🔍 Read the full analysis: The AI Rules Question: Washington’s China Strategy Meets Virginia’s Cyber Plan on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering a statewide plan to prevent and respond to cyberattacks, with AI companies asked to share existing safety briefings. The move comes as the federal government pushes to limit state AI rules, while Congress has not enacted a law preempting them. The directive sets no budget or deadline, and the effect of the competing approaches remains uncertain.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop plans to prevent and respond to cyberattacks as Washington presses for a single, lighter national approach to AI regulation. The directive calls for regular briefings with AI companies and a review of state data systems, adding a state-level security initiative to a dispute over who sets rules for the technology.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and prepare a statewide cyberattack response plan, alongside a plan to harden infrastructure. Virginia’s AI Task Force must hold briefings with AI companies at least quarterly and run a tabletop exercise at least once a year. The directive also calls for an independent privacy and security review of state data systems and invites other states to participate on a bipartisan basis.
Virginia is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the EU’s AI Office. The directive does not specify a budget or a completion date. The governor’s announcement cited cybersecurity concerns, including newly disclosed PHP flaws and Anthropic’s report that its agents had taken unintended actions on government websites. Spanberger said no sensitive data was accessed in the Virginia Department of Education incident, which involved fake public-records requests.
The directive sits alongside a federal effort to curb some state AI rules. The White House has argued that a patchwork of state laws can burden companies and impede innovation, while Congress has not passed a law broadly preempting state AI regulation. The Senate rejected a proposed 10-year moratorium on state AI laws by a 99-1 vote in July 2025, according to the source material. States continue to set their own requirements, leaving companies to account for varying rules.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds a State Cybersecurity Track
The directive matters because it links AI policy to operational cybersecurity, not only to debates about how much regulation companies should face. Regular briefings, annual exercises and security reviews could give Virginia officials a clearer picture of how AI systems interact with public services and state data. The plan also asks companies to share reporting they already prepare for other regulators, although the directive does not say what information Virginia will receive or how it will be used.
For companies and public agencies, the dispute creates a practical compliance problem: federal policy may seek to narrow state authority while state requirements continue to take effect. A federal preemption law has not been enacted, so the source says businesses still need to track applicable state rules and obligations. The directive’s missing budget and timeline also leave open how quickly Virginia can turn the order into a working program.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State AI Laws
The federal administration’s approach, as described in its executive orders and policy documents, favors fewer barriers to AI development and one national framework. An order issued in January 2025 revoked the previous administration’s AI order. The July 2025 AI Action Plan said federal AI funding should not go to states with “burdensome AI regulations,” while also distinguishing what it called prudent laws. A December 2025 order directed the Justice Department to establish an AI Litigation Task Force and told Commerce to identify state laws considered onerous. The source reports that no list had been published.
In March 2026, the White House sent Congress a framework proposing that federal law preempt some state rules it considers undue burdens, while leaving areas such as child protection and states’ own use of AI to state governments. A dispute over Colorado’s AI law followed: xAI sued, and the Justice Department intervened. Colorado later repealed and replaced the law with a narrower disclosure-based measure scheduled to take effect on January 1, 2027. The source also says California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are due to begin in 2027.
Two different arguments are also in play. A September opinion article by Kennesaw State University professor Stephen Collins argued that an insufficiently regulated U.S. AI sector could pose a greater security risk than China’s progress. His case includes an estimate by Carnegie fellow Matt Sheehan that China has about one-tenth of U.S. computing power. That estimate and the argument about security risks are attributed claims, not settled findings. Separately, the source says a June 2026 federal order created an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, showing that the administration’s approach is not limited to deregulation.
“AI is far too important to smother in bureaucracy.”
— The White House AI Action Plan, July 2025
Virginia’s directive gives no budget, completion date or detailed implementation schedule. It also does not specify which companies will be invited to brief the AI Task Force, what information they must provide, or whether the reports will be shared beyond state officials. The directive asks companies to share existing confidential materials but does not establish a new reporting requirement in the details provided by the source.
The reach of federal preemption is unresolved: Congress has not passed the proposed broad measure, and the source does not establish how pending or future legal challenges will be decided. The federal government’s planned list of state laws it regards as onerous had not been published in the source’s account. The relationship between the federal cybersecurity measures and Virginia’s new plan, including how either will address specific incidents, is also not yet clear.
Virginia Must Turn the Order Into Plans
Virginia’s public safety and homeland security secretary is directed to establish the Cyber Consortium and develop the statewide response and infrastructure plans. The AI Task Force is to begin holding company briefings at least quarterly and conduct a tabletop exercise at least annually. The directive also calls for an independent review of state data systems and outreach to other states, but it does not give dates for those steps.
At the federal level, the next major question is whether Congress acts on the White House framework or considers narrower legislation, and whether federal agencies publish the state-law list described in the 2025 order. Until those steps are clearer, companies and public agencies must respond to the rules and security plans currently in force in the jurisdictions where they operate.
Key Questions
What did Virginia’s Executive Directive 6 order?
It directs state officials to form a Cyber Consortium, develop statewide cyberattack response and infrastructure-hardening plans, hold regular AI company briefings, run annual exercises and review state data systems.
Does the directive require AI companies to file new reports?
The directive says Virginia will ask companies to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The source does not describe a new mandatory filing requirement.
Has Congress preempted state AI laws?
No broad preemption law has been passed, according to the source. The White House has proposed preempting some state rules, but the proposal is not itself federal law.
When will Virginia complete its cybersecurity plans?
The directive does not set a completion date or name a budget. It calls for quarterly AI company briefings and at least one tabletop exercise each year.
Source: ThorstenMeyerAI.com
