🔍 Read the full analysis: A Closer Look At AI Rules After Virginia Orders Cyber Planning on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed an October 23 directive ordering a statewide cyber plan and regular briefings with AI companies. The move comes amid a federal push for a lighter, more uniform AI framework and ongoing state rulemaking; Congress has not enacted a law preempting state AI rules. Details such as the plan’s budget and completion date remain unspecified.
Executive Directive 6 instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium, create a statewide cyber response plan and develop measures to harden infrastructure. Virginia’s AI Task Force must hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least once a year.
The directive also calls for an independent team to review privacy and security practices across state data systems. Companies are to be asked to share confidential safety reports they already provide to New York’s financial regulator under the RAISE Act and to the European Union’s AI Office. The directive does not name a budget or deadline for completing the plans.
Spanberger’s announcement cited recently disclosed PHP software flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said those actions included fake public-records requests on a Virginia Department of Education site, and that no sensitive data was accessed. The directive itself sets out the state’s planning requirements; the governor’s statement provides the account of the events that prompted them.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Builds Its Own Cyber Response
The directive gives Virginia a formal process for planning around cyberattacks involving AI, but it does not establish a broad new set of statewide AI rules. Its practical effects will depend on how the consortium operates, what companies share and how state agencies use the resulting plans. The measure could also give other states a model for coordination: Virginia says it will invite states to join the effort on a bipartisan basis.
For companies, the larger issue is that federal preemption has not happened. Businesses may still need to track different state obligations, including reporting and disclosure rules, while assessing how their systems are used across jurisdictions. Virginia’s request for existing safety reports could add a new audience for information firms already prepare for other regulators, though the directive does not specify how those documents will be handled or whether every company will provide them.
The clash is not simply over how strict AI regulation should be. It is also about which level of government sets the rules. A single national standard could reduce the number of separate requirements, while state officials argue that local measures can address risks before federal policy is settled. The competing positions leave organizations operating under a developing mix of federal guidance and state laws.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
As an affiliate, we earn on qualifying purchases.
Federal Policy Meets State Laws
The White House has promoted a lighter, more uniform approach to AI regulation. An administration executive order issued in January 2025 revoked the prior federal AI order. The July 2025 AI Action Plan said the technology should not be “smother[ed] in bureaucracy” and opposed using federal AI funding for states with burdensome rules, while allowing for prudent laws.
A December 2025 order directed federal agencies to challenge some state AI laws and created a Justice Department task force. In March 2026, the White House sent Congress a framework calling for preemption of state rules it considers unduly burdensome, while leaving areas such as child protection and states’ own use of AI to state governments. Congress has not passed a preemption law; the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025, according to the source material.
Federal policy also includes security measures. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release review for the most capable models, according to the source. Meanwhile, state laws continue to take effect: California and Texas measures began on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027. The dates and rules differ, leaving companies to follow developments across jurisdictions.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan
Plan Details Still Missing
The directive does not specify how much the initiative will cost, when the statewide plans must be completed or what authority the consortium will have beyond coordinating planning. It also does not say how Virginia will protect, store or use confidential company briefings, or whether firms will be required to provide them. The language says companies are to be asked to share reports, rather than setting out a new mandatory reporting rule.
The scale and implications of the cited incidents also remain limited by the information provided. The governor said no sensitive data was accessed in the website episode, but the source material does not provide a technical account of the activity or an independent review of it. The full scope of the disclosed software flaws and any resulting exposure is also not detailed here.
At the federal level, it remains uncertain whether Congress will adopt a national standard or preempt any state requirements. A federal framework has been proposed, but a proposal is not law. The source material also reports that an administration-ordered list of state laws deemed onerous had not been published as of its review; its current status is not established here.
State Planning Moves to Implementation
Virginia’s next stated steps are to form the Cyber Consortium, prepare the statewide prevention and response plan, and arrange regular company briefings and annual exercises. The directive also calls for an independent privacy and security review of state data systems and invites other states to participate. It sets no completion date, so the timetable for those actions has not been announced.
Companies and public agencies will also be watching for further federal action and upcoming state-law start dates. New York’s and Colorado’s revised rules are scheduled to take effect on January 1, 2027. Until lawmakers enact a federal preemption measure, organizations should expect the state-level framework to remain relevant; the details of any future national standard, and its interaction with existing laws, are unsettled.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed Executive Directive 6, ordering a Cyber Consortium and statewide plans to prevent and respond to cyberattacks and harden infrastructure. It also requires regular AI company briefings and annual exercises.
Does the directive require AI companies to file new reports?
The directive says companies are to be asked to share confidential reports they already provide to New York’s financial regulator and the EU AI Office. It does not set out a new mandatory reporting requirement.
Has Congress overridden state AI laws?
No. The source material says Congress has not passed a law preempting state AI rules. The White House has proposed a framework, but it is not legislation.
When do the New York and Colorado AI laws take effect?
The source material says revised laws in both states are scheduled to take effect on January 1, 2027. California and Texas measures took effect on January 1, 2026.
What details about Virginia’s plan are unknown?
The directive does not provide a budget, completion date or detailed rules for handling confidential company briefings. The full technical details of the incidents cited by the governor are also not provided.
Source: ThorstenMeyerAI.com
