🔍 Read the full analysis: Virginia’s AI Cyber Plan And Washington’s Deregulation Push: Key Questions on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed an October 23 directive ordering state officials to develop a plan for preventing and responding to cyberattacks, with AI companies asked to share existing safety briefings. The move comes amid a federal push to limit some state AI rules; Congress has not passed a law preempting them, and the scope and timing of Virginia’s plan remain unsettled.
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including threats involving artificial intelligence. The directive adds a state-level security initiative to a national dispute over whether AI should be governed mainly by a lighter federal standard or by separate state laws.
The directive instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and prepare plans for cyberattack response and infrastructure protection. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are to be invited to join on a bipartisan basis.
Virginia is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or deadline for completing the plans. It calls for companies to share reports; the source material does not establish that companies are legally required by the directive to hand them over.
The governor’s announcement cited recently disclosed software vulnerabilities and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites. Spanberger said those actions included fake public-records requests on a Virginia Department of Education site, while stating that no sensitive data was accessed. The source does not provide further technical details about the vulnerabilities or the website activity.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds a State Security Layer
The directive matters because it links AI oversight to state cybersecurity planning, rather than focusing only on rules for how companies develop or deploy models. Regular briefings, exercises and reviews could give state officials a structured way to prepare for incidents involving AI systems, though the directive itself does not set out a finished plan or new company-wide safety standards.
For businesses, the broader regulatory question remains unresolved. Federal actions seek to limit some state requirements, while states continue to enact or revise their own laws. Until Congress changes the law or courts settle disputes over federal authority, companies may need to track requirements across multiple jurisdictions. Virginia’s request for existing reports also leaves practical questions about confidentiality and how state officials would use the information.
Products Worth Considering
DJI Osmo Pocket 3 Filter Bundle – Vlogging Camera with 1 CMOS Sensor and 4K/120fps
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Remain Contested
The White House’s stated approach favors a lighter national framework and challenges what it calls burdensome state rules. The source material says Executive Order 14179, issued in January 2025, revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that AI should not be constrained by excessive bureaucracy. A later executive order directed federal agencies to identify state laws considered onerous and set up a Justice Department task force focused on AI-related litigation.
That federal push has not produced a congressional preemption law. According to the source, the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025. The White House sent Congress a framework in March 2026 proposing that some state requirements be preempted, while leaving areas such as child protection and state government use of AI to states. A Justice Department challenge to Colorado’s law followed; Colorado later replaced that law with a narrower disclosure-based measure scheduled to take effect on January 1, 2027.
State rules are also changing on their own schedules. The source says California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are due to begin on January 1, 2027. The two headlines framing the dispute have different evidentiary status: the argument that weak US regulation poses a greater security threat than China’s AI progress is an opinion by Stephen Collins, a Kennesaw State University professor, published by The Conversation on September 25. It is not a government finding or an established consensus.
Virginia’s directive does not identify funding, a completion date or a final plan. It also does not explain which companies will be asked to provide reports, whether participation will be voluntary, or how confidential material will be protected and handled. The source describes the request for existing briefings but does not establish the legal basis or consequences for declining.
The extent of the reported AI-agent activity and the newly disclosed software flaws is also unclear from the information provided. Spanberger said no sensitive data was accessed, but the source offers no independent technical account. At the federal level, it remains uncertain whether Congress will enact a preemption measure, how courts will resolve challenges to state laws, or which state requirements could ultimately be displaced.
Virginia Officials Must Set the Process
Virginia’s public safety and homeland security secretary is to establish the Cyber Consortium and develop the cyber-response and infrastructure plans. The state AI Task Force is directed to schedule quarterly company briefings and an annual exercise, but the directive supplies no calendar for those steps. The independent review of state data systems and invitations to other states are also part of the work ahead.
Companies and public agencies will continue to face a changing mix of state rules while federal proposals and legal challenges develop. The next concrete indicators will be Virginia’s implementation details and any published plan, alongside further action by Congress, federal agencies and courts. For now, the directive is an order to organize and plan, not evidence that a completed statewide framework or a settled national AI rulebook is in place.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed a directive instructing state officials to establish a Cyber Consortium and develop plans to prevent and respond to cyberattacks and protect infrastructure. It also calls for regular AI company briefings, an annual tabletop exercise and an independent review of state data systems.
Does Virginia’s directive require AI companies to provide confidential reports?
The directive says companies are to be asked to share safety reports they already provide to New York’s financial regulator and the EU AI Office. The source material does not establish that it creates a legal obligation for companies to provide them.
Has the federal government stopped states from regulating AI?
No federal preemption law is identified in the source material. The administration has sought to challenge or limit some state rules, but the division of authority remains contested through policy proposals and litigation.
When will Virginia’s cyber plan be completed?
The directive does not set a completion date or specify a budget. It directs state officials to organize the work, but the timing and detailed contents of the plan remain unclear.
Source: ThorstenMeyerAI.com
