🔍 Read the full analysis: The Federal-State AI Policy Puzzle: Virginia’s Cyber Plan And Washington’s Approach on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed an Oct. 23 directive calling for a statewide plan to prevent and respond to cyberattacks, including attacks involving AI. The move comes amid a federal-state dispute over AI regulation: the White House seeks a lighter national approach and limits on some state laws, while states continue to set requirements of their own.
The directive, identified as Executive Directive 6, instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop plans for cyberattack response and infrastructure security. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly and conduct an annual tabletop exercise. A separate team is to review privacy and security practices across state data systems.
Virginia plans to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. The directive does not say that companies must produce the reports, and it sets no funding allocation or deadline for completing the statewide plans. It invites other states to participate in the effort on a bipartisan basis.
Spanberger’s announcement cited recently disclosed software flaws and Anthropic’s account of AI agents taking unintended actions on government websites. According to the governor, the activity included fake public-records requests on a Virginia Department of Education website, and no sensitive data was accessed. Those points were presented as reasons for the directive; the material provided does not include an independent technical account of the incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Builds Its Own Cyber Response
The directive creates a state-level process for planning, exercises and company briefings at a time when the federal government is pursuing a lighter national framework and challenging some state AI rules. For organizations that operate across state lines, the dispute affects which reporting and safety obligations may apply, and whether one federal standard will eventually replace parts of the current patchwork.
Virginia’s plan is focused on cybersecurity and government systems, rather than setting out a broad AI code for private-sector development. Still, its request for existing company safety briefings could give state officials information about risks and practices that are also being discussed in federal policy. How much information companies share, and how the state will use it, is not specified in the directive as described.
The practical effect is not yet a new, fully defined compliance regime. The state must still organize the consortium, establish its plans and determine how the reviews and exercises will work. For residents, the directive signals a government effort to prepare for cyber incidents; it does not establish that Virginia’s systems have suffered a breach or that the cited AI activity exposed sensitive data.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
Federal and State AI Rules Diverge
The federal administration has argued for a single, comparatively light national standard. An executive order in January 2025 revoked the prior federal AI order. The administration’s July 2025 AI Action Plan said federal funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws. A later executive order directed the Justice Department to create an AI Litigation Task Force and instructed the Commerce Department to identify state laws considered onerous.
In March 2026, the White House sent Congress a framework proposing that federal policy preempt state laws judged to impose undue burdens, while preserving state authority over areas including child protection, zoning and state government use of AI. Congress has not passed a preemption law, according to the source material. A proposed 10-year moratorium on state AI regulation was removed from a Senate bill in July 2025 by a 99-to-1 vote.
States have continued to act. California and Texas AI laws took effect on January 1, 2026, while rewritten laws in New York and Colorado are scheduled to begin on January 1, 2027. In Virginia, the directive’s request for safety reports already provided to New York and the EU links its cyber planning to requirements outside the state. The policy debate is not simply over how strict rules should be: it is also about which level of government has authority to set them.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan
Funding, Deadlines and Reporting Details
Virginia’s directive does not specify how much the plan will cost, when it must be completed or what authority the consortium will have. It also does not establish whether companies will provide their confidential reports, how the state will handle them or whether the briefings will lead to additional rules.
The federal-state dispute remains unsettled. Congress has not enacted the proposed preemption framework, and the source material reports that the Commerce Department’s planned list of state laws considered onerous had not been published. It is unclear whether the administration will publish such a list, bring further legal challenges or secure legislation limiting state authority.
The circumstances of the incidents cited by Virginia also remain only partly detailed in the supplied material. The governor said no sensitive data was accessed in the activity involving the education department website. Further technical findings, the full scope of the activity and any resulting changes to state systems are not provided here.
State Plans and Federal Action Ahead
Virginia’s public safety and homeland security secretary is to organize the Cyber Consortium and develop the state’s cyber response and infrastructure plans. The AI Task Force is directed to hold quarterly company briefings and an annual tabletop exercise, while the privacy and security review of state data systems is another step to be arranged. The directive does not provide dates for those activities.
At the federal level, the next developments depend on whether Congress acts on the White House framework and whether the administration moves ahead with its efforts to contest or limit state rules. State requirements already in force, along with laws scheduled to start in 2027, remain relevant while that question is unresolved. Companies and public agencies will have to track the rules that apply in each jurisdiction rather than assume a federal preemption measure is imminent.
Key Questions
What did Virginia’s directive require?
It directs state officials to establish a Cyber Consortium and develop statewide plans for preventing and responding to cyberattacks and protecting infrastructure. It also calls for regular AI-company briefings, an annual exercise and a review of state data-system privacy and security.
Does the directive require AI companies to hand over confidential reports?
It says Virginia officials are to ask companies to share reports they already provide to New York’s financial regulator and the EU AI Office. The supplied material does not establish that companies are legally required to provide them.
Has the federal government preempted state AI laws?
No federal preemption law is identified in the source material. The White House has proposed limits on some state rules, but Congress has not enacted that framework.
When do the state AI laws take effect?
The source material says California and Texas laws took effect on January 1, 2026. Rewritten laws in New York and Colorado are scheduled to begin on January 1, 2027.
Source: ThorstenMeyerAI.com
