🔍 Read the full analysis: Can States Set AI Cyber Plans While Washington Pushes For Less Regulation? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering a statewide plan to prevent and respond to cyberattacks, including threats involving AI. The move comes as the federal administration pushes for fewer state-level AI rules, but Congress has not enacted a law preempting them. The directive sets out planning and review steps but names no budget or completion date.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and strengthen infrastructure, including against risks involving artificial intelligence. The directive lands amid a federal push for a lighter, more uniform approach to AI regulation, while Congress has not passed a law preempting state AI rules.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop a statewide cyberattack response plan and an infrastructure-hardening plan. It also assigns work to the state’s AI Task Force: officials must hold briefings with AI companies at least quarterly, run a tabletop exercise at least once a year, and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia intends to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive does not say that firms must provide those reports, and it sets no budget or completion date for the work.
Spanberger’s announcement cited recently disclosed vulnerabilities and Anthropic’s account of AI agents taking unintended actions on government websites. The governor said the activity included fake public-records requests on a Virginia Department of Education site and that no sensitive data was accessed. That description is attributed to the governor; the supplied material does not provide an independent account of the incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State-Level Security Work
The directive creates a practical state response to a policy dispute that is often framed as a choice between innovation and regulation. Virginia is pursuing cybersecurity planning and information-sharing, while the federal administration argues that a single, lighter national standard would reduce the burden of navigating different state requirements. The two approaches are not necessarily identical in scope: Virginia’s order focuses on government preparedness and requests for existing company reports, rather than setting out a new general licensing regime for AI.
For companies operating across state lines, the immediate issue is that state requirements remain in force unless changed by law or court action. The federal administration has sought to challenge what it calls onerous state rules, but no congressional preemption law has passed. This leaves organizations facing a changing mix of state laws, federal policy and security directives, with the exact obligations depending on their activities and locations.
The plan also matters to residents because it concerns how the state prepares for cyberattacks and reviews the privacy and security of its own data systems. The directive establishes tasks, but it does not yet specify what changes agencies or technology companies will make after the reviews and exercises.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Apple MacBook Pro 2023 14 with M3 Pro Chip, 18 GB RAM, 2 TB SSD, Space Black
Apple MacBook Pro 16.2-inch with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 1TB SSD, Nano-Texture Display, Space Black
As an affiliate, we earn on qualifying purchases.
Federal Policy Meets State AI Laws
The Trump administration’s stated direction has been to limit what it considers burdensome state AI regulation and promote a national approach. Executive Order 14179 in January 2025 revoked the previous administration’s AI order. A July 2025 AI Action Plan said AI should not be “smother[ed] in bureaucracy” and opposed federal AI funding for states with burdensome rules, while recognizing what it described as prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and the Commerce Department to identify state laws deemed onerous. The supplied source says the task force launched in January 2026 and that no Commerce list had been published as of the source’s review. In March 2026, the White House sent Congress a framework calling for preemption of state laws that impose undue burdens, while leaving areas such as child protection and states’ own use of AI to state governments.
Congress has not adopted that proposal. The Senate rejected a proposed 10-year state-law moratorium by a 99-to-1 vote in July 2025, according to the source material. State rules have continued to move forward: California and Texas laws took effect in January 2026, while revised laws in New York and Colorado are scheduled to start in January 2027. Virginia’s directive is a cybersecurity planning order, not itself a broad AI statute.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Funding, Deadlines and Company Participation
The directive does not identify funding, a completion deadline or a public reporting schedule. It also says AI companies are to be asked to share reports, but the supplied text does not establish whether firms must comply, which companies will be approached, or how Virginia would handle confidential material. Details of the proposed consortium, including membership and operating procedures, remain unsettled in the source material.
It is also unclear what findings will emerge from the independent review of state data systems or from the annual exercise, and whether either will lead to new rules or operational changes. More broadly, the legal boundary between state and federal AI authority remains contested. Federal efforts to challenge state laws and proposals for preemption do not, by themselves, remove laws already in effect.
State Agencies Must Set the Work in Motion
Virginia’s public safety and homeland security secretary is tasked with establishing the Cyber Consortium and preparing the statewide plans. The AI Task Force is directed to begin quarterly company briefings, arrange an annual tabletop exercise and initiate the independent privacy and security review. The directive does not give dates for those first steps, so a timetable will depend on subsequent state actions.
Companies and residents can expect the broader state-federal dispute to continue through legislation, agency decisions and litigation. For now, the central confirmed point is that Virginia has ordered planning and review—not that a finished plan, new company mandate or federal preemption measure is already in place.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed a directive ordering a Cyber Consortium and statewide plans for preventing and responding to cyberattacks and strengthening infrastructure. It also calls for company briefings, an annual exercise and an independent review of state data systems.
Does the directive require AI companies to hand over confidential reports?
The directive says Virginia will ask companies to share reports they already provide to New York’s financial regulator and the EU AI Office. The supplied material does not establish a legal requirement that companies comply.
Has Congress barred states from regulating AI?
No. The source material says Congress has not passed a preemption law. A proposed 10-year moratorium on state AI laws was rejected in the Senate in July 2025.
When will Virginia’s plan be completed?
The directive gives no completion date or budget. State agencies must carry out the assigned planning and review work, but the timing remains unspecified.
Source: ThorstenMeyerAI.com
