🔍 Read the full analysis: Will Virginia’s AI Cyber Plan Stand Alongside Washington’s Lighter-Touch Approach? on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, directing state officials to develop a statewide plan to prevent and respond to cyberattacks and strengthen infrastructure. The move comes amid a dispute over federal efforts to limit state AI rules, but the directive’s budget and completion date are not specified. For now, companies must contend with differing state requirements while federal preemption remains unresolved.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks and strengthen infrastructure, including against threats involving artificial intelligence. The directive adds a state-level security effort as the federal government seeks a more uniform, lighter-touch approach to AI regulation and states continue to adopt their own rules.
The directive instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop the statewide response and infrastructure plans. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia officials are to ask companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive calls for requesting those materials; it does not establish that companies must provide them to Virginia. The document names no budget or completion deadline for the plans.
The governor’s announcement cited recently disclosed software vulnerabilities and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed. That account is attributed to the governor’s announcement; the supplied material does not provide an independent technical assessment of the incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds a State Cyber Track
The directive puts a practical question for agencies and companies at the center of the broader policy dispute: which rules apply, in which jurisdictions, and when? Virginia’s request for existing company safety briefings could give state officials information about risks and responses without creating a new reporting format, though the directive does not say how many firms will participate or what information Virginia will receive.
For businesses operating across state lines, the policy landscape remains unsettled. The federal government has argued for one national standard and has taken steps to challenge some state requirements, but Congress has not enacted a law preempting state AI rules. Companies therefore still need to track the laws and reporting obligations that apply to their products, customers and contracts, rather than assume a federal override is imminent.
Products Worth Considering
Ring Outdoor Cam 4K Plus Battery Security Camera, 3-Pack, White
Levoit Vital 100S-P Air Purifier with Washable Pre-Filter
Ring Floodlight Cam 2K Wired Security Camera, 3-Pack, Black
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Diverge
The administration’s position is set out in federal orders and policy documents. Executive Order 14179, issued in January 2025, revoked the prior administration’s AI order. The July 2025 AI Action Plan said AI was “far too important to smother in bureaucracy” and opposed using federal funding to support states with burdensome AI regulations, while also recognizing “prudent laws.” In December 2025, Executive Order 14365 directed the Justice Department to create an AI Litigation Task Force and instructed Commerce to identify state laws considered onerous. The source material says a list had not been published in the reporting cited and that no later published version was found.
A White House framework sent to Congress on March 20, 2026, proposed preempting state laws that impose “undue burdens” and limiting state regulation of AI development, while leaving areas such as child protection and state use of AI to the states. That framework is a proposal, not enacted law. In July 2025, the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote, according to the source material.
State rules have continued to move on their own schedules. California and Texas laws took effect on January 1, 2026; rewritten laws in New York and Colorado are scheduled to begin January 1, 2027. A separate June 2026 federal order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source. The federal approach is therefore not simply an absence of security activity; the dispute includes both the level of regulation and which government sets it.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Funding and Participation Remain Open
The directive does not state how much the plans will cost, when they must be completed, or which agencies will supply staff and resources. It also does not specify how Virginia will handle confidential company reports, whether firms will agree to share them, or what the state will publish from its reviews and exercises.
The broader legal outcome is also unresolved. The White House framework is not a statute, and the source material reports no congressional preemption law. A separate argument that less regulation improves US security by helping the country compete with China is an attributed opinion, not an established finding. The balance between innovation, cybersecurity and state authority remains contested.
State Planning and Federal Action
Virginia’s public-safety and homeland-security secretary is expected to organize the Cyber Consortium and develop the plans required by the directive. The AI Task Force’s quarterly briefings and annual exercise will provide recurring points for the state to work with companies, although the directive does not set a first meeting date. Participation by other states is also prospective.
At the federal level, Congress could consider legislation, and disputes over state laws may continue through litigation and agency action. Until the legal position changes, companies and public agencies will need to monitor the requirements in each jurisdiction where they operate. The next concrete markers are the rollout of Virginia’s planning process and the scheduled January 1, 2027, start dates for the revised New York and Colorado laws.
Key Questions
What did Virginia’s directive require?
It directed state officials to establish a Cyber Consortium, develop plans for preventing and responding to cyberattacks and hardening infrastructure, and have the AI Task Force hold company briefings at least quarterly and conduct an annual tabletop exercise.
Must AI companies give Virginia their confidential safety reports?
The directive says officials are to ask companies to share reports they already provide to New York’s financial regulator and the EU’s AI Office. It does not establish a legal requirement that companies provide them.
Has the federal government overridden state AI laws?
No preemption law has been passed, according to the source material. The White House has proposed a federal approach and taken steps to challenge some state laws, but those actions have not created a general congressional override.
When will Virginia complete its plans?
The directive does not give a completion date or identify a budget. The timing and resources for the planning work remain unclear.
What should companies watch next?
Companies should watch Virginia’s implementation details, any federal legislation or court decisions affecting state rules, and upcoming state requirements. The revised New York and Colorado laws are scheduled to take effect on January 1, 2027.
Source: ThorstenMeyerAI.com
