🔍 Read the full analysis: Virginia Orders AI Cyber Planning: What It Signals For The Rules That Apply on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including those involving AI. It also calls for regular briefings with AI companies and reviews of state data systems, while leaving key details such as funding and deadlines unspecified. The move highlights a broader dispute over state and federal authority: Congress has not passed a law preempting state AI rules.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks and strengthen infrastructure. The directive also calls for regular briefings with AI companies, placing the state’s security planning in the middle of a broader dispute over who sets the rules for artificial intelligence.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop a statewide cyberattack response plan, alongside a plan to harden infrastructure. It assigns additional work to the state’s AI Task Force: hold briefings with AI companies at least quarterly, conduct a tabletop exercise at least once a year and arrange an independent privacy and security review of state data systems.
Virginia intends to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive also invites other states to participate on a bipartisan basis. It does not specify a budget or a date by which the plans and reviews must be completed.
Spanberger’s announcement cited recently disclosed PHP flaws and Anthropic’s account of its AI agents taking unintended actions on government websites. The governor said those actions included fake public-records requests on a Virginia Department of Education site, and that no sensitive data was accessed. That account is the administration’s description of the incident; the source material does not provide an independent technical review.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets a State-Federal Divide
The directive is a concrete state-level response to concerns about AI-related cyber risks, but it also raises practical questions for companies already facing rules in several jurisdictions. Virginia wants companies to share safety briefings they provide elsewhere, potentially making existing reporting and documentation relevant to state preparedness. The order itself does not establish a new general AI compliance regime or spell out penalties for companies that do not participate.
The wider policy dispute concerns regulatory authority as well as regulatory strictness. The federal administration has pursued a lighter national framework and challenged some state requirements, while states continue to enact their own laws. Congress has not passed a law preempting state AI rules. For now, businesses cannot assume a federal standard has displaced state obligations; the exact duties depend on applicable laws, the company’s activities and the jurisdictions involved.
Virginia’s approach also links cybersecurity planning to broader questions about transparency and privacy. Briefings and independent reviews could help officials identify risks in public systems, but their value will depend on what information companies provide, how sensitive material is handled and whether the state has resources to act on findings. Those operational details are not set out in the directive as described in the source.
Popular right now
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Breville Barista Pro Espresso Machine with Grinder, Brushed Stainless Steel
Roborock Robot Vacuum and Mop with LiDAR Navigation and 10,000 Pa Suction
As an affiliate, we earn on qualifying purchases.
How the AI Rules Fight Developed
The federal administration’s position is reflected in actions that began in 2025. Executive Order 14179 revoked the prior administration’s AI order in January 2025. The July 2025 AI Action Plan argued that AI should not be burdened by bureaucracy and said federal funding should not go to states with burdensome AI regulations, while recognizing what it called prudent state laws. A later executive order cited the cost of complying with multiple state regimes, concerns about ideological bias and the reach of some state laws beyond their borders.
The administration also created a Justice Department AI Litigation Task Force and directed the Commerce Department to identify state laws it considered onerous. The source reports that a list had not been published as of its review. In March 2026, the White House sent Congress a framework proposing to preempt some state restrictions while leaving areas such as child protection and state governments’ own AI use to the states. A federal lawsuit challenging Colorado’s AI law followed; Colorado later replaced that law with a narrower disclosure-based statute set to take effect in 2027.
State laws remain in force on their own schedules. According to the source, California and Texas laws took effect on Jan. 1, 2026, while revised laws in New York and Colorado are scheduled to begin on Jan. 1, 2027. Against that backdrop, Virginia’s Oct. 23 directive focuses on cyber preparedness and information-sharing rather than announcing a comprehensive AI law.
Funding, Deadlines and Data Protections
The directive does not identify funding, completion dates or implementation milestones for the consortium, statewide plans, annual exercise or independent review. It is also unclear which AI companies will be approached, what information they will be asked to provide, whether sharing will be voluntary and how Virginia will protect confidential reports once received.
The source describes the reported actions by Anthropic’s agents and the governor’s statement that no sensitive data was accessed, but does not provide a technical investigation or further details about the affected systems. The directive’s practical effect on companies is also not yet clear: it requests briefings and reports, but the available material does not describe new penalties or a separate Virginia AI safety law.
At the federal level, the dispute over preemption remains unresolved. The source says Congress has not enacted a law overriding state AI requirements. It also reports that a Senate proposal for a 10-year moratorium on state AI laws was rejected 99-1 in July 2025, while a separate bipartisan House proposal would preempt only a narrow set of frontier-model rules. Those developments do not settle what future federal legislation may do.
State Agencies Begin Planning
The next steps under the directive are for the Secretary of Public Safety and Homeland Security to organize the Cyber Consortium and for the AI Task Force to arrange company briefings and an annual tabletop exercise. The directive also calls for an independent review of state data systems. No public timetable is specified, so the timing and scope of those activities remain to be announced.
Companies operating across state lines should track the laws that apply to their products and customers rather than assume that federal preemption is imminent. The source advises maintaining incident-reporting plans that can meet different deadlines, but the applicable reporting duties vary by law and incident; the directive itself does not set a new universal reporting clock.
Further developments may come from Virginia’s implementation work, state lawmakers and federal court or congressional action. Until those steps produce binding changes, the central practical picture remains a state-by-state patchwork alongside federal efforts to limit or standardize some requirements.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger’s Oct. 23 directive orders state officials to create a cyber consortium and plans to prevent and respond to cyberattacks and strengthen infrastructure. It also calls for quarterly AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
Does the directive create a new AI law for Virginia companies?
The source describes it as a directive focused on state cybersecurity planning and information-sharing. It does not identify a new general AI compliance law, penalties or a universal reporting duty for companies.
Why is Virginia seeking AI-company safety reports?
The state plans to ask companies to share confidential reports they already provide to New York’s financial regulator under its RAISE Act and to the EU AI Office. The directive’s stated aim is to inform state cyber preparedness; the precise process and safeguards are not yet specified.
Have federal officials overridden state AI rules?
No federal preemption law has been passed, according to the source. The administration has pursued a federal framework and challenged some state rules, but businesses must still assess which state laws apply to them.
What remains unknown about implementation?
The directive gives no budget or completion date. The state has not specified which companies will be invited, what information they must share, how reports will be protected or when the plans and review will be finished.
Source: ThorstenMeyerAI.com
