🔍 Read the full analysis: AI Cyber Plans And Regulation: What Virginia’s Order Means For Washington’s Approach on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed an executive directive on Oct. 23 ordering a statewide plan to prevent and respond to cyberattacks, with AI companies asked to share existing safety reports. The move comes as the federal government seeks to limit some state AI rules, while Congress has not passed a law preempting them. For now, companies face a changing mix of federal and state requirements.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and strengthen infrastructure, including against threats involving artificial intelligence. The directive asks AI companies to share safety reports they already provide to New York regulators and the European Union, adding a state-level security initiative to a national dispute over who should set AI rules.
The directive instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and prepare a statewide cyber-response plan and an infrastructure-hardening plan. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Companies are to be asked for confidential reports they already submit under New York’s RAISE Act and to the European Union’s AI Office. The order does not say that companies must create new reports, and it does not set a budget or deadline for completing the plans. Its provisions are framed as a request for information and assignments to state officials, rather than a new comprehensive set of AI rules for private companies.
Spanberger’s announcement cited newly disclosed software flaws and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed. That account is attributable to the governor’s announcement; the source material does not provide an independent technical review of the incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State-Level Security Work
The order puts cybersecurity planning and incident readiness at the center of Virginia’s AI policy, even as the federal government argues for a lighter, more uniform national approach. Its practical effect may depend on how the state turns the directive into plans, briefings and exercises, and whether companies agree to share existing reports.
For businesses, the immediate issue is not a new nationwide compliance rule. It is that state requirements remain in motion while federal preemption is unsettled. Companies operating across states may need to track where their models, customers and contracts fall under current laws, as well as maintain incident-response procedures that can meet applicable reporting timelines. Virginia’s directive does not itself establish a new reporting clock for private firms.
The policy disagreement also concerns authority. The administration has sought to challenge state rules it considers burdensome and has called for federal preemption in some areas. Virginia’s action shows a state government using its own agencies and coordination mechanisms to address AI-linked risks. Neither development, by itself, resolves which level of government will set the long-term rules.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Preemption Meets State Action
The administration’s current approach took shape after President Donald Trump’s January 2025 order revoked the previous administration’s AI executive order. A July 2025 AI Action Plan argued that AI should not be constrained by excessive bureaucracy and said federal funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.
A December 2025 executive order directed federal agencies to identify state rules considered onerous and established a Justice Department task force to pursue legal challenges. A March 2026 White House framework called for preempting state laws that impose undue burdens and restricting state regulation of AI development, while leaving areas such as child protection and states’ own use of AI to state authority. The source material says a Commerce Department list of targeted state laws had not been published as of the reporting cited.
Congress has not enacted broad preemption. A proposed 10-year moratorium on state AI regulation was removed from a Senate bill by a 99-1 vote in July 2025. State laws nevertheless continue to take effect: California and Texas measures began on Jan. 1, 2026, while revised laws in New York and Colorado are scheduled to begin on Jan. 1, 2027. The source also describes a narrower bipartisan House proposal focused on some frontier-model rules, rather than a general replacement for state law.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Costs, Deadlines and Company Responses
Virginia’s directive names no budget or completion date, and the available material does not establish when the Cyber Consortium will be formed or when its plans will be finished. It is also unclear how many AI companies will provide reports, what information the state will request, or how confidentiality will be handled in practice.
The exact reach of federal efforts to override state AI rules is also unresolved. Congress has not passed a broad preemption law, and litigation and proposed legislation could alter the boundaries. The source material summarizes a fast-moving policy dispute but does not provide a final legal ruling on the scope of federal authority. The alleged software flaws and agent actions cited by Virginia also need to be distinguished from independently established findings: the governor said no sensitive data was accessed, but no further technical assessment is supplied here.
State Plans and Federal Challenges Ahead
Virginia agencies must now carry out the directive’s assignments, including setting up the consortium, arranging company briefings and preparing the requested plans. The directive calls for briefings at least quarterly and an annual tabletop exercise, but provides no first meeting date or public milestone for completion.
At the federal level, the administration may continue pursuing its stated strategy through agency actions and litigation, while lawmakers consider narrower proposals. For companies, the near-term position described in the source is a state-by-state compliance landscape, not a settled national standard. The next indicators will be Virginia’s implementation details, any published federal actions on state laws and changes to state rules scheduled to take effect in 2027.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed Executive Directive 6, directing state officials to establish a Cyber Consortium and prepare statewide plans to prevent and respond to cyberattacks and strengthen infrastructure.
Does the directive impose a new AI reporting law on companies?
The directive asks AI companies to share confidential safety reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not describe it as a new general reporting mandate, and the order does not specify how many companies will respond.
Has Congress passed a law overriding state AI rules?
No broad preemption law is described in the source material. A proposed 10-year moratorium was removed from a Senate bill by a 99-1 vote in July 2025, while narrower proposals and federal legal challenges remain part of the debate.
What should companies expect in the near term?
They should expect state requirements to remain relevant while federal policy is contested. The source advises tracking the states where models, customers and contracts are covered, and keeping incident-response procedures ready for applicable reporting deadlines.
Source: ThorstenMeyerAI.com
