🔍 Read the full analysis: Virginia’s AI Plan Brings Federal-State Regulation Questions To The Fore on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23, 2026, ordering state agencies to develop a cyberattack response plan and hold regular briefings with AI companies. The move comes amid a federal push for a lighter, more uniform national AI framework and ongoing state-level rulemaking; Congress has not enacted a law preempting state AI rules.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, directing state officials to prepare a statewide plan to prevent and respond to cyberattacks and asking AI companies to share safety reports they already provide to regulators in New York and the European Union. The action adds a state cybersecurity initiative to a growing dispute over whether AI rules should be set mainly by Washington or by individual states.
The directive tells Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop plans for responding to cyberattacks and hardening infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states may be invited to take part.
Companies are to be asked to share confidential reports they already submit under New York’s RAISE Act and with the EU’s AI Office. The directive calls for requests for those materials; the source does not establish that companies must provide them to Virginia. It specifies no budget or completion deadline.
Spanberger’s announcement cited cybersecurity concerns, including vulnerabilities disclosed that week and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said the activity included fake public-records requests on a Virginia Department of Education site and that no sensitive data was accessed. That account is attributed to the governor’s announcement, and the source provides no independent findings on the incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
The directive matters because companies deploying AI across state lines face an unsettled mix of requirements, while federal officials are seeking a more uniform national approach. Virginia’s request for existing safety reports could give state officials information about company practices, but the directive does not itself create a broad new AI compliance regime or specify penalties for firms that do not share materials.
For businesses and public agencies, the immediate issue is practical: which rules apply in each jurisdiction, and whether federal action will displace state requirements. The source says California and Texas laws took effect on January 1, 2026, while revised New York and Colorado laws are scheduled to start on January 1, 2027. Until Congress changes the legal landscape or courts resolve disputes, organizations may need to track obligations state by state.
The cybersecurity focus also distinguishes Virginia’s action from a debate framed only around the pace of AI innovation. State agencies depend on digital systems and may be exposed to risks from AI-enabled activity. The directive sets up planning, exercises and review, but its likely effect will depend on how agencies carry out those tasks and what companies choose or are legally required to share.
Products Worth Considering
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Rulemaking
The federal administration has argued for a single, lighter national framework. According to the source material, a January 2025 executive order revoked the prior administration’s AI order, and a July 2025 AI Action Plan opposed what it described as burdensome regulation. A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and asked the Commerce Department to identify state laws considered onerous. The source reports that no such list had been published as of its account.
In March 2026, the White House sent Congress a framework proposing federal preemption of some state rules it considers undue burdens, while leaving areas such as child protection, zoning and government use of AI to states. The proposal is a framework, not an enacted statute. Congress has not passed a preemption law; the source says the Senate rejected a proposed 10-year moratorium on state AI laws by 99 votes to 1 in July 2025.
State laws and litigation have continued. The source says California and Texas measures took effect in January 2026, and that Colorado replaced its law in May with a narrower disclosure-focused measure due to take effect in 2027. A federal-state dispute is not limited to regulation of commercial AI: the source also describes federal cybersecurity actions, including an executive order establishing an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models.
Scope and Implementation Remain Open
Virginia’s directive does not name a budget, set a deadline for completing the statewide plans or specify how the state will obtain the companies’ confidential reports. It is also unclear how many companies will participate in the briefings, what information they will provide, or whether the state will publish findings from its reviews and exercises.
The broader legal question remains unsettled. The White House has called for federal preemption of some state rules, but Congress has not enacted that proposal. The source describes federal litigation and changing state laws, but does not establish a final court ruling that resolves the boundary between federal and state authority. Spanberger’s criticism of federal leadership is her stated view; the administration has presented a different account of its policies and actions.
Agencies Must Build the State Plan
Virginia’s secretary of public safety and homeland security is directed to establish the Cyber Consortium and prepare the statewide cyber plans. The AI Task Force is to begin its company briefings at least quarterly, schedule an annual tabletop exercise and arrange the independent review of state data systems. The directive does not give dates for those milestones, so their timing is not yet clear.
At the federal level, the status of any legislation or court action that could alter state authority remains a key issue for companies and public agencies. For now, the source material indicates that federal preemption has not been enacted and state laws continue to take effect on their own schedules. The next practical developments will be Virginia’s implementation details and any changes to the federal or state rules that apply to AI systems.
Key Questions
What did Virginia order in Executive Directive 6?
It directs state officials to establish a Cyber Consortium, develop plans to prevent and respond to cyberattacks, and harden infrastructure. It also calls for regular AI company briefings, an annual tabletop exercise and an independent review of state data systems.
Must AI companies give Virginia their confidential safety reports?
The directive says companies are to be asked to share reports they already submit to New York’s financial regulator and the EU’s AI Office. The source does not say the directive creates a legal requirement to provide those reports.
Has the federal government preempted state AI laws?
No federal preemption law has been enacted, according to the source material. The White House has proposed limiting some state rules, but its framework is not itself a law.
When will Virginia complete its plans?
The directive does not set a completion date or name a budget. It does require AI Task Force briefings at least quarterly and a tabletop exercise at least once a year.
Source: ThorstenMeyerAI.com
