, remain relevant unless changed by lawmakers or courts. The next concrete developments to watch are publication of Virginia’s plans, any disclosure of resources or deadlines, and decisions on federal proposals that would alter state authority.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger’s October 23 directive orders a Cyber Consortium and statewide plans to prevent and respond to cyberattacks and protect infrastructure. It also sets quarterly AI-company briefings, an annual exercise and an independent review of state data systems.
Does the directive create new AI rules for every company in Virginia?
The source material describes planning, briefings and requests for companies to share existing safety reports. It does not describe a new general licensing requirement or a broad set of AI rules for all companies.
Has the federal government preempted state AI laws?
No broad federal preemption law has passed, according to the source material. The administration has advocated preemption and pursued related policy and legal steps, but state rules continue to apply unless changed through legislation or court action.
What remains unknown about Virginia’s plan?
The directive does not name a budget or completion date. It is also not yet clear which companies will provide reports, what information the state will receive, or when the consortium and plans will be fully operational.
Source: ThorstenMeyerAI.com
