🔍 Read the full analysis: Does Washington’s ‘Regulate Less’ Position Limit Virginia’s AI Cyber Plan? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering a statewide plan for preventing and responding to cyberattacks, including AI-related risks. The move comes as the White House seeks a lighter national AI framework and challenges some state rules, but Congress has not passed a law broadly preempting state regulation.
Virginia Gov. Abigail Spanberger signed an executive directive on Oct. 23 ordering state officials to develop a plan to prevent and respond to cyberattacks, as the White House presses for a lighter, more uniform national approach to artificial intelligence regulation. The order calls for regular briefings with AI companies and a review of state data systems, but does not specify a budget or completion date. It highlights the practical uncertainty for businesses and residents: federal efforts to limit some state rules have not yet produced a broad congressional preemption law.
Executive Directive 6 instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and create statewide plans for cyberattack prevention and response, as well as for strengthening infrastructure. The state’s AI Task Force must hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least once a year. The directive also calls for an independent privacy and security review of state data systems and invites other states to participate.
Virginia plans to ask companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the European Union’s AI Office. The directive does not say that companies must disclose those reports, or specify how any information would be handled. Spanberger cited newly disclosed software flaws and Anthropic’s report that its agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Her announcement said no sensitive data was accessed.
The federal government is seeking a different balance, arguing for a single national standard and action against state laws it considers burdensome. However, the source account reports that Congress has not enacted a general preemption measure. In July 2025, the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote. The immediate result is continued overlap between federal policy efforts and state-level requirements.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets Federal Pushback
The dispute affects which rules companies must follow, as well as how quickly public agencies can prepare for AI-related cyber risks. Virginia’s directive uses existing state channels to seek briefings and safety information. The White House, by contrast, has argued that differing state requirements can raise compliance costs and impede AI development, and has pursued legal and policy steps aimed at limiting some of them.
For organizations operating across state lines, the lack of a settled national framework means they cannot assume that proposed federal preemption will displace current or forthcoming state requirements. The source reports that California and Texas laws took effect Jan. 1, 2026, while revised laws in New York and Colorado are scheduled to take effect Jan. 1, 2027. Which provisions apply depends on each law’s scope; the broader policy conflict does not itself suspend state obligations.
The security question is also distinct from the argument over the overall level of regulation. The source describes federal cybersecurity initiatives alongside the administration’s deregulatory agenda. That means “lighter regulation” does not necessarily mean no federal security activity. Virginia’s order adds a state-led planning process, but its effectiveness and the companies’ participation will depend on implementation details that are not yet set out.
Popular right now
Samsung 42-Inch Class OLED S90F 4K Smart TV (2025)
Roborock Robot Vacuum and Mop with LiDAR Navigation and 10,000 Pa Suction
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Diverge
The White House’s approach has developed through executive actions and policy proposals. President Donald Trump’s January 2025 order revoked the Biden administration’s AI order. A July 2025 AI Action Plan called AI too important to “smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while also saying the government should not interfere with prudent laws.
An executive order dated Dec. 11, 2025, directed the Justice Department to establish an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The task force launched in January 2026. The source says a list of targeted state laws had not been published as of its reporting. A March 2026 White House framework proposed preempting state laws that impose undue burdens while leaving areas such as child protection, zoning and state governments’ own AI use to states. These were federal actions and proposals, not a comprehensive law passed by Congress.
The federal government has also pursued AI security measures. The source describes a June 2026 executive order establishing an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, as well as a brief Commerce Department cutoff of foreign access to two Anthropic models. Those measures indicate that the administration’s position includes security-related interventions even as it argues against some state regulation. Spanberger’s statement that Washington has shown no leadership is her political assessment; the administration’s actions provide a different account of its role.
Funding and Company Disclosures Unset
Virginia’s directive gives no budget, completion date or detailed implementation schedule. It also does not specify how the state will protect confidential company briefings, whether firms will agree to share their reports, or what action officials could take if companies decline. The scope and findings of the independent review of state data systems have not been described.
The federal-state legal picture remains unsettled. The source reports litigation and federal efforts to challenge certain state rules, but no enacted congressional law broadly preempting them. It is also unclear when, or whether, the proposed federal framework will become legislation. The source account does not establish that every state law cited will be challenged or displaced.
Virginia cited cyber incidents and disclosures as reasons for acting, but the directive itself does not establish that a particular AI system caused a breach or that sensitive state information was exposed. The governor’s announcement said sensitive data was not accessed in the website incident she referenced. Further details about the event and any independent technical findings were not supplied in the source material.
Virginia’s First Planning Steps
Virginia’s secretary of public safety and homeland security is to organize the Cyber Consortium and develop the statewide plans. The AI Task Force is directed to begin quarterly company briefings and hold at least one annual tabletop exercise. The order also calls for an independent review of state data systems, though it provides no public deadline for these steps.
Companies and state agencies will be watching for details on participation, confidentiality and how the resulting plans will address prevention and response. At the federal level, further action could come through courts, executive agencies or Congress. Until a binding national law changes the rules, businesses must track applicable state requirements rather than treat proposed preemption as settled policy.
Key Questions
What did Virginia order on Oct. 23?
Gov. Abigail Spanberger signed Executive Directive 6, directing officials to establish a Cyber Consortium and develop statewide cyberattack prevention and response plans. It also requires regular AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
Does the directive require AI companies to hand over confidential reports?
The directive says Virginia officials are to ask companies to share reports they already provide to New York’s financial regulator and the EU’s AI Office. The source does not say the order compels disclosure or explain how the state would handle the information.
Has Congress barred states from regulating AI?
No broad congressional preemption law is identified in the source account. The White House has proposed limiting some state rules, but those proposals are not the same as an enacted law. The Senate rejected a proposed 10-year moratorium on state AI laws by 99 to 1 in July 2025.
Does Washington’s push for lighter rules mean it has no AI security policy?
No. The source describes federal cybersecurity measures, including a June 2026 order establishing an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. The administration’s opposition to some state requirements is separate from those federal security actions.
What should companies expect while the dispute continues?
For now, companies should identify the state laws that apply to their operations, customers and contracts. The source reports that some state rules are already in force and others are scheduled to take effect in 2027; any change from federal preemption remains uncertain.
Source: ThorstenMeyerAI.com
