🔍 Read the full analysis: Which AI Policies Matter When Virginia Orders A Cyber Plan? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering a statewide plan to prevent and respond to cyberattacks, along with recurring briefings with AI companies. The move comes amid a broader dispute over whether Washington or states should set AI rules; the directive names no budget or completion date, and the federal policy picture remains unsettled.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including threats involving artificial intelligence. The directive also calls for at least quarterly briefings with AI companies, placing Virginia’s security measures within a wider contest over whether states or the federal government should set AI policy.
The directive tells Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create a statewide cyber response plan, as well as a plan to harden infrastructure. It also assigns responsibilities to the state’s AI Task Force: hold company briefings at least quarterly, conduct a tabletop exercise at least annually, and arrange an independent privacy and security review of state data systems. Other states are to be invited to join the effort on a bipartisan basis.
Virginia is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the RAISE Act and to the European Union’s AI Office. The directive requests those reports; the source material does not establish that companies must provide them under a new Virginia disclosure mandate. It specifies no budget and no completion date, leaving the timetable and practical scope of the work unresolved.
Spanberger’s announcement cited cybersecurity concerns, including vulnerabilities disclosed that week and Anthropic’s report that its agents had taken unintended actions on government websites. According to the governor, those actions included fake public-records requests on a Virginia Department of Education site, and no sensitive data was accessed. The directive itself sets out the state’s response; the governor’s account of the incidents and her assessment of federal leadership are attributed statements, not independent findings established by the directive.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State-Level AI Oversight
The order matters because it connects AI policy to the operational work of protecting state systems: planning for cyber incidents, reviewing data security and hearing from companies developing advanced models. A recurring briefing schedule could give state officials a regular channel to raise risks and learn about company practices. Whether that produces new safeguards depends on how Virginia implements the directive and what information companies agree to share.
For companies operating across the United States, the order adds to a changing state-by-state landscape while federal officials seek a more uniform approach. The directive does not by itself settle which rules will apply to a particular company or replace existing state and federal requirements. Its immediate effect is to task Virginia officials with planning and coordination, not to announce a new general licensing system or a completed set of AI safety standards.
Popular right now
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
Samsung 48-Inch S90H OLED 4K Smart TV (2026)
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
Federal and State AI Rules Diverge
The source describes a federal push for a lighter, more uniform approach to AI regulation. Executive Order 14179, issued in January 2025, revoked the prior administration’s AI order. A July 2025 AI Action Plan said AI should not be “smother[ed] in bureaucracy” and called for federal funding decisions to account for what it termed burdensome state regulations. In December 2025, Executive Order 14365 set out the administration’s objections to some state laws and created a Justice Department task force to challenge them. A federal framework sent to Congress in March 2026 proposed preempting state laws deemed to impose undue burdens, while leaving some matters, including child protection and states’ own AI use, to states.
That effort has not produced a blanket congressional preemption law, according to the source. A Senate vote in July 2025 removed a proposed 10-year moratorium on state AI laws, by a vote of 99 to 1. The source also reports that a federal cybersecurity initiative was established by an executive order in June 2026, alongside a voluntary pre-release check for the most capable models. Those measures show that the federal approach described is not limited to deregulation, even as the administration disputes some state rules.
States have continued to legislate. California and Texas laws took effect on Jan. 1, 2026, while revised laws in New York and Colorado are scheduled to start on Jan. 1, 2027. The source says Virginia’s directive asks companies to share briefings they already give to New York and the EU, linking the state’s security planning to disclosure processes that exist elsewhere.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Funding, Timelines and Company Cooperation
The directive does not say how much the work will cost, when the statewide plans must be completed or what powers the Cyber Consortium will have. It also does not establish whether AI companies will provide the requested confidential reports, how Virginia would handle sensitive information, or whether the state will set additional requirements after the briefings and reviews.
The source material attributes the reported website activity to Anthropic’s disclosure and gives the governor’s statement that no sensitive data was accessed; it does not provide an independent technical review of the incident. Separately, the future reach of federal preemption remains unsettled: the source reports proposals and executive actions, but no enacted law overriding state AI rules across the board.
State Officials Must Set the Process
Virginia’s public safety and homeland security secretary is directed to establish the Cyber Consortium and develop the statewide plans. The AI Task Force is expected to hold company briefings at least quarterly and run a tabletop exercise at least once a year; the directive also calls for an independent review of state data systems. The order does not give dates for those milestones, so the first public timetable will help clarify how quickly the program is taking shape.
Further developments may include which AI companies and other states take part, what information is shared, and whether the reviews lead to recommendations or new state rules. At the federal level, litigation and congressional proposals could change the boundaries between state and national authority. Until those details are settled, Virginia’s directive is a confirmed state planning order, while the broader regulatory outcome remains open.
Key Questions
What did Virginia order on Oct. 23?
Gov. Abigail Spanberger signed Executive Directive 6, directing officials to establish a Cyber Consortium and develop statewide plans to prevent and respond to cyberattacks and harden infrastructure.
Does the directive require AI companies to disclose confidential reports?
It says Virginia will ask companies to share reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not describe this as a new compulsory disclosure rule.
When will Virginia’s cyber plans be completed?
The directive names no completion date. It calls for quarterly AI-company briefings and at least one tabletop exercise each year, but does not provide a start date for those activities.
Has the federal government overridden state AI laws?
Not through a blanket law, according to the source material. Federal officials have pursued executive actions and proposed preemption, but the source says Congress has not passed a general preemption law.
Source: ThorstenMeyerAI.com
