🔍 Read the full analysis: A New AI Policy Tension: Washington’s China Push Versus Virginia’s Cyber Order on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed an October 23 directive requiring state agencies to plan for cyberattacks involving AI and to brief AI companies at least quarterly. The move comes amid a federal push to limit state-by-state AI regulation, while Congress has not enacted a law preempting state rules. The directive sets no budget or completion date, and its requested company briefings are not described as mandatory.
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including those involving AI, while the Trump administration pushes for a lighter national AI framework and challenges some state rules. The directive puts the clash over who sets AI policy into practical focus for companies and public agencies, but it does not establish a state AI law or a budget for the work.
Executive Directive 6 instructs Virginia’s Secretary of Public Safety and Homeland Security to create a Cyber Consortium and develop plans for cyberattack response and infrastructure protection. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
The directive says companies are to be asked to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The document sets no completion date or funding amount, and the source material does not establish whether companies must provide the reports. Spanberger’s office cited recently disclosed software flaws and Anthropic’s report that its agents took unintended actions on government websites, including making fake public-records requests on a Virginia education site. The governor said no sensitive data was accessed.
The federal government’s stated approach favors a single, lighter national standard and opposition to what it calls burdensome state regulation. Executive orders and policy documents have sought to challenge some state laws and encourage Congress to preempt them. But Congress has not passed a general preemption law. The Senate rejected a proposed 10-year moratorium on state AI laws by 99-1 in July 2025, according to the source material.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets Federal Preemption Push
The dispute affects which rules companies must follow as they develop and deploy AI across state lines. A federal standard could reduce differences among state requirements, while state officials argue that local rules and plans are needed to manage risks to residents and public systems. Virginia’s directive focuses on cybersecurity planning and information-sharing rather than setting broad new obligations for AI developers.
For organizations operating in multiple jurisdictions, the immediate situation remains a patchwork: state laws and directives are advancing while federal preemption remains a policy goal, not an enacted general rule. That means companies cannot treat the administration’s stated preference for one national framework as a substitute for checking current state requirements. The directive also signals that public agencies may seek more regular contact with AI companies as they prepare for incidents.
The political disagreement is distinct from the operational question. Spanberger criticized the federal response, saying Washington had not shown leadership; the administration’s documents describe federal action as an effort to promote innovation and avoid conflicting state regimes. Those are competing political assessments. The directive itself confirms Virginia’s planning steps, not a finding that federal policy caused a particular cyber incident.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Portable Waterproof Speaker, Black
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How Federal and State Rules Diverged
The administration’s policy shift began in January 2025, when Executive Order 14179 revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that AI should not be burdened by bureaucracy and said federal funding should not support states with burdensome AI rules, while distinguishing those from what it called prudent laws.
A December 2025 executive order directed the Justice Department to establish an AI Litigation Task Force and instructed the Commerce Department to identify state laws considered onerous. The task force launched in January 2026. The source material says a list of state laws had not been published as of a March report, and no later published list was identified. A White House framework sent to Congress in March 2026 proposed preemption in some areas while leaving matters such as child protection, zoning and states’ own AI use to state governments.
Meanwhile, states continued to legislate. California and Texas laws took effect on January 1, 2026; rewritten laws in New York and Colorado are scheduled to begin on January 1, 2027. Federal action has also included a separate cybersecurity track: a June 2026 order created an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source material. These steps show that the federal position is not simply an absence of AI security activity; the dispute is also over authority and the scope of state rules.
“we have seen no leadership from this President and his allies in Congress.”
— Virginia Gov. Abigail Spanberger, in the announcement accompanying Executive Directive 6
Funding, Deadlines and Company Participation
Virginia’s directive does not specify how much the plan will cost, when it must be completed or how the consortium will operate in practice. It calls for AI companies to be asked for reports, but the material does not say whether participation will be voluntary, what information may be shared, or how confidentiality will be protected by state officials.
It is also unclear how the proposed plan will interact with existing state and federal cybersecurity work, or whether the Virginia effort will prompt other states to join. The source material describes a policy push toward federal preemption, but Congress has not enacted a broad law resolving the conflict. The administration’s proposed approach, any litigation and the scope of future state rules remain subject to change.
Virginia’s Planning and Federal Action
Virginia’s public safety secretary is expected to organize the Cyber Consortium and begin work on the statewide response and infrastructure plans. The AI Task Force is directed to hold company briefings at least quarterly and conduct a tabletop exercise at least once a year; the directive does not provide a public schedule for the first sessions.
At the federal level, the next substantive developments depend on Congress, agency actions and ongoing legal challenges to state laws. Until lawmakers enact a preemption measure or courts resolve relevant disputes, companies and public agencies will need to track rules in each jurisdiction where they operate. No completion date for Virginia’s plan or new federal legislative milestone is specified in the source material.
Key Questions
What did Virginia order state officials to do?
Executive Directive 6 directs officials to establish a Cyber Consortium and develop statewide plans for preventing and responding to cyberattacks and protecting infrastructure. It also calls for regular AI-company briefings, an annual exercise and an independent review of state data systems.
Does Virginia’s directive require AI companies to hand over confidential reports?
The directive says companies are to be asked to share reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not say that providing them is mandatory or explain how Virginia would handle the reports.
Has the federal government preempted state AI laws?
No general federal preemption law has passed, according to the source material. The administration has advocated for a national framework and challenged some state rules, but companies still need to account for applicable state requirements.
Why are Washington and Virginia taking different approaches?
The administration argues that differing state rules can burden innovation and favor a single national standard. Virginia’s directive emphasizes state cybersecurity planning and coordination. The disagreement concerns both the level of regulation and which level of government should set the rules.
Source: ThorstenMeyerAI.com
