🔍 Read the full analysis: How Washington’s Push To Regulate Less Clashes With Virginia’s AI Cyber Order on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed an Oct. 23 directive calling for a statewide cyber response plan and regular briefings with AI companies, including requests for safety reports they provide to New York and the EU. The move lands amid the Trump administration’s effort to limit state AI rules and promote a lighter national framework; Congress has not enacted a federal preemption law.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 ordering work on a statewide plan to prevent and respond to cyberattacks, including threats involving artificial intelligence. The directive also calls for regular briefings with AI companies and requests that they share safety reports already provided to New York regulators and the European Union, putting Virginia’s security push against the Trump administration’s effort to constrain state AI regulation.
Executive Directive 6 instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop statewide plans for cyberattack response and infrastructure protection. The state’s AI Task Force is directed to hold company briefings at least quarterly, conduct an annual tabletop exercise, and arrange an independent privacy and security review of state data systems. It is also asked to invite other states to participate on a bipartisan basis.
The directive says companies are to be asked for confidential safety briefings they already submit under New York’s RAISE Act and to the EU AI Office. It does not specify a budget or deadline for completing the plans. The source account says the governor’s announcement cited recently disclosed software flaws and Anthropic’s report that its agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed.
The state action is part of a wider federal-state dispute, but it is not itself a comprehensive AI regulation. The directive focuses on cybersecurity preparedness, information-sharing and government systems. Washington’s stated policy favors a lighter national framework and challenges some state requirements; Congress has not passed a law preempting state AI rules.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Security Plan Meets Federal Preemption Push
The dispute affects which rules companies must follow as they sell or deploy AI across the country. The federal government argues that a patchwork of state laws can raise compliance costs and hinder innovation, while state officials have pursued requirements and preparedness measures tied to local risks. Virginia’s directive could add another state-level process for companies to address, although it requests existing reports rather than setting out a new disclosure regime with specified penalties.
For residents and public agencies, the directive focuses on the ability to prepare for and respond to cyber incidents involving AI, as well as on reviews of state data systems. Its practical effect will depend on how the plans are written, what information companies provide, and whether the consortium produces shared procedures or recommendations. Those details are not set in the order described in the source material.
The broader policy stakes remain unsettled. Federal efforts to discourage or challenge some state laws have not amounted to a general preemption statute. Meanwhile, states continue to legislate and issue directives. That leaves organizations operating across state lines facing a changing set of requirements while courts, agencies and lawmakers debate how much authority belongs at each level.
Products Worth Considering
Apple iPad Air (4th Generation, 10.9-inch, Wi-Fi, 256GB) – Space Gray
Logitech MX Keys S Wireless Keyboard, Graphite
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
As an affiliate, we earn on qualifying purchases.
Federal Policy and State AI Rules
The Trump administration’s approach has developed through executive actions and policy statements. President Donald Trump’s January 2025 Executive Order 14179 revoked the prior administration’s AI order. The July 2025 AI Action Plan described AI as too important to be burdened by bureaucracy and said federal funding should not go to states with what the administration calls burdensome AI regulations, while also saying prudent state laws should not be interfered with.
A December 2025 executive order argued that differing state regimes complicate compliance, particularly for startups, and raised concerns about laws with effects beyond their borders and laws the administration says could impose ideological bias. It established a Justice Department task force to litigate against certain state laws. A March 2026 White House framework called for Congress to preempt state laws that impose undue burdens, while preserving state authority in areas including child protection, zoning and government use of AI. These are administration positions and proposals, not a federal statute that has displaced state law.
Security has also appeared in federal policy. According to the source account, a June 2026 order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. That record complicates a simple description of Washington as taking no action on AI security: the central disagreement is also about the scope, authority and enforceability of rules.
“AI is far too important to smother in bureaucracy.”
— The Trump administration’s July 2025 AI Action Plan
Implementation and Legal Reach Remain Open
The directive does not name a budget, set a completion date, or spell out what companies must do if they decline to provide reports. It is also unclear how Virginia will handle the confidential material it requests, who will have access to it, and whether companies will provide the same reports they submit to New York and the EU.
The source material does not establish whether the federal government will challenge this particular directive. It is not clear how the proposed consortium will operate or whether other states will join. Nor has Congress enacted the broad preemption sought by the administration: the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-1 vote in July 2025, according to the source account.
The legal status of individual state rules may continue to change. The source says California and Texas laws took effect January 1, 2026, while revised New York and Colorado laws are scheduled to begin January 1, 2027. Those measures have different scopes, and the source does not provide enough detail to treat them as equivalent or to determine how every rule applies to a particular company.
State Plans and Federal Challenges Ahead
Virginia’s public safety and homeland security secretary is expected to organize the Cyber Consortium and develop the cyber response and infrastructure plans. The AI Task Force’s next steps include quarterly company briefings, an annual tabletop exercise and an independent review of state data systems. The directive sets those tasks but, as described in the source, gives no public timetable for their completion.
Companies should watch for details on how Virginia will request, store and use existing safety reports, as well as any guidance the state issues for agencies and vendors. At the national level, the administration may continue its legal and policy efforts against some state laws, while Congress could consider legislation defining which state rules remain in force. The immediate position, however, is that the federal government has not enacted general preemption and Virginia has begun planning under its new directive.
Key Questions
What did Virginia’s directive order?
It calls for a Cyber Consortium, statewide plans for cyberattack response and infrastructure protection, quarterly AI-company briefings, an annual tabletop exercise and an independent review of state data systems.
Does the directive create a new AI safety law?
The source describes it as an executive directive focused on cybersecurity planning and information-sharing. It asks companies to provide safety reports already filed with New York and the EU; it does not set out a broad new AI compliance code.
Has Washington barred states from regulating AI?
No general federal preemption law has been enacted, according to the source material. The administration has used executive actions, policy proposals and legal challenges to oppose some state requirements.
What remains unknown about Virginia’s plan?
The directive gives no budget or completion date. Details about report handling, company participation, consortium operations and whether other states will join have not been specified in the source material.
Source: ThorstenMeyerAI.com
