🔍 Read the full analysis: Understanding AI Policy: Federal Deregulation, Virginia’s Cyber Order, And What Applies on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed an October 23 directive calling for a statewide plan to prevent and respond to cyberattacks, including threats involving AI. The move comes as the federal government seeks a lighter, more uniform approach to AI regulation while states continue to enact their own rules. Congress has not passed a law preempting state AI rules, and the directive specifies no budget or completion date.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and harden infrastructure, including against threats involving artificial intelligence. The directive adds a state-level security effort as the federal government pushes for a lighter national approach to AI rules and Congress has yet to pass legislation overriding state laws.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create statewide plans covering cyberattack response and infrastructure security. It also assigns work to the state’s AI Task Force: the group must meet with AI companies at least quarterly, hold a tabletop exercise at least once a year, and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia plans to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the EU AI Office. The directive calls for companies to be asked for those materials; it does not establish that they have agreed to share them or make the reports public. The order names no budget and sets no deadline for completing the plans.
Spanberger’s announcement cited vulnerabilities disclosed that week and an Anthropic disclosure that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed. Her announcement also criticized the federal government’s approach, saying, “we have seen no leadership from this President and his allies in Congress.” That is the governor’s assessment, not a settled finding about federal policy.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds a State Cybersecurity Layer
The directive could shape how Virginia agencies prepare for AI-related cyber incidents and how state officials communicate with AI companies. Its emphasis on existing company safety reports may give officials information about risks identified elsewhere, but the directive does not say what disclosures companies must provide if they decline the request.
For businesses, the immediate policy picture remains state-by-state rather than governed by a single federal preemption law. The source reports that California and Texas AI laws took effect on January 1, 2026, while rewritten laws in New York and Colorado are scheduled to begin January 1, 2027. Companies working across jurisdictions may need to track different obligations while the federal-state dispute continues.
The issue extends beyond compliance costs. It concerns which level of government sets AI safeguards and how security risks are handled. Virginia’s directive is a state action focused on cyber preparedness; it does not itself settle the wider dispute over whether federal rules should displace state AI laws.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State AI Laws
The federal administration has argued for a single, lighter national standard. According to the source, a January 2025 executive order revoked the prior administration’s AI order. A July 2025 AI Action Plan called AI too important to “smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while distinguishing those from prudent laws.
A December 2025 executive order directed the Justice Department to establish an AI Litigation Task Force and instructed the Commerce Department to identify state laws considered onerous. The source reports that a list had not been published as of its publication date. In March 2026, the White House sent Congress a framework calling for preemption of state laws it considers undue burdens, while leaving areas such as child protection, zoning and states’ own use of AI to state governments. Congress has not enacted a general preemption law; the source says the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025.
Federal policy is not limited to deregulation. The source describes a June 2026 executive order establishing an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. It also reports that the Commerce Department briefly cut off foreign access to two Anthropic models that month. These measures reflect a federal security role alongside the administration’s effort to limit some state rules.
Plans, Funding and Company Cooperation
The directive does not identify a budget, completion date or detailed implementation schedule. It also does not spell out what the Cyber Consortium will do first, how the independent review team will be selected, or how Virginia will handle sensitive information in company reports.
It remains unclear whether AI companies will share the confidential briefings Virginia intends to request, and whether the state will publish any resulting findings. The governor said no sensitive information was accessed in the cited website incident, but the source does not provide an independent technical assessment of that event.
The broader federal-state dispute is unresolved. Congress has not passed a law broadly preempting state AI rules, and the source does not establish when or whether such legislation will advance. The administration’s stated position and the states’ existing laws therefore continue to shape a changing policy landscape.
State Plans and Federal Action
Virginia’s public safety and homeland security secretary is directed to organize the Cyber Consortium and develop the statewide plans. The AI Task Force is expected to begin quarterly company briefings and arrange an annual tabletop exercise, although the directive gives no dates for those steps. Virginia also plans to invite other states to take part.
For the national policy dispute, the next developments depend on federal agency actions, litigation and Congress. The source reports that the administration has pursued challenges to some state laws, while a bipartisan House bill would preempt only a narrow category of frontier-model rules. Until lawmakers enact a broader measure, the existing state requirements remain relevant to companies operating across state lines.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed a directive calling for a Cyber Consortium and statewide plans to prevent and respond to cyberattacks and strengthen infrastructure. It also requires regular AI company briefings, an annual tabletop exercise and an independent review of state data systems.
Does the directive require AI companies to hand over confidential reports?
It says Virginia will ask companies to share reports they already provide to New York’s financial regulator and the EU AI Office. The source does not say companies are legally required to provide them or have agreed to do so.
Has the federal government overridden state AI laws?
No general federal preemption law has passed, according to the source. The administration has proposed limiting some state rules, but Congress has not enacted a broad measure to replace them.
When must Virginia complete its cybersecurity plans?
The directive does not give a completion date or name a budget. It assigns state officials to develop the plans, but the timeline and implementation details remain unclear.
What should companies expect from the current policy landscape?
For now, companies may need to account for different state laws while federal policy and litigation develop. The source says relevant laws are already in effect in California and Texas, with revised New York and Colorado laws scheduled to start January 1, 2027.
Source: ThorstenMeyerAI.com
