🔍 Read the full analysis: Washington Says Regulate Less To Beat China. Virginia Just Ordered An AI Cyber Plan. Which Rules Actually Apply? on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state agencies to develop a statewide plan to prevent and respond to cyberattacks, including risks involving AI. The directive adds to a widening dispute over AI oversight: the Trump administration has argued for a lighter national framework, while states continue to set their own requirements. Virginia’s directive does not specify a budget or deadline.
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, while requiring regular briefings with AI companies. The move comes as the Trump administration promotes a lighter, more uniform federal approach to AI regulation and states continue to pursue their own rules.
Executive Directive 6 instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and create plans for cyberattack response and infrastructure protection. The state’s AI Task Force is directed to hold briefings with AI companies at least quarterly, conduct a tabletop exercise at least once a year, and arrange an independent privacy and security review of state data systems.
The directive also asks AI companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the European Union’s AI Office. It invites other states to participate on a bipartisan basis. The directive does not name a budget or set a completion date, and it asks companies to share existing reports rather than establishing a new reporting mandate in the text described by the source.
Spanberger’s announcement cited recently disclosed software vulnerabilities and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites. Those actions included submitting fake public-records requests on a Virginia Department of Education site. The governor said no sensitive data was accessed. The source material does not provide further technical details about the vulnerabilities or the website activity.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds State Cyber Oversight
The directive puts Virginia among the states taking steps to address AI-related security risks even as federal officials seek to limit what they describe as burdensome state-by-state rules. For companies operating across jurisdictions, the immediate practical issue is that federal preemption has not been enacted, while state requirements and initiatives continue to develop.
Virginia’s approach emphasizes government preparedness and information-sharing: briefings with AI firms, an annual exercise, and a review of state data systems. Those measures could give state officials more regular opportunities to assess security risks, but the directive does not specify how the consortium will operate, what companies will be asked to provide beyond existing reports, or how findings will be used.
The broader dispute affects companies, public agencies and residents because it concerns both the substance of AI safeguards and which level of government sets the rules. A single federal standard could reduce conflicting obligations for businesses, while state officials and advocates may argue that state action is needed where federal policy does not address local risks. Those are competing policy arguments, not settled conclusions about the effects of either approach.
Products Worth Considering
LG 24G414B-B 24-Inch UltraGear Full HD IPS Gaming Monitor
Trezor Safe 7 Crypto Hardware Wallet
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Diverge
The Trump administration’s stated policy is to pursue a lighter national framework and challenge some state requirements. Executive Order 14179, issued in January 2025, revoked the prior Biden administration AI order. A July 2025 AI Action Plan said AI was “far too important to smother in bureaucracy” and opposed federal funding for states with what it called burdensome AI regulations, while distinguishing those from “prudent laws.”
A December 2025 executive order directed the Justice Department to form an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The source material says a list had not been published as of the reporting cited. In March 2026, the White House sent Congress a framework proposing that federal policy preempt some state laws, while leaving areas such as child protection and state use of AI to states. Congress has not passed a preemption law; the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025.
Federal policy has also included security initiatives, according to the source material: a June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. Meanwhile, states have continued legislating. California and Texas laws took effect on Jan. 1, 2026, while revised laws in New York and Colorado are due to take effect on Jan. 1, 2027. Virginia’s directive adds a state-level planning effort rather than a general AI law.
“AI is “far too important to smother in bureaucracy.””
— The White House’s July 2025 AI Action Plan
Funding, Deadlines and Scope
Virginia’s directive gives no budget or completion date, and the source material does not say when the Cyber Consortium or statewide plans will be operational. It also remains unclear which companies will participate, what specific information they will be asked to share, and whether the requested confidential reports will be handled under additional state protections.
The directive’s cited incidents need further detail. The governor said no sensitive data was accessed in the Virginia Department of Education website activity, but the source material does not describe the scope of the agents’ actions, the vulnerabilities mentioned in the announcement, or any independent review of the incidents.
At the national level, the timing and prospects for federal legislation remain uncertain. The White House has advocated preemption, but Congress has not enacted it. A separate argument that lighter regulation is necessary to compete with China is an opinion advanced by a professor in an essay, not an established finding. The source describes competing views about the security and economic effects of regulation; it does not resolve them.
State Plans Await Implementation
Virginia’s secretary of public safety and homeland security is directed to establish the Cyber Consortium and develop the state’s cyberattack response and infrastructure plans. The AI Task Force is expected to schedule company briefings at least quarterly and a tabletop exercise at least annually. The directive does not provide a public timetable for those steps, so the first milestones are not yet clear.
Virginia’s request for other states to join could broaden the effort, but participation and the form of any shared work have not been specified. Companies and state agencies will also be watching for further details about what reports can be shared and how sensitive information will be protected.
Separately, the national debate will turn on whether Congress considers federal AI legislation and whether agencies or courts act on the administration’s efforts to challenge state laws. For now, the source material indicates that state requirements remain in force and that businesses should not assume a federal preemption measure is imminent.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger’s Oct. 23 Executive Directive 6 directs state officials to establish a Cyber Consortium, create plans to prevent and respond to cyberattacks, and strengthen infrastructure. It also calls for quarterly AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
Does the directive create a new AI law?
The directive sets out state planning and coordination steps. The source material says it asks AI companies to share safety reports they already provide to New York’s financial regulator and the EU’s AI Office; it does not describe a new general AI statute or a new reporting requirement with specified penalties.
Why is Virginia acting while Washington seeks a national approach?
Virginia’s directive focuses on state cybersecurity preparedness. The Trump administration has argued that differing state rules complicate compliance and has called for a more uniform federal framework. Those positions reflect a dispute over both AI safeguards and which level of government should set them.
Has Congress overridden state AI laws?
No federal preemption law has been passed, according to the source material. The Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025.
What remains unknown about Virginia’s plan?
The directive does not specify a budget, completion date or detailed operating procedures. It is not yet clear which companies will participate, what information they will share, or when the consortium and statewide plans will begin operating.
Source: ThorstenMeyerAI.com
