🔍 Read the full analysis: What AI Rules Apply After Virginia Orders A Cyber Plan? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering work on a statewide plan to prevent and respond to cyberattacks, including AI-driven threats. It calls for quarterly briefings with AI companies and asks them to share existing safety reports, but does not set a budget or completion date. Federal efforts to limit some state AI rules have not produced a general preemption law, so applicable requirements still depend on the state and the activity involved.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, directing state officials to develop a statewide plan to prevent and respond to cyberattacks and to hold quarterly briefings with AI companies. The directive matters amid a broader dispute over AI oversight: federal officials have pushed for a lighter national approach and challenges to some state laws, while no federal law preempting state AI rules has been passed, according to the source material.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and produce plans for cyberattack prevention, response and infrastructure protection. It also assigns tasks to the state’s AI Task Force: briefings with AI companies at least quarterly, an annual tabletop exercise, and an independent privacy and security review of state data systems. Virginia will invite other states to participate on a bipartisan basis.
Companies are to be asked to share confidential safety reports they already submit to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or deadline for completing the statewide plan, and the source does not say whether companies would be legally required to provide the reports.
Spanberger cited newly disclosed PHP software flaws and Anthropic’s account of its agents taking unintended actions on government websites, including submitting fake public-records requests on a Virginia Department of Education site. The governor said no sensitive data was accessed. The directive creates planning and review tasks; the material provided does not establish that the incidents were caused by a breach of state systems or that the plan is already in operation.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Cyber Plan and Company Requests
The directive could give Virginia agencies a more formal way to coordinate cyber preparedness and examine how AI systems interact with public services. The requirement for regular briefings and an annual exercise could also help state officials identify risks before an incident, though the source material provides no schedule beyond the minimum frequency and no details about how the exercises will be run.
For AI companies, the immediate issue is a request to provide information they already share with regulators elsewhere. Whether the state will seek new reporting duties, what information companies will be expected to provide, and how confidential material will be protected are not specified. The directive is therefore a state planning and information-gathering move, not evidence of a new, comprehensive Virginia AI law.
For residents and businesses, the larger practical point is that AI obligations remain fragmented. Federal policy proposals and litigation have not erased existing state requirements. Organizations using AI may need to track rules by jurisdiction, product and activity rather than assume that a single national standard has replaced state law.
Popular right now
Samsung 42-Inch S90H OLED 4K Smart TV Bundle
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
Federal Policy Meets State Rules
The federal administration’s stated approach favors a lighter national AI standard and has directed agencies to challenge certain state laws. Executive orders and a 2025 federal action plan described state-by-state requirements as a burden, while a December 2025 order established a Justice Department task force to address state AI laws. A White House framework sent to Congress in March 2026 proposed preempting some state rules, but it was a framework, not enacted legislation. The source says a Senate vote in July 2025 rejected a proposed 10-year moratorium on state AI laws, 99 to 1.
Federal action on AI security has also proceeded alongside the deregulatory push. The source describes a June 2026 executive order establishing an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. These measures do not by themselves settle which state laws apply. Separately, the source reports that California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027.
The Virginia directive is distinct from the political argument over whether the United States should regulate AI more or less than China. The source attributes that comparison to an opinion essay by Kennesaw State University professor Stephen Collins, and describes its security argument as contested. The confirmed Virginia development is the governor’s signed directive and the duties it assigns to state officials.
Plan Funding and Reporting Terms
The directive names no budget or completion date, and the source material does not identify a published implementation schedule. It also remains unclear whether AI companies will be asked to share reports voluntarily or face any enforceable requirement, what information the state will seek, and how confidential reports would be stored or used.
The source says federal officials directed Commerce to identify state laws considered burdensome, but reports that no list had been published as of the account. It does not establish the current status of every state law or how future litigation and congressional action may affect them. Spanberger’s account of the incidents that prompted the directive is attributed to her announcement; the material does not include independent technical findings about their scope or cause.
Agencies Must Set the Work
Virginia’s public-safety secretary and AI Task Force now have to turn the directive into operational plans, establish the Cyber Consortium and arrange the required company briefings and annual exercise. The directive also calls for an independent review of state data systems, but the source provides no dates for those steps or for release of the plans.
Companies and public agencies will have to watch for further guidance explaining the requested reports and any confidentiality safeguards. Separately, state AI laws and federal efforts to challenge or preempt them remain subject to legislative and legal developments; no general federal preemption law is confirmed in the supplied material.
Key Questions
What did Virginia order?
Executive Directive 6 directs state officials to develop plans for preventing and responding to cyberattacks, protect infrastructure, establish a Cyber Consortium and carry out specified AI-related briefings, exercises and reviews.
Does the directive create a new AI law?
The source describes it as an executive directive assigning work to state agencies. It does not establish a broad new AI statute or specify penalties for companies that do not provide requested reports.
The directive says companies are to be asked to share reports they already submit to New York’s financial regulator and the EU’s AI Office. The supplied material does not say whether the request is mandatory or set out confidentiality terms.
Have federal officials replaced state AI rules with one national standard?
No general federal preemption law is identified in the source material. Federal proposals and legal challenges are underway, while state requirements continue to apply according to their terms and effective dates.
Source: ThorstenMeyerAI.com
