🔍 Read the full analysis: From Washington To Virginia: The Question Of Which AI Rules Apply on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed an October 23 directive calling for a statewide plan to prevent and respond to cyberattacks, including regular briefings with AI companies. The move comes as the Trump administration seeks to limit state AI rules and Congress has yet to pass a law preempting them, leaving companies to navigate differing state requirements.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and directing an AI task force to meet with companies at least quarterly. The directive arrives as the Trump administration pushes for a lighter national approach and challenges some state AI regulations, while Congress has not passed a law overriding those rules. For businesses, the immediate question remains which state requirements apply to their models, customers and contracts.
The directive assigns the secretary of public safety and homeland security to establish a Cyber Consortium, prepare a statewide cyber incident response plan and develop a plan to harden infrastructure. It also calls for an annual tabletop exercise, an independent privacy and security review of state data systems, and invitations for other states to take part. The order sets no budget or completion date.
Virginia’s AI Task Force is instructed to hold briefings with AI companies at least quarterly. The companies are to be asked to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. The directive does not say the companies must disclose those reports, or specify how the state would handle information they share.
The governor’s announcement linked the action to recently disclosed vulnerabilities and to Anthropic’s report that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests on a Virginia Department of Education site. The announcement said no sensitive data was accessed. Spanberger also criticized the federal government’s approach, saying, “we have seen no leadership from this President and his allies in Congress.” That is the governor’s political assessment; the administration has described its own efforts as a push to reduce barriers to AI development.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
What Virginia’s Directive Changes
The directive adds a state-level cyber planning effort to a broader dispute over who sets the rules for AI. It does not itself create a general licensing system or a new, binding set of AI safety standards for private companies. Its practical effect will depend on the plans state officials produce, what companies share in briefings, and whether other states join the consortium.
For companies operating across state lines, the federal-state disagreement means compliance cannot yet be treated as a single settled national standard. The source account says California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are due to start on January 1, 2027. Requirements vary, and firms may need to track where their systems are offered and what obligations attach to particular uses or customers.
The disagreement also affects public-sector cybersecurity. Virginia’s order focuses on preparing state agencies and infrastructure for attacks, while Washington has pursued its own AI-security measures alongside efforts to constrain some state rules. These are not necessarily mutually exclusive: federal action on security can coexist with state planning, even as the governments differ over who has authority to regulate AI development.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Laws
The administration’s policy documents describe a preference for fewer state restrictions and a more consistent national framework. President Donald Trump’s January 2025 Executive Order 14179 revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that AI should not be “smother[ed] in bureaucracy” and said federal funding should not go to states with burdensome AI regulations, while preserving room for what it called prudent laws.
A December 2025 executive order directed the Justice Department to establish an AI Litigation Task Force and told the Commerce Department to identify state laws deemed onerous. The task force launched in January 2026. The source account says no Commerce Department list had been published by the time of its October 27 report. In March 2026, the White House sent Congress a framework calling for federal preemption of state laws it considers undue burdens, while reserving areas such as child protection and states’ own use of AI for state authority.
Congress has not enacted that proposal. A proposed ten-year moratorium on state AI laws was removed from a Senate measure by a 99-to-1 vote in July 2025, according to the source material. Meanwhile, states continue to legislate. In Colorado, xAI challenged the state’s AI law, and the Justice Department intervened in April 2026. Colorado later replaced the law with a narrower disclosure-based measure scheduled to take effect in 2027. The source also reports that 26 attorneys general asked Congress for federal safety rules and an explicit prohibition on preemption.
Washington has also taken steps focused on security. The source describes a June 2026 executive order establishing an AI cybersecurity clearinghouse and a voluntary pre-release review for the most capable models. It also reports that the Commerce Department briefly cut off foreign access to two Anthropic models that month. These measures form part of the federal record, even as the administration argues against some state-level requirements.
“we have seen no leadership from this President and his allies in Congress.”
— Virginia Gov. Abigail Spanberger, in her announcement of Executive Directive 6
Details Virginia Has Not Set
The directive does not specify how much the plans will cost, when they must be completed, or what resources the Cyber Consortium will have. It also leaves open whether invited companies will provide confidential reports, what safeguards would govern those disclosures, and whether participation by other states will follow.
The larger legal dispute remains unsettled. Congress has not passed a federal preemption law, and the source material does not establish that the administration’s proposed approach will become law or survive court challenges. The exact reach and enforcement of state statutes can also depend on regulations, legal cases and the facts of individual uses.
The source material summarizes the administration’s June cybersecurity actions but does not provide enough detail to assess their operation, participation or results. It also presents Spanberger’s account of the incidents that prompted Virginia’s order; the available material does not independently establish the full technical circumstances of the vulnerabilities or the agents’ actions.
Plans, Briefings and Court Tests
Virginia’s secretary of public safety and homeland security is to establish the Cyber Consortium and prepare the statewide plans. The AI Task Force is directed to hold company briefings at least quarterly and conduct a tabletop exercise at least once a year. The directive itself does not give a deadline for those steps, so the timing of the first plans and meetings remains unknown.
Companies and state agencies will continue to operate under the laws currently in force unless those laws change or are blocked. For businesses, the near-term task is to track the jurisdictions where they operate and the rules attached to their products and contracts, rather than assume federal preemption is imminent. State laws scheduled for 2027 and ongoing legal challenges may alter that picture.
At the federal level, Congress could take up proposals to set national AI standards or preempt some state requirements, but no enacted measure is identified in the source material. Further court decisions and implementation details from Virginia and federal agencies will clarify how the competing approaches affect companies and public agencies.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed Executive Directive 6, directing state officials to establish a Cyber Consortium, develop plans for cyber incident response and infrastructure protection, and arrange regular AI-company briefings.
Does the directive create new AI regulations for companies?
The directive calls for briefings and asks companies to share safety reports they already provide to New York and the EU. The source material does not describe it as a new general AI licensing regime or say companies are required to hand over those reports.
Has Washington overridden state AI laws?
No federal preemption law is identified in the source material. The administration has proposed limiting some state rules, but Congress has not passed a law doing so.
Which state AI laws are currently in effect?
According to the source account, California and Texas laws took effect on January 1, 2026. Revised laws in New York and Colorado are scheduled to begin on January 1, 2027. The specific obligations depend on each law and how it applies to a company’s activities.
What happens next in Virginia?
State officials are expected to establish the consortium, prepare cyber plans and schedule quarterly AI-company briefings. The directive sets no completion date or budget, so the timing and scope of implementation have not been specified.
Source: ThorstenMeyerAI.com
