🔍 Read the full analysis: Washington Says Regulate Less To Beat China. Virginia Just Ordered An AI Cyber Plan. Which Rules Actually Apply? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, with provisions addressing AI-related risks. It lands amid a federal push for a lighter, more uniform approach to AI regulation and continuing state-level rulemaking; the directive sets no budget or completion date.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including threats involving AI. The directive calls for regular briefings with AI companies and a review of state data systems, sharpening a dispute over whether AI safeguards should be set in Washington or by states.
Executive Directive 6 instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and prepare a statewide cyber response plan, along with a plan to strengthen infrastructure. The state’s AI Task Force is directed to meet with AI companies at least quarterly and conduct a tabletop exercise at least once a year. It must also arrange an independent privacy and security review of state data systems and invite other states to participate on a bipartisan basis.
The directive asks AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. It does not specify a budget or a deadline for completing the plans. Spanberger’s office cited recently disclosed software flaws and Anthropic’s report that its agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed.
The action comes as the federal administration argues for a lighter national framework and has challenged some state rules. But Congress has not enacted a law preempting state AI regulations. States continue to set requirements, leaving companies to track rules that can differ by jurisdiction while the federal-state dispute remains unresolved.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State-Level Oversight
The directive makes Virginia’s response to cyber risk an operational state-government issue, not just a debate about how AI companies should be regulated. Quarterly company briefings, annual exercises and a review of state systems could create recurring channels for officials to learn about risks and prepare for incidents. The directive itself does not establish new penalties for companies or detail a specific enforcement regime.
For businesses, the immediate significance is the continued uncertainty over which rules apply. The federal administration has sought to reduce or preempt some state requirements, while states are still adopting and revising their own laws. Until Congress or the courts settle more of that dispute, organizations operating across state lines may need to account for multiple reporting and compliance obligations. Virginia’s request for existing company reports also raises practical questions about confidentiality and how information will be handled.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
Federal Policy Meets State Rulemaking
The federal government has said a patchwork of state AI laws could raise compliance costs and impede innovation. Its July 2025 AI Action Plan called AI too important to “smother in bureaucracy” and said federal AI funding should not go to states with burdensome regulations, while preserving room for what it called prudent laws. A December 2025 executive order directed federal agencies to challenge certain state rules and created a Justice Department task force. A federal framework sent to Congress in March 2026 proposed preempting state laws that impose undue burdens, while leaving areas such as child protection and states’ own use of AI to state governments.
The federal position is not wholly hands-off on security. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release assessment for the most capable models, according to the source material. The administration has also taken other actions involving AI security. These steps coexist with its effort to limit some state-level regulation, illustrating that the dispute concerns who sets the rules as well as how strict they should be.
State laws have continued to take effect or change. California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to begin on January 1, 2027. In July 2025, the Senate voted 99 to 1 to remove a proposed 10-year moratorium on state AI regulation from a bill. That vote did not settle the broader question of federal preemption.
The other headline behind this dispute was an opinion essay by Stephen Collins, a Kennesaw State University professor, published by The Conversation on September 25. Collins argued that an unregulated U.S. AI sector could pose a greater security risk than China’s progress. He cited an estimate by Carnegie fellow Matt Sheehan that China has about one-tenth of the United States’ computing power. That is an attributed estimate and argument, not an established finding that resolves the policy debate.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Plans, Funding and Data Safeguards
The directive does not say how much the state will spend, when the statewide plans must be completed, or which agencies will carry out each part of the work. It also does not explain how officials will protect confidential company reports, who will be permitted to see them, or whether the information will be shared with other states through the proposed consortium.
The governor’s office said no sensitive information was accessed in the reported activity involving the Virginia Department of Education website. The source material does not provide independent technical findings about the incident, describe the full scope of the unintended actions, or explain how the referenced software flaws relate to the state’s planned measures. The federal-state regulatory dispute also remains unsettled: Congress has not enacted preemption, and the material does not establish how courts will rule on future challenges.
State Officials Must Set the Process
Virginia’s public safety and homeland security secretary is expected to organize the Cyber Consortium and develop the cyber and infrastructure plans. The AI Task Force is directed to begin company briefings at least quarterly and schedule an annual exercise, but the directive provides no calendar for those steps. Details on participation, report handling, funding and deadlines will determine how the order works in practice.
At the federal level, the administration’s actions against state rules and any congressional proposals or court cases could change the compliance landscape. For now, companies and public agencies must operate amid overlapping federal and state policies; the next concrete developments will be Virginia’s implementation details and any further federal or legislative moves.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger signed Executive Directive 6 on October 23, directing state officials to create a Cyber Consortium and prepare plans to prevent and respond to cyberattacks and strengthen infrastructure. It also calls for quarterly AI-company briefings, annual exercises and an independent review of state data systems.
Does the directive create new AI-company penalties?
The directive asks companies to share certain safety reports they already submit to New York and the EU. The source material does not describe new penalties or a new enforcement system for companies under this order.
Has the federal government ended state AI regulation?
No. The administration has pushed to limit or preempt some state rules, but Congress has not passed a federal preemption law. State laws and regulatory requirements remain in effect according to their own terms.
When will Virginia’s plans be completed?
The directive gives no completion date or budget. It requires recurring company briefings and at least one tabletop exercise each year, but further implementation details have not been provided in the source material.
Source: ThorstenMeyerAI.com
