🔍 Read the full analysis: AI Policy Across Federal And State Lines: Virginia’s Cyber Plan Explained on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state agencies to develop a statewide plan to prevent and respond to cyberattacks, including attacks involving AI. The directive comes as the federal government seeks to limit state AI regulation, while states continue to adopt their own rules; its budget, timetable and legal reach remain unclear.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks and to strengthen infrastructure. The directive calls for regular briefings with AI companies and comes as the federal government pushes for a lighter, more uniform approach to AI regulation while states continue to set their own requirements.
The directive instructs the Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and produce plans for cyberattack response and infrastructure protection. Virginia’s AI Task Force must hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. The directive also invites other states to participate on a bipartisan basis.
Virginia plans to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. The directive does not state a budget or a deadline for completing the plans. It describes a request for existing reports, not a new general reporting mandate for every AI company.
Spanberger’s announcement cited recently disclosed software vulnerabilities and Anthropic’s report that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed. That account is attributed to the governor; the directive itself establishes the planning and review requirements.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets a Federal-State Standoff
The directive adds a state-level security initiative to a policy landscape where federal preemption remains unsettled. The federal administration has argued that differing state laws create compliance costs and can impede AI development. Virginia’s action, by contrast, focuses on cyber preparedness and asks companies to share information they already provide in other jurisdictions.
For companies operating across state lines, the immediate practical issue is that requirements may vary by location. The source account says California and Texas laws took effect in January 2026, while revised laws in New York and Colorado are scheduled to begin in January 2027. Virginia’s directive does not itself resolve that patchwork or establish a single national standard.
The directive also links AI policy to the security of public services and government systems. A statewide exercise and independent review could help agencies identify gaps, but the directive does not specify funding, performance measures or how findings will be made public. Its impact will depend on how state officials carry out the assignments.
Products Worth Considering
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
As an affiliate, we earn on qualifying purchases.
Federal Policy and State AI Rules
The federal administration’s approach began with Executive Order 14179 in January 2025, which revoked the prior administration’s AI order. A July 2025 AI Action Plan called AI too important to “smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The source account reports that a list had not been published as of its October 27, 2026 publication. A White House framework sent to Congress in March 2026 proposed preempting some state rules, but Congress has not enacted a broad preemption law. A proposed 10-year moratorium was defeated in the Senate 99 to 1 in July 2025, according to the source.
Federal action has also included a security track. The source reports that a June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. These federal steps do not replace state laws. The account also describes a bipartisan House proposal that would preempt only a narrower set of frontier-model rules, and a request from 26 attorneys general for federal safety rules and an explicit ban on preemption.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Funding, Deadlines and Legal Reach
Virginia’s directive sets out tasks but provides no named budget or completion date. It is not clear when the Cyber Consortium will be formed, when the statewide plans will be published, or what resources agencies will use to carry out the reviews and exercises.
The directive says companies are to be asked to share reports already provided to New York and the EU, but it does not specify which companies will be approached, how information will be protected, or whether participation is voluntary. It also remains unclear how the state will respond if companies decline to share confidential material.
The broader legal dispute is unresolved. The White House has sought to challenge state AI laws, but Congress has not passed a general preemption measure. The source account describes litigation and proposed legislation, not a final federal rule that settles which state requirements will remain in force.
State Agencies Begin Implementation
The next steps under the directive are for Virginia’s public safety and homeland security secretary to establish the Cyber Consortium and begin work on the cyberattack and infrastructure plans. The AI Task Force is directed to organize quarterly company briefings, schedule an annual exercise and arrange the independent review of state data systems. The directive does not give dates for those first milestones.
Companies and public agencies will also be watching for further federal action, including any published Commerce Department assessment of state laws, court decisions and congressional proposals. Until those developments clarify the boundary between federal and state authority, organizations operating in multiple jurisdictions will need to track the rules that apply to their activities and locations.
Key Questions
What did Virginia’s Executive Directive 6 require?
It directed state officials to establish a Cyber Consortium and develop plans to prevent and respond to cyberattacks and strengthen infrastructure. It also calls for quarterly AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
Does Virginia’s directive create a new AI law for companies?
The directive chiefly assigns planning and review tasks to state officials. It says AI companies will be asked to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office; it does not set out a new general reporting requirement for all companies.
Has the federal government preempted state AI laws?
No broad federal preemption law has been enacted, according to the source account. The administration has issued orders and proposed a framework, while Congress and courts remain part of the ongoing dispute.
When will Virginia’s cyber plan be completed?
The directive gives no completion date or budget. It is not yet clear when the state plans will be finished or when the first company briefings and tabletop exercise will take place.
Source: ThorstenMeyerAI.com
