🔍 Read the full analysis: What Virginia’s AI Cyber Plan Means Amid Washington’s Call For Less Regulation on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state agencies to develop a cybersecurity plan that addresses AI-driven attacks and directs the state AI Task Force to meet with AI companies at least quarterly. The move comes amid a federal push to limit state AI regulation, but the directive names no budget or deadline, and federal legislation to preempt state rules has not passed.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including attacks involving artificial intelligence. The directive adds state-level cybersecurity and company-briefing measures as the federal government argues for fewer state AI rules and a single national approach.
The directive tells Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop a statewide cyberattack response plan, alongside a plan to strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least once a year. A team is to review state data systems for privacy and security, and Virginia is to invite other states to participate on a bipartisan basis.
Virginia intends to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive calls for those briefings but does not specify a budget, a completion date, or a penalty for companies that decline to share information.
Spanberger’s announcement cited recently disclosed software flaws and Anthropic’s report that its agents had taken unintended actions on government websites. The governor said those actions included fake public-records requests on a Virginia Department of Education website and that no sensitive data was accessed. That account is attributed to the governor’s announcement; the directive itself establishes state planning and review requirements rather than a finding of a breach.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds State Cyber Oversight
The directive could bring regular contact between Virginia officials and AI companies into the state’s cybersecurity planning, while setting out exercises and reviews intended to prepare agencies for attacks. Its practical effect will depend on how the state builds the consortium, what companies provide, and whether the planned reviews lead to changes in state systems.
For businesses, the immediate issue is the continued uncertainty over which rules apply across jurisdictions. Virginia’s initiative is not itself a federal standard, and it does not settle the broader dispute over state authority. Companies operating across state lines may still need to track different requirements while Congress considers whether to limit them.
The disagreement is about both the strictness of AI rules and which level of government sets them. The federal administration has argued that differing state laws complicate compliance, especially for smaller firms. Virginia’s action reflects the view that state governments need to plan for cyber risks even as Washington pursues a less restrictive approach.
Popular right now
Breville Bambino Espresso Machine, Brushed Stainless Steel
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
Shark Rocket Pet Plus Corded Stick Vacuum, Bordeaux, HV322
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Rules
The White House has pursued a lighter national regulatory approach since Executive Order 14179 in January 2025 revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that AI should not be burdened by excessive bureaucracy and said federal funding should not go to states with burdensome AI regulations, while leaving room for what it called prudent laws.
A later executive order, dated December 11, 2025, directed the Justice Department to create an AI Litigation Task Force and the Commerce Department to identify state laws deemed onerous. The task force launched in January 2026. The source report says a list of targeted state laws had not been published in the materials it reviewed. In March, the White House sent Congress a framework calling for preemption of some state AI laws; Congress has not passed a preemption law.
Federal policy has also included cybersecurity measures. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release review for the most capable models, according to the source material. Meanwhile, state requirements continue to vary: California and Texas laws took effect in January 2026, while revised laws in New York and Colorado are scheduled to begin in January 2027. Those dates illustrate the changing state landscape but do not determine how Virginia’s directive will operate.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Plan Details Still Missing
Executive Directive 6 does not give a budget or deadline for completing the statewide plans. It also does not explain what information companies must provide, how Virginia will protect confidential reports, or what happens if a company does not participate. The timing and scope of the independent review of state data systems are not specified in the source material.
It is also unclear how the directive will interact with any future federal action or new state laws. The administration’s efforts to challenge or preempt some state requirements have not produced a general congressional preemption law, while federal and state cybersecurity policies continue to develop. The governor’s description of the incidents that prompted the directive is not, by itself, a complete independent account of those events.
Virginia’s Implementation Steps
The next practical steps are for Virginia’s public safety and homeland security secretary to establish the Cyber Consortium and begin work on the statewide prevention, response, and infrastructure plans. The AI Task Force is directed to start quarterly company briefings and schedule an annual tabletop exercise. The directive does not set dates for those first meetings or for publication of the plans.
Companies and public agencies will also be watching for any federal legislation or court action that changes state authority over AI rules. Until such changes are enacted, Virginia’s directive and other state requirements remain part of a developing, state-by-state policy landscape.
Key Questions
What did Virginia’s Executive Directive 6 require?
It directs state officials to establish a Cyber Consortium, develop statewide plans to prevent and respond to cyberattacks and strengthen infrastructure, hold AI-company briefings at least quarterly, and run an annual tabletop exercise.
Does the directive require AI companies to disclose confidential reports?
It says Virginia officials are to ask companies to share confidential reports they already provide to New York’s financial regulator and the EU AI Office. The source material does not describe a mandatory disclosure penalty or say how the state will handle reports it receives.
Has Congress passed a law preempting state AI rules?
No. The source material says Congress has not passed a general law preempting state AI regulations. The White House has proposed a federal framework, but a proposal is not an enacted law.
When will Virginia’s plans be completed?
The directive sets no completion date or budget. It directs agencies to begin the planning and briefing work, but the timing of publication and the first company meetings is not specified.
Source: ThorstenMeyerAI.com
