🔍 Read the full analysis: Are AI Rules Changing? Virginia Orders Cyber Planning As Washington Urges Restraint on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed an October 23 directive ordering statewide planning for cyberattacks, including those involving AI, and regular briefings with AI companies. The move comes amid a federal-state dispute over AI regulation: the administration favors a lighter national framework and limits on some state laws, while states continue to set their own requirements. The directive does not specify a budget or deadline.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including threats involving AI. The order calls for regular briefings with AI companies and security reviews of state data systems, adding to a national dispute over whether AI rules should be set chiefly by Washington or by individual states.
Executive Directive 6 instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop plans for cyberattack response and infrastructure protection. The state’s AI Task Force must hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least once a year. It must also arrange an independent privacy and security review of state data systems and invite other states to participate on a bipartisan basis.
The directive asks AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. It does not set a budget or completion date. The governor’s announcement cited recently disclosed PHP software vulnerabilities and Anthropic’s report that its agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed.
The federal government’s approach is not solely deregulation. A June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source account. The Commerce Department also briefly cut off foreign access to two Anthropic models that month. At the same time, the administration has sought to curb what it calls burdensome state AI rules and promote a single national standard.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds State-Level Cyber Oversight
The directive puts practical questions about cybersecurity and AI oversight into state operations: how officials identify risks, test response plans and review systems holding public data. Quarterly company briefings and annual exercises could give state agencies a recurring channel to discuss emerging threats, although the directive does not describe the final plan’s scope or resources.
For businesses, the order is part of a broader patchwork rather than a replacement for existing laws. The source account says California and Texas laws took effect on January 1, 2026, while revised rules in New York and Colorado are scheduled to start on January 1, 2027. Until federal legislation changes that landscape, organizations may need to track requirements by state, customer and contract. The practical effect of Virginia’s request for confidential reports will depend on how companies respond and how the state handles the information.
The dispute also concerns authority, not just the strictness of rules. The administration argues that differing state requirements can burden companies and hinder innovation. State officials and attorneys general have pressed for federal safety rules that do not displace state authority. The outcome could shape which government level can impose AI requirements and how much flexibility companies have to use one compliance approach nationwide.
Products Worth Considering
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Jackery Solar Generator 1000 v2 with 200W Solar Panel
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State AI Laws
The administration’s policy shifted after President Donald Trump’s January 2025 order revoking the previous administration’s AI order. Its July 2025 AI Action Plan argued that AI should not be “smother[ed] in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while preserving what it called prudent laws. A December 2025 executive order said a range of state rules could make compliance harder, impose ideological bias or reach beyond state borders. It created a Justice Department task force to challenge state laws; the task force launched in January 2026.
In March 2026, the White House sent Congress a framework proposing preemption of state laws that impose undue burdens and restrictions on states regulating AI development, while leaving areas such as child protection and states’ own use of AI to state governments. Congress has not passed a preemption law. The source account says the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025. A bipartisan House proposal would preempt a narrower set of frontier-model rules.
Legal and political opposition remains active. The Justice Department intervened in a lawsuit over Colorado’s AI law in April 2026, arguing it violated equal protection. The enforcement was suspended by agreement, and Colorado repealed and replaced the law in May with a narrower disclosure-based measure due to take effect January 1, 2027. The source account also says 26 attorneys general asked Congress for federal safety rules and an explicit ban on preemption.
A separate opinion essay, first published by The Conversation on September 25, argued that an insufficiently regulated U.S. AI sector could pose a greater security risk than China’s progress. Its author cited an estimate that China has about one-tenth of U.S. computing power. That is an attributed argument and estimate, not a settled finding; it is distinct from the confirmed government action in Virginia.
Funding, Deadlines and Legal Reach
Virginia’s directive does not identify funding, a completion date or detailed implementation steps. It is also not clear which companies will provide confidential reports, what information they will share, or how Virginia will protect and use those materials. The directive requests briefings and disclosures; the source account does not say that companies are legally compelled to comply.
The boundary between federal and state authority remains unsettled. Congress has not enacted the White House’s proposed preemption, and ongoing legal and legislative efforts could alter the rules. The source account reports that a Commerce Department list of state laws described as onerous had not been published as of its review, but it does not establish whether that status has since changed. The administration and states also disagree over whether particular laws protect the public or impose excessive burdens.
The source material describes a June 2026 federal cybersecurity order and model-access action, but does not provide full implementation details, the duration of the access cutoff, or the criteria for the voluntary model checks. Those points should not be treated as a complete account of the federal program.
Virginia’s Planning and Federal Action
Virginia’s next steps under the directive are for the responsible agencies to establish the Cyber Consortium, arrange the required briefings and tabletop exercise, and develop cyber response and infrastructure plans. The order sets recurring activities but no final deadline. The independent review of state data systems is another specified task, though its scope and schedule are not given.
At the federal level, the dispute will turn on whether Congress advances legislation, whether the administration continues legal challenges to state rules, and how courts resolve those cases. Companies should not assume federal preemption is imminent: for now, the source account describes state-by-state requirements already in force or scheduled to begin. The precise obligations for any organization depend on the laws that apply to its products, customers and contracts.
Key Questions
What did Virginia order?
Executive Directive 6 orders state officials to create a Cyber Consortium and develop plans to prevent and respond to cyberattacks and protect infrastructure. It also requires recurring AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
The directive asks companies to share safety reports they already submit to New York’s financial regulator and the EU’s AI Office. The source account does not say that Virginia can compel companies to provide them or explain how the state will handle the reports.
Has the federal government banned state AI laws?
No. The administration has proposed limiting some state rules and has challenged a state law, but Congress has not passed a federal preemption law, according to the source account. State requirements therefore remain relevant, subject to individual legal developments.
When do the state AI laws mentioned in the report take effect?
The source account says California and Texas AI laws took effect on January 1, 2026. Revised New York and Colorado laws are scheduled to take effect on January 1, 2027.
What remains unknown about Virginia’s plan?
The directive gives no budget or completion date. Details about the plan’s specific measures, the scope of the data-system review and whether companies will provide confidential reports have not been established in the source material.
Source: ThorstenMeyerAI.com
