🔍 Read the full analysis: Washington’s Call For Less AI Regulation Meets Virginia’s New Cyber Plan on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 calling for a statewide plan to prevent and respond to cyberattacks, with quarterly AI-company briefings and an annual exercise. The move comes as the White House argues for fewer state AI restrictions and a national standard; Congress has not enacted a law overriding state rules. The directive names no budget or deadline, and its plans are not yet complete.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and to strengthen infrastructure, including against risks involving artificial intelligence. The directive calls for quarterly briefings with AI companies and an annual cyber exercise, as the White House presses for a lighter federal approach and limits on state AI regulation. The clash leaves businesses operating across state lines facing rules that remain unsettled.
The directive tasks Virginia’s Secretary of Public Safety and Homeland Security with establishing a Cyber Consortium and developing statewide plans for cyberattack response and infrastructure security. It also directs the state’s AI Task Force to meet with AI companies at least quarterly, conduct a tabletop exercise at least once a year and invite other states to take part on a bipartisan basis.
Virginia’s AI Task Force is to ask companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the European Union’s AI Office. The directive also calls for an independent privacy and security review team to examine state data systems. It does not say that companies must disclose the reports, and it specifies no budget or completion date.
Spanberger’s announcement cited cybersecurity concerns, including disclosed PHP software flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said the incidents included fake public-records requests on a Virginia Department of Education website, but that no sensitive data was accessed. That account is the governor’s statement; the directive itself establishes the state’s planning and coordination requirements.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State-Level Pressure
The directive makes cybersecurity preparedness part of the wider dispute over who sets AI safeguards. Virginia is directing its agencies to coordinate with companies and other states even as the White House seeks to restrain state rules it considers burdensome. For firms providing AI tools across the country, that means the federal debate has not replaced the need to track state requirements.
The near-term effect is a new planning and engagement process in Virginia, not a fully specified set of duties for AI companies. The directive asks companies to share existing reports; it does not spell out penalties or establish a new reporting deadline for them. Its practical reach will depend on how state officials organize the consortium, what information they request and whether companies participate.
For residents, the plan concerns the security of public systems and the state’s response to cyber incidents. But the source material does not establish that the cited incidents resulted in data theft or that the directive will prevent future attacks. Its impact will be clearer after Virginia publishes its plans and sets out how reviews and exercises will work.
Products Worth Considering
Withings Body Smart Wi-Fi and Bluetooth Smart Scale
Bowflex SelectTech 840 Adjustable Kettlebell
Blueair Blue Pure 511i Max Air Purifier
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Diverge
The federal administration has promoted a single, lighter national approach. Executive Order 14179, issued in January 2025, revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that regulation should not smother AI development and said federal AI funding should not go to states with burdensome AI rules, while allowing what it called prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and asked the Commerce Department to identify state laws deemed onerous. The task force launched in January 2026. The source reports that a list of state laws had not been published as of its October 27 account. In March 2026, the White House sent Congress a framework proposing that federal policy preempt some state restrictions while leaving areas such as child protection and states’ own use of AI to state governments.
Congress has not passed a broad preemption law. In July 2025, the Senate voted 99 to 1 to remove a proposed 10-year moratorium on state AI laws. Meanwhile, California and Texas laws took effect on January 1, 2026, while rewritten laws in New York and Colorado are scheduled to begin on January 1, 2027. The source also reports federal security initiatives, including a June 2026 order creating an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan
Deadlines, Costs and Company Duties
Virginia’s directive does not specify funding, a completion date or a detailed implementation schedule. It also does not explain how the independent review team will be selected, what access it will have, or how state officials will handle confidential company reports. The requirement is to ask companies to share reports, not to compel disclosure under terms set out in the directive.
The wider policy conflict is also unresolved. The White House has sought to limit state rules, but Congress has not enacted broad preemption, and states continue to adopt or revise their own laws. The source describes the administration’s arguments and Spanberger’s criticism, but neither settles the legal or policy debate over the proper division of authority.
The cited cyber incidents do not establish that sensitive information was accessed, and the source gives no independent technical findings about the PHP flaws or the government-site activity. It is also unclear when Virginia will publish its statewide plans or whether other states will join the proposed consortium.
Virginia Must Turn Directive Into Plans
The immediate next step is for Virginia’s Secretary of Public Safety and Homeland Security to set up the Cyber Consortium and prepare statewide cyber response and infrastructure plans. The AI Task Force is directed to hold company briefings at least quarterly and run an annual tabletop exercise. The directive gives no date for the first meeting or for completion of the plans.
State officials will also need to establish the independent review process and invite other states to participate. Companies doing business in Virginia should watch for details about the briefings and requests for existing safety reports, while continuing to assess the laws that apply in each state where they operate.
At the national level, further congressional action or court decisions could change how state AI laws operate. For now, no broad federal preemption law has passed, and the source identifies no published federal list of state laws targeted under the administration’s order. The regulatory picture therefore remains a state-by-state matter while Virginia’s new planning work begins.
Key Questions
What did Virginia’s Executive Directive 6 require?
It directs state officials to develop plans to prevent and respond to cyberattacks and to strengthen infrastructure. It also calls for quarterly briefings with AI companies, an annual tabletop exercise and an independent review of state data systems.
Must AI companies give Virginia their confidential safety reports?
The directive says Virginia’s AI Task Force must ask companies to share reports they already provide to New York’s financial regulator and the EU AI Office. It does not specify a compulsory disclosure rule or penalties for refusing.
Has Congress overridden state AI laws?
No broad preemption law has passed, according to the source material. The Senate removed a proposed 10-year moratorium on state AI laws in a 99-to-1 vote in July 2025.
When will Virginia’s cyber plans be completed?
The directive provides no completion date or budget. It orders state officials to develop the plans, but the schedule and implementation details remain unclear.
Source: ThorstenMeyerAI.com
