🔍 Read the full analysis: Virginia’s AI Order Puts Washington’s ‘Regulate Less’ China Strategy In Focus on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23, 2026, ordering state officials to plan for cyberattacks involving AI and to hold regular briefings with AI companies. The move highlights a wider dispute over whether Washington or individual states should set AI rules; Congress has not passed a law preempting state regulation, and the directive does not specify a budget or completion date.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks and to strengthen infrastructure, including against risks involving artificial intelligence. The directive puts Virginia’s security-focused action against a federal push for fewer state-level AI restrictions, while Congress has not enacted a law preempting state AI rules.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and prepare plans for cyberattack prevention, response and infrastructure security. It also calls for the state’s AI Task Force to meet with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the EU AI Office. The directive does not say the companies must provide the reports, and it names no budget or completion date. Spanberger’s announcement cited recently disclosed software vulnerabilities and Anthropic’s report that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed.
The move comes amid competing approaches to AI governance. The federal administration has sought a single, lighter national standard and challenged what it calls burdensome state laws. At the same time, the source material describes federal measures on AI cybersecurity and model review. The immediate practical picture remains a state-by-state compliance landscape, rather than a settled national framework.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
States Keep Setting AI Security Rules
The directive matters because it shows that states are building their own cybersecurity responses while Washington contests some state-level AI regulation. For companies operating across jurisdictions, the dispute is not just about how strict a rule should be; it is also about which government has authority and what obligations apply in each location.
Virginia’s request for existing company safety briefings could add reporting and coordination demands, although the directive does not establish a mandatory disclosure regime. Its planned exercises and data-system reviews could also shape how state agencies prepare for AI-related incidents. Until federal preemption is enacted or courts resolve the limits of state authority, businesses and public agencies may need to plan for overlapping requirements.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Action
The federal administration’s stated approach began with a January 2025 executive order revoking the prior administration’s AI order. Its July 2025 AI Action Plan argued that AI was too important to constrain with excessive bureaucracy and said federal funding should not go to states with burdensome AI rules, while distinguishing those from prudent laws. A December 2025 order directed the Justice Department to create an AI Litigation Task Force and the Commerce Department to identify state laws considered onerous. The source material says no such Commerce list had been published at the time it was prepared.
In March 2026, the White House sent Congress a framework proposing federal preemption of state laws it considers undue burdens, while leaving areas such as child protection and states’ own use of AI to state governments. The framework is a proposal, not a law. The source also reports that a Senate proposal for a 10-year moratorium on state AI laws was defeated 99 to 1 in July 2025, underscoring the lack of congressional agreement on broad preemption.
State rules have continued to move forward. According to the source material, California and Texas laws took effect on Jan. 1, 2026, while revised laws in New York and Colorado are scheduled to start on Jan. 1, 2027. The source also describes a June 2026 federal cybersecurity order establishing an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. Those steps complicate claims that Washington is taking no security action: the dispute is over the balance and division of authority, not simply whether government acts.
““We have seen no leadership from this President and his allies in Congress.””
— Virginia Gov. Abigail Spanberger, in the announcement accompanying Executive Directive 6
Directive Leaves Key Details Open
Virginia has not set a budget, deadline or detailed implementation schedule in the directive. It is also not clear which companies will be approached, what information they will be asked to share beyond existing reports, or how the state will handle confidential material. The directive says companies are to be asked for reports; it does not establish that they must provide them.
The broader federal-state dispute is unresolved. The White House framework does not itself override state laws, and the source material does not identify an enacted congressional preemption law. Legal challenges and future legislation may alter the rules, but their timing and outcomes are uncertain. Spanberger’s account of the federal response and the administration’s account of its own actions are competing political positions.
Virginia’s Plans Await Implementation
Virginia’s public-safety secretary is to organize the Cyber Consortium and develop the statewide plans. The AI Task Force is directed to schedule quarterly company briefings and at least one annual exercise; the directive also calls for an independent review of state data systems. The document does not give dates for those steps, so the state’s schedule and any resulting recommendations remain to be seen.
At the national level, the key question is whether Congress will take up a federal AI framework and whether courts will define how far federal challenges to state laws can go. For now, companies should not assume that broad preemption is imminent: state laws and implementation timelines remain relevant, while Virginia’s new directive adds another state-level planning process.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed Executive Directive 6, directing state officials to establish a Cyber Consortium and prepare statewide plans to prevent and respond to cyberattacks and strengthen infrastructure. It also calls for regular AI-company briefings and an annual exercise.
Does Virginia require AI companies to turn over their safety reports?
The directive says Virginia officials are to ask companies to share reports they already provide to New York’s financial regulator and the EU AI Office. It does not say companies are compelled to provide them.
Has Congress preempted state AI laws?
No preemption law is identified in the source material. The White House has proposed a federal framework, but a proposal does not change state law by itself. State requirements therefore remain relevant unless changed through legislation, court rulings or other lawful action.
What details about Virginia’s plan are still unknown?
The directive names no budget or completion date. It also leaves open how the consortium will operate, which companies will be approached, what information they may share and when the data-system review and cyber exercise will take place.
Source: ThorstenMeyerAI.com
