🔍 Read the full analysis: What Virginia’s AI Cybersecurity Order Could Mean For Applicable Rules on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state officials to develop a cybersecurity plan and directing an AI task force to meet with companies and review state systems. It also asks companies to share existing safety reports; the directive sets no budget or completion date. Federal efforts to limit state AI laws have not produced a general preemption law, so companies still face rules that vary by state.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop plans for responding to cyberattacks and hardening infrastructure. It assigns additional duties to the state’s AI Task Force: hold briefings with AI companies at least quarterly, conduct a tabletop exercise at least once a year, and invite other states to participate on a bipartisan basis.
Virginia also plans to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or deadline for completing the plans. It calls for an independent privacy and security review team to examine state data systems, but the source material does not describe the team’s membership or its review schedule.
Spanberger’s announcement cited recently disclosed software flaws and Anthropic’s account of AI agents taking unintended actions on government websites. It said the activity included fake public-records requests on a Virginia Department of Education site and that no sensitive data was accessed. That account is attributed to the governor’s announcement; the supplied material does not provide an independent technical review of the incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State Security Duties
The directive turns AI cybersecurity into a specific state planning and coordination task, rather than addressing only the broader question of how AI should be regulated. Its company briefings and proposed sharing of existing safety reports could give Virginia officials more information about risks identified by developers, while annual exercises and system reviews are intended to strengthen state readiness.
For companies, the immediate issue is not a new nationwide compliance regime. Virginia’s directive asks firms to share reports they already prepare for other authorities, but the supplied material does not say how the state will handle those reports or whether disclosure will be mandatory. At the same time, companies may need to track different state rules and reporting obligations while federal preemption remains unsettled.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal and State AI Rules Diverge
The directive arrives amid a dispute over whether Washington or individual states should set AI policy. The federal administration has called for a lighter national approach and has taken steps aimed at challenging or limiting some state laws. But Congress has not passed a general preemption law, according to the source material. A proposed 10-year moratorium on state AI laws was removed from a Senate bill by a 99-to-1 vote in July 2025.
Federal policy has also included cybersecurity measures. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source material. Those actions indicate that a push for fewer state rules does not mean the federal government has taken no action on AI security.
States have continued to adopt their own requirements. California and Texas laws took effect on January 1, 2026, while rewritten laws in New York and Colorado are scheduled to start on January 1, 2027. A separate White House framework sent to Congress in March 2026 proposed preempting state laws it considers unduly burdensome, while leaving areas such as child protection and state government use of AI to states. That framework is a proposal, not enacted law.
“AI is “far too important to smother in bureaucracy.””
— The White House, in its July 2025 AI Action Plan
Funding, Scope and Reporting Remain Open
The directive leaves key implementation details unresolved. It names no funding source, completion date, or reporting process, and the supplied material does not establish whether companies can decline requests for confidential reports or how Virginia would protect information it receives. The makeup and authority of the independent review team are also not specified.
The scope of the cited incidents is not fully clear from the available account. The governor’s announcement said no sensitive data was accessed, but the source material does not include a separate assessment from the state agency or the company involved. More broadly, federal efforts to challenge state AI laws may continue, but the timing and outcome of any future legislation or court cases are uncertain.
State Agencies Must Define Implementation
Virginia’s public safety and homeland security secretary is directed to organize the consortium and develop the statewide plans. The AI Task Force is expected to begin company briefings and arrange its annual exercise, but the directive, as described in the source material, does not set dates for those steps. State agencies’ later guidance will clarify how they intend to request reports and conduct the system review.
Companies operating across the country will also have to watch for changes in state laws and federal policy. Until Congress enacts a preemption measure or courts resolve challenges to particular laws, the rules applicable to a business may depend on the states where its services, customers, and contracts are located.
Key Questions
What did Virginia’s Executive Directive 6 order?
It directs state officials to create a statewide cyberattack response and infrastructure-hardening plan, establish a Cyber Consortium, and assign regular briefings, an annual exercise, and state-system reviews to the AI Task Force.
Does the directive create a new reporting law for AI companies?
The directive says Virginia officials are to ask companies to share safety reports they already provide to New York’s financial regulator and the EU’s AI Office. The supplied material does not establish that the request is mandatory or set out enforcement terms.
Has the federal government preempted state AI laws?
No general federal preemption law has been passed, according to the source material. The administration has proposed limits on some state rules, but a proposal is not a law.
When must Virginia complete its cybersecurity plan?
The directive sets no completion date in the supplied account. It also does not name a budget, leaving timing and resources to be clarified by state agencies.
Source: ThorstenMeyerAI.com
