🔍 Read the full analysis: Virginia Acts On AI Cybersecurity While Washington Calls For Less Regulation on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering work on a statewide plan to prevent and respond to cyberattacks, including those involving AI. The directive’s approach contrasts with the Trump administration’s push to limit state AI rules, although federal actions also include cybersecurity measures. Virginia’s directive sets out tasks but names no budget or completion date.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, directing state officials to develop a statewide plan to prevent and respond to cyberattacks and to strengthen infrastructure. The order calls for regular briefings with AI companies and reviews of state data systems, setting a state-level security agenda as the Trump administration argues for a lighter, more uniform national approach to AI regulation.
The directive instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop a statewide cyberattack prevention and response plan, alongside a plan to harden infrastructure. Virginia’s AI Task Force is to hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least once a year. An independent team is also to review privacy and security across state data systems.
Virginia will ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive also invites other states to join the effort on a bipartisan basis. It does not specify a budget or a deadline for completing the plans.
The governor’s announcement linked the order to cybersecurity concerns, including vulnerabilities disclosed that week and Anthropic’s report that its AI agents had taken unintended actions on government websites. Spanberger said the agents made fake public-records requests on a Virginia Department of Education site, while her office said no sensitive data was accessed. These are details attributed to the governor’s announcement; the directive itself establishes the planning and briefing requirements.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s State-Level Security Plan
The directive matters because it turns AI-related cyber risk into a specific state-government planning task, rather than leaving the issue solely to federal agencies or voluntary company practices. Regular company briefings, annual exercises and independent reviews could help Virginia identify vulnerabilities and prepare responses. The order does not itself establish a new general AI law or set penalties for companies, but it seeks access to information those companies already provide to other regulators.
For businesses operating across the country, the disagreement over federal and state authority has practical consequences. The administration says a single national standard would reduce compliance burdens; Virginia’s action reflects the continuing role states are taking in security and oversight. With no federal preemption law enacted, companies may still need to track requirements in multiple jurisdictions. The directive does not clarify how many companies will provide the requested reports or how Virginia will handle information it receives.
Popular right now
Dyson Ball Animal 2 Plus Corded Vacuum
De’Longhi Classic Matte Black Espresso Machine with Milk Frother
Samsung 42-Inch Class OLED S90F 4K Smart TV (2025)
As an affiliate, we earn on qualifying purchases.
A Federal-State Split on AI Rules
The Trump administration has pursued a policy of limiting what it views as burdensome state AI regulation. An executive order in January 2025 revoked the previous administration’s AI order. The administration’s July 2025 AI Action Plan said AI should not be “smother[ed] in bureaucracy” and argued that federal funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.
A December 2025 executive order directed federal agencies to challenge certain state laws and pursue a national approach. In March 2026, the White House sent Congress a framework calling for preemption of state rules that impose undue burdens, while preserving state authority in areas such as child protection and states’ own use of AI. Congress has not passed a preemption law. The source material says the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025.
Federal policy has also included cybersecurity steps. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source material. The political dispute is therefore not simply whether government should act, but which level of government should set rules and how far those rules should go.
“far too important to smother in bureaucracy”
— The White House AI Action Plan, July 2025
Funding, Deadlines and Company Participation
The directive does not give a budget, completion date or detailed implementation schedule for Virginia’s cyber plans. It is not yet clear which companies will take part in the briefings, what information they will share, or how the state will protect and use confidential reports. The order also does not set out how the independent review team will be selected or what its findings will make public.
The wider federal-state dispute remains unresolved. Although the administration has called for Congress to preempt some state rules, Congress has not enacted such a measure. The source material also says a federal list of state laws designated as onerous had not been published in the period it reviewed. Future court cases or congressional action could change the regulatory landscape, but their timing and outcome are unknown.
Virginia’s Plans and Briefings
Virginia agencies are expected to establish the Cyber Consortium and begin work on the prevention, response and infrastructure plans required by the directive. The AI Task Force is directed to schedule quarterly company briefings and at least one annual tabletop exercise. The state is also to arrange an independent privacy and security review of its data systems and invite other states to participate.
The directive does not announce dates for those steps. The next concrete developments will be the state’s implementation details, including who will lead the consortium, whether companies provide the requested reports and when the first exercise or review takes place. Congress’s response to the administration’s national framework remains a separate unresolved part of the broader policy dispute.
Key Questions
What did Virginia order on October 23?
Executive Directive 6 directs state officials to create a Cyber Consortium, develop statewide cyberattack and infrastructure plans, hold regular AI-company briefings and review state data systems.
Does the directive create a new AI law?
The directive sets tasks for Virginia agencies and calls for company briefings and requests for existing safety reports. The source material does not describe it as a new general AI statute or identify new company penalties.
What does the directive require from AI companies?
Virginia’s AI Task Force is to meet with companies at least quarterly and ask them to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The order does not specify how many companies will participate.
Has Washington blocked states from regulating AI?
No federal preemption law has been enacted, according to the source material. The administration has called for limits on state AI rules, but the division of authority remains unsettled.
When will Virginia complete its plans?
The directive names no completion date or budget. The timing of the plans, briefings and independent review has not been specified in the material available.
Source: ThorstenMeyerAI.com
