🔍 Read the full analysis: AI Governance In Focus: Washington’s Deregulation Call And Virginia’s Order on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering a statewide plan to prevent and respond to cyberattacks, with regular briefings involving AI companies. The move comes as the White House seeks to limit state AI rules and Congress has not enacted a federal law preempting them. The result is continued uncertainty over which rules companies must follow across states.
The directive assigns the state’s Secretary of Public Safety and Homeland Security responsibility for establishing a Cyber Consortium and developing plans for cyberattack response and infrastructure protection. Virginia’s AI Task Force is instructed to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states may be invited to participate.
Virginia’s government is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or deadline for completing the plans. The governor’s announcement cited newly disclosed software vulnerabilities and Anthropic’s account of agents taking unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed.
At the federal level, the administration has argued that a single, lighter national standard would reduce regulatory burdens and support US competitiveness. Executive orders and policy documents have directed agencies to challenge some state rules and encouraged Congress to preempt them. But Congress has not passed a preemption law. The source material says the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
The directive puts a specific state response into motion while the federal government is pressing to reduce the role of state AI rules. For companies, that leaves an immediate operational issue: requirements may vary by state, even as federal policy aims for greater uniformity. Virginia’s requests for existing company safety reports could also add state-level oversight without creating a new reporting regime from scratch.
The dispute is about who gets to set AI rules, as well as how strict those rules should be. States have enacted or revised laws on AI, while federal officials have challenged some state approaches and proposed limits on them. Until Congress acts or courts resolve the reach of federal authority, businesses and public agencies must plan around rules already in force and the possibility of further changes.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Diverge
The White House’s January 2025 executive order revoked the previous administration’s AI order. A July 2025 AI Action Plan called AI too important to “smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while also saying the administration would not interfere with prudent laws. A December 2025 executive order cited compliance costs, alleged ideological bias in some state laws and rules with effects beyond state borders as reasons to challenge state regulation.
The administration’s March 2026 framework urged Congress to preempt state laws it considered undue burdens, while leaving areas such as child protection, zoning and states’ own use of AI to state authority. The source material says a Commerce Department list of onerous state laws had not been published in the reporting cited. Separately, federal action has included security measures: a June 2026 order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models.
State policy has continued to move. California and Texas laws took effect on Jan. 1, 2026, while revised laws in New York and Colorado are scheduled to begin on Jan. 1, 2027. The source material also reports that 26 attorneys general called for federal AI safety rules and an explicit ban on preemption, while a bipartisan House bill would preempt a narrower set of frontier-model rules.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Deadlines, Funding and Federal Reach
Virginia’s directive does not set a budget or completion date, and the source material does not establish when the Cyber Consortium or statewide plans will be fully operational. It also remains unclear how many AI companies will share confidential reports with Virginia, what information the state will request, or how it will protect and use those materials.
The legal boundary between federal and state authority is unsettled. The White House has sought congressional action and pursued legal challenges, but no broad preemption law has passed. The source material describes a Justice Department challenge involving Colorado’s earlier law; Colorado later replaced that law with a narrower disclosure-based measure due to take effect in 2027. The eventual effects of federal litigation and proposed legislation remain unknown.
Spanberger cited the Anthropic incident and software vulnerabilities as reasons for Virginia’s action, but the directive itself does not establish that AI systems caused the cited vulnerabilities or that sensitive information was exposed. Her office said no sensitive data was accessed in the government website incident.
Virginia’s Plans and Congress’s Next Moves
Virginia’s public safety and homeland security secretary is tasked with organizing the Cyber Consortium and preparing statewide cyberattack-response and infrastructure plans. The AI Task Force is directed to begin its quarterly company briefings, arrange an annual exercise and commission the privacy and security review. The directive provides no public schedule for those steps, so their timing remains to be announced.
At the federal level, Congress could take up proposals to set national safety requirements or preempt some state rules, but the material provided does not identify a passed measure or a confirmed vote date. Companies and public agencies will need to monitor state implementation, federal policy and related court cases while complying with rules currently in force.
Key Questions
What did Virginia’s Executive Directive 6 order?
It directs state officials to establish a Cyber Consortium, develop statewide plans to prevent and respond to cyberattacks and protect infrastructure, and have the AI Task Force hold regular company briefings, conduct an annual exercise and arrange an independent review of state data systems.
Does the directive require AI companies to disclose new reports?
Virginia is to ask companies to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The directive does not specify a new mandatory filing requirement or say how many companies will agree to share reports.
Has Congress preempted state AI laws?
No. The source material says Congress has not passed a federal law broadly preempting state AI rules. The White House has urged Congress to limit some state laws, while state requirements continue to take effect or be revised.
When will Virginia’s cyber plans be completed?
The directive sets no completion date or budget. It calls for the plans and related work but does not provide a public timeline for their delivery.
Which state AI laws are currently in effect or due to start?
The source material says California and Texas laws took effect Jan. 1, 2026, while revised New York and Colorado laws are scheduled to start Jan. 1, 2027. Specific obligations depend on each law and the activities covered.
Source: ThorstenMeyerAI.com
