🔍 Read the full analysis: Why Virginia Ordered An AI Cyber Plan As Washington Seeks Fewer Rules on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state officials to develop a plan to prevent and respond to cyberattacks, with a focus on AI-related risks. The move comes as the federal government seeks to limit some state AI rules, leaving businesses to navigate overlapping requirements while the scope and timing of Virginia’s plan remain unsettled.
Virginia Gov. Abigail Spanberger signed an executive directive on Oct. 23 ordering state officials to create a statewide plan to prevent and respond to cyberattacks, including threats involving artificial intelligence. The directive also requires regular briefings with AI companies and annual exercises, as Virginia moves ahead on security planning while the federal government presses for a lighter, more uniform approach to AI regulation.
Executive Directive 6 instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop plans for cyberattack response and for hardening infrastructure. It assigns the state’s AI Task Force to hold briefings with AI companies at least quarterly and run a tabletop exercise at least once a year. The directive also calls for an independent privacy and security review of state data systems and invites other states to participate on a bipartisan basis.
Virginia plans to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive calls for those briefings but does not itself establish a general disclosure mandate for all companies. It names no budget or completion date, and the source material does not identify a timetable for the consortium or statewide plan.
Spanberger’s announcement cited recently disclosed vulnerabilities and Anthropic’s account that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. According to the governor’s announcement, no sensitive data was accessed. That account describes the governor’s stated reasons for the directive; the directive itself sets out the state’s planning and review instructions.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Security Plan Amid Federal Pushback
The directive puts the dispute over AI policy into practical terms: who sets the rules, and what measures states can take while federal policy is still developing. Virginia is ordering state planning and seeking company briefings around cyber risks. At the same time, the White House has argued that differing state laws can burden innovation and has called for federal limits on some state regulation.
For companies, the immediate issue is not a settled nationwide standard but a mix of existing and upcoming requirements. The source material says California and Texas laws took effect on Jan. 1, 2026, while revised laws in New York and Colorado are scheduled to start Jan. 1, 2027. Virginia’s directive adds a state-level security process, but does not specify a new compliance deadline or describe penalties for companies that do not provide requested reports.
The stakes also reach public services and residents. State agencies rely on digital systems that can hold sensitive information, while AI tools may create new pathways for mistakes or misuse. Virginia’s proposed independent review and recurring exercises are intended to test defenses and response procedures. The effectiveness of those steps will depend on how they are funded, organized and followed through.
Popular right now
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
Federal and State AI Rules Diverge
The federal administration has pursued a policy of reducing what it calls burdensome AI regulation and promoting a single national approach. Executive Order 14179, issued in January 2025, revoked the prior administration’s AI order. A July 2025 AI Action Plan said AI was “far too important to smother in bureaucracy” and said federal funding should not go to states with burdensome AI rules, while distinguishing those from what it called prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and Commerce to identify state laws considered onerous. The task force launched in January 2026. The source material reports that a list of state laws had not been published as of the account’s reporting, and says the White House sent Congress a framework in March 2026 proposing federal preemption of some state rules. Congress has not passed a preemption law; a proposed 10-year moratorium on state and local AI laws was removed from a Senate bill in July 2025 by a 99-1 vote.
Federal policy has also included cybersecurity measures. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source material. That means the federal position is not simply an absence of security action: the dispute is also over the balance between federal oversight, state authority and the form those protections should take.
Funding, Deadlines and Company Duties
Virginia’s directive does not state how much the plan will cost, when it must be completed or which agency will lead each part of the work beyond the instructions it assigns. It also does not say whether AI companies must provide requested confidential reports, how those reports would be protected, or what information the state would publish after the briefings.
The precise legal reach of the federal effort remains unsettled. The source material describes executive actions, a White House framework and litigation, but no enacted congressional preemption law. It also does not establish whether a federal court will ultimately restrict any particular state AI law. The boundaries between state cybersecurity action and federal efforts to limit state AI regulation may become clearer through future guidance, legislation or court decisions.
The account of the Virginia website incident comes from the governor’s announcement. The source material says no sensitive data was accessed, but does not provide an independent technical review or additional details about the agents’ actions. The extent of any wider exposure and the safeguards companies will be asked to demonstrate remain unclear.
State Agencies Must Build the Plan
The next step under the directive is for Virginia’s Secretary of Public Safety and Homeland Security to establish the Cyber Consortium and move the statewide planning work forward. The AI Task Force is expected to schedule quarterly company briefings and at least one annual tabletop exercise. The directive also calls for an independent review of state data systems, though it does not specify when that review will begin.
Companies and public agencies will be watching for details about how Virginia will request and handle confidential reports, and whether other states join the effort. Separately, Congress and the courts may shape how much authority states retain over AI regulation. Until those issues are resolved, the source material indicates that businesses must account for state-by-state rules already in force and those scheduled to take effect.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23. It directs state officials to establish a Cyber Consortium and develop statewide plans for preventing and responding to cyberattacks and hardening infrastructure.
Does the directive require every AI company to submit reports?
The directive says Virginia will ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not say that it creates a mandatory reporting requirement for every company.
Why is Virginia acting while Washington seeks fewer rules?
Virginia is focusing on state cybersecurity planning and preparedness. The federal administration has argued for a lighter national AI framework and has challenged some state rules. The two efforts reflect disagreement over the appropriate roles of federal and state governments.
Has Congress blocked states from regulating AI?
No federal preemption law has passed, according to the source material. A proposed 10-year moratorium was removed from a Senate bill in July 2025 by a 99-1 vote, and the legal status of future federal restrictions remains unsettled.
When will Virginia’s plan be completed?
The directive does not give a completion date or budget. It calls for quarterly AI company briefings and at least one annual tabletop exercise, but further implementation details have not been provided in the source material.
Source: ThorstenMeyerAI.com
