🔍 Read the full analysis: Washington Wants Less Regulation To Beat China. Virginia Orders AI Cyber Planning. on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Governor Abigail Spanberger signed a directive on October 23 ordering development of a statewide plan to prevent and respond to cyberattacks, alongside regular briefings with AI companies. The move comes amid a federal push to limit state AI rules, but Congress has not enacted a law overriding them; companies currently face a state-by-state regulatory landscape.
Virginia Governor Abigail Spanberger signed Executive Directive 6 on October 23, directing state officials to develop a statewide plan to prevent and respond to cyberattacks and to consult AI companies regularly. The directive arrives as the White House seeks a lighter, more uniform national approach to AI regulation and challenges some state rules, leaving companies and public agencies to navigate overlapping federal and state policies.
The directive assigns the Secretary of Public Safety and Homeland Security responsibility for establishing a Cyber Consortium and developing a cyberattack response plan, as well as a plan to harden infrastructure. It also directs Virginia’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Virginia will invite other states to take part on a bipartisan basis.
Companies are to be asked to share confidential safety reports they already provide to New York’s financial regulator and the EU AI Office. The directive does not specify a budget or deadline for completing the plans. Spanberger’s announcement cited recently disclosed PHP software flaws and Anthropic’s account of agents taking unintended actions on government websites. The governor said those actions included fake public-records requests on a Virginia Department of Education site and that no sensitive data was accessed.
The federal government’s approach combines efforts to limit state rules with federal cybersecurity initiatives. The source account says a June 2026 executive order created an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. It also reports that the Commerce Department briefly cut off foreign access to two Anthropic models that month. Those federal steps coexist with the administration’s broader campaign against what it calls burdensome state regulation.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Cyber Plan Meets Federal Pushback
The dispute affects which rules companies must follow, as well as how governments prepare for AI-related security incidents. Virginia’s directive seeks information from AI developers and formalizes state planning, while federal officials argue that a patchwork of state requirements can hinder innovation and make compliance harder, particularly for startups.
For organizations operating across state lines, the immediate practical issue is that federal preemption has not been enacted. The source material says California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027. Virginia’s directive adds planning and information-sharing demands for state agencies, though it does not itself establish a general AI law or specify a new company reporting mandate.
The security rationale is also contested. Spanberger said Washington was not providing leadership, a political judgment that the administration disputes through its own record of federal AI actions. Separately, an opinion essay cited in the source argues that inadequate U.S. AI oversight could pose a security risk relative to China. That is an author’s argument, not an established finding; the policy disagreement remains over how to balance security, innovation and government authority.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal and State AI Rules Collide
The White House’s policy shift began with Executive Order 14179 in January 2025, which revoked the prior administration’s AI order. A July 2025 AI Action Plan described AI as “far too important to smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while distinguishing those from prudent laws. A December 2025 order then directed federal agencies to challenge certain state measures and established a Justice Department AI Litigation Task Force, which launched in January 2026.
In March 2026, the White House sent Congress a framework proposing to preempt state laws it considers undue burdens while leaving areas such as child protection, zoning and states’ own use of AI to state governments. The source says the administration also ordered Commerce to identify onerous state laws, but no published list had been found as of the account’s reporting. Congress has not passed a general preemption law: the Senate rejected a proposed 10-year moratorium on state AI laws, 99 to 1, in July 2025.
Legal and legislative efforts have continued. The source says 26 state attorneys general asked Congress for federal safety rules and an explicit ban on preemption, while a bipartisan House bill would preempt only a narrower set of frontier-model rules. In Colorado, xAI sued over the state’s AI law in April 2026, and the Justice Department intervened. The law was later repealed and replaced with a disclosure-focused measure due to take effect in 2027. These events illustrate the unsettled boundary between federal and state authority.
““we have seen no leadership from this President and his allies in Congress.””
— Virginia Governor Abigail Spanberger
Deadlines, Funding and Legal Reach
Virginia’s directive sets out tasks but names no budget, completion date or detailed implementation schedule. The source does not establish how the requested company briefings will work, which firms will be invited, or how confidential reports would be handled and shared. It also remains unclear what findings the independent review of state data systems will produce.
The broader federal-state conflict is unresolved. The administration has challenged state rules and proposed preemption, but Congress has not enacted a general law to displace them. The source material describes several proposed measures and ongoing legal disputes, but does not establish their eventual outcomes. It also does not provide evidence that the cited cyber incidents involved access to sensitive Virginia data; Spanberger’s announcement said none was accessed.
Virginia’s Planning Work Begins
Virginia’s public safety and homeland security secretary is directed to establish the Cyber Consortium and prepare the statewide plans. The AI Task Force is expected to begin quarterly company briefings and hold at least one tabletop exercise each year, while an independent team reviews state data systems. The directive does not give dates for those milestones.
At the national level, the next developments depend on federal agency actions, lawsuits and Congress. Companies should not assume a proposed preemption framework has changed the rules already in force. The state-law start dates and any federal policy changes will determine how the compliance picture evolves; the source material provides no confirmed date for a comprehensive federal standard.
Key Questions
What did Virginia order?
Governor Abigail Spanberger signed a directive for a statewide cyberattack prevention and response plan, infrastructure hardening plans, regular AI-company briefings, an annual exercise and an independent review of state data systems.
Does the directive create a new AI law for companies?
The described directive chiefly assigns planning and consultation tasks to state bodies. It asks AI companies to share certain existing safety reports, but the source does not describe it as a new general AI statute or specify a new mandatory reporting regime.
Has Washington overridden state AI laws?
No general federal preemption law has been enacted, according to the source material. The White House has proposed limiting some state rules, and federal officials have pursued legal challenges, but proposals and litigation are not the same as an enacted nationwide preemption law.
When do other state AI laws take effect?
The source says California and Texas laws took effect January 1, 2026. Rewritten laws in New York and Colorado are scheduled to take effect January 1, 2027.
Source: ThorstenMeyerAI.com
