🔍 Read the full analysis: How Virginia’s AI Cyber Plan Fits Into Washington’s Competition-with-China Strategy on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering a statewide plan to prevent and respond to cyberattacks, with specific attention to AI companies and systems. The directive arrives amid a federal push for a lighter national AI framework and efforts to limit some state rules; Congress has not enacted a law preempting them. Virginia has not named a budget or deadline for the plan.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, directing state officials to create a plan to prevent and respond to cyberattacks and strengthen infrastructure. The directive calls for regular briefings with AI companies and asks them to share safety reports they already provide to New York and the European Union, placing Virginia’s response inside a wider dispute over who sets U.S. AI rules.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop a statewide cybersecurity plan. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct a tabletop exercise at least once a year, and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia officials are to ask AI companies to share confidential safety briefings they already provide to New York’s financial regulator under its RAISE Act and to the EU AI Office. The directive requests the information; the source material does not say companies are legally compelled to provide it. It names no budget or completion date, leaving the resources and timetable for the work unsettled.
Spanberger’s announcement cited recently disclosed software vulnerabilities and Anthropic’s account of its AI agents taking unintended actions on government websites, including submitting fake public-records requests on a Virginia Department of Education site. The governor said no sensitive data was accessed. Those incidents provide the stated immediate context for the directive, but the source does not establish that they caused a breach of state data.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Role in AI Security
The directive gives Virginia a concrete role in AI-related security oversight even as federal officials argue for a more uniform, lighter-touch national approach. For companies operating across jurisdictions, the practical issue is not only how demanding each rule is, but which authorities can set requirements and whether those requirements may differ from state to state.
Virginia’s request for existing company briefings could give state officials access to safety information prepared for other regulators, if companies share it. The directive does not establish a new disclosure mandate or specify what the state will do with those reports. Its significance for businesses will depend on how the consortium and plan are implemented, and whether they lead to additional state requirements.
The political dispute also has direct implications for the status of state laws. The administration has sought to challenge or preempt some state rules, while state officials and attorneys general have called for federal safety standards that preserve state authority. Congress has not passed a preemption law, so the directive arrives while the boundary between federal and state oversight remains contested.
Products Worth Considering
HP Sprocket Photo Booth Instant Color Printer Bundle
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
FLEXISPOT 42-Inch Electric Height-Adjustable Desk Converter with Keyboard Tray
As an affiliate, we earn on qualifying purchases.
The Federal-State AI Policy Split
The White House has promoted a single national approach and argued that varied state requirements can complicate compliance and hinder innovation. Executive Order 14179, issued in January 2025, revoked the previous administration’s AI order. A July 2025 AI Action Plan called AI too important to burden with bureaucracy and said federal funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The source material says the list had not been published by March 2026 and that no published version had been found afterward. In March 2026, the White House sent Congress a framework seeking to preempt some state rules while leaving areas such as child protection and state use of AI to state governments.
The effort has not produced a broad federal preemption statute. A proposed 10-year moratorium on state AI laws was removed from a Senate bill by a 99-to-1 vote in July 2025. Meanwhile, state rules continued to take effect: California and Texas laws began on January 1, 2026, while revised New York and Colorado laws are scheduled to start on January 1, 2027. A separate federal security track also exists: a June 2026 order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source material.
“AI is far too important to smother in bureaucracy.”
— The White House AI Action Plan, July 2025
Plan Funding and Company Participation
Virginia’s directive does not specify how much the plan will cost, when it must be completed, or which state agencies will carry out each part. It also does not say whether AI companies will share the confidential reports requested, how Virginia would protect or use them, or whether the briefings will lead to any new rules.
The scope of federal efforts to challenge state laws remains unsettled as well. The source material reports no enacted congressional preemption law and no published Commerce Department list of laws targeted under the 2025 order. A federal framework and litigation can shape the debate, but their eventual effect on specific state requirements is not established here.
The source describes a contested argument over whether lighter regulation helps the United States compete with China or creates security risks. An opinion essay cited in the material argues that an unregulated U.S. AI sector could pose a greater security threat than China’s catch-up; that is an attributed interpretation, not a settled finding. Virginia’s directive addresses cyber preparedness, but does not resolve that broader policy dispute.
Virginia’s Next Planning Steps
Virginia’s public-safety secretary is to establish the Cyber Consortium and develop the statewide cyber and infrastructure plans. The AI Task Force is directed to begin quarterly company briefings and schedule an annual tabletop exercise, while an independent team is to review state data systems. The directive does not provide dates for these milestones, so when they will occur remains unclear.
Further developments will show whether companies provide the requested safety reports and whether Virginia’s work produces specific operational standards or public findings. Separately, Congress, federal agencies and courts may clarify how far Washington can go in limiting state AI rules. Until those steps produce a settled legal framework, the source material describes state-by-state compliance as the current reality for companies.
Key Questions
What did Virginia’s Executive Directive 6 require?
It directs state officials to create a statewide plan to prevent and respond to cyberattacks, establish a Cyber Consortium, strengthen infrastructure planning, and have the AI Task Force hold regular company briefings and conduct an annual tabletop exercise.
Does the directive force AI companies to hand over confidential reports?
The directive says companies are to be asked to share reports they already provide to New York and the EU. The source material does not describe this request as a legal mandate.
Has Congress barred states from regulating AI?
No. The source material says Congress has not passed a law broadly preempting state AI rules. A proposed 10-year moratorium was removed from a Senate bill in July 2025.
When will Virginia’s plan be completed?
The directive does not state a completion date or name a budget. The timetable and resources remain unclear.
What is the main dispute between Virginia and Washington?
The dispute concerns the balance between a lighter, more uniform federal approach and state authority to set AI-related rules and security measures. The legal and policy boundaries are still developing.
Source: ThorstenMeyerAI.com
