🔍 Read the full analysis: Making Sense Of AI Regulation As Washington And Virginia Take Different Approaches on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 calling for a statewide plan to prevent and respond to cyberattacks, with AI companies asked to share existing safety reports. The move contrasts with the Trump administration’s push for a lighter national standard and limits on state AI laws; Congress has not enacted federal preemption.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 ordering state officials to develop plans for preventing and responding to cyberattacks, including threats involving artificial intelligence. The directive puts Virginia’s state-led approach in contrast with the Trump administration’s effort to limit state AI rules and establish a lighter national standard—a dispute with practical consequences for companies operating across state lines.
Executive Directive 6 tells Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and create a statewide cyberattack response plan, as well as a plan to protect infrastructure. The state’s AI Task Force is directed to hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least once a year. The directive also calls for an independent privacy and security review of state data systems and invites other states to participate.
Virginia is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or deadline for completing the plans. Spanberger’s office cited recently disclosed software vulnerabilities and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said no sensitive data was accessed in the Virginia Department of Education incident.
Washington’s policy documents favor reducing what the administration calls burdensome state rules. A December 2025 executive order directed federal agencies to challenge certain state AI laws and pursue a national approach. The administration proposed that Congress preempt state laws it considers unduly restrictive, but Congress has not passed a preemption law. In July 2025, the Senate voted 99-1 to remove a proposed 10-year moratorium on state AI regulation from legislation.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
The Compliance Map Still Follows State Lines
For businesses, the immediate issue is not which side wins the federal-state argument, but which rules apply to their products, customers and contracts right now. With no federal preemption law in place, companies may have to track requirements state by state while also responding to federal actions and rules in other jurisdictions.
That uncertainty can affect product launches, reporting processes and safety documentation. The source article advises companies to map where their models and customers operate and to prepare for different incident-reporting deadlines. Those are practical recommendations, not a single nationwide legal requirement: applicable duties depend on the relevant law and the organization’s activities. Virginia’s directive adds a new request for existing company briefings, but does not itself set a general compliance regime for AI firms.
The dispute also concerns who gets to define AI safety standards. The administration argues that a patchwork can burden innovation, particularly for startups. State officials and supporters of state authority argue for local action where they see gaps in federal leadership. Those positions are political arguments; the policy question remains unsettled, and the legal reach of any federal effort to displace state rules may be contested.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Rulemaking
The Trump administration began reversing the prior federal AI policy in January 2025, when Executive Order 14179 revoked the Biden administration’s AI order. Its July 2025 AI Action Plan argued that AI should not be constrained by excessive bureaucracy and said federal funding should not go to states with burdensome AI regulations, while recognizing what it called prudent state laws.
A December 2025 order directed the Justice Department to create an AI Litigation Task Force and instructed the Commerce Department to identify state laws deemed onerous. The source article reports that a list had not been published as of its October 27, 2026 publication. In March 2026, the White House sent Congress a framework calling for preemption of some state laws while leaving areas such as child protection and states’ own use of AI to state governments.
States have continued to legislate. According to the source, California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to begin on January 1, 2027. Virginia’s directive is different from a new broad AI statute: it orders planning and briefings, including requests for reports companies already provide elsewhere.
Deadlines, Funding and Federal Reach
Virginia’s directive sets no budget or completion date, and the source does not identify a published implementation schedule. It is also not clear which companies will share reports, what information they will provide, or how the state will handle confidential material. The directive asks for existing reports; it does not establish a public disclosure requirement.
At the federal level, Congress has not enacted the proposed preemption framework. The legal outcome of efforts to challenge state laws remains uncertain, as do the scope and timing of any future federal standard. The source describes federal cybersecurity measures and a proposed voluntary review process for some advanced models, underscoring that the administration’s approach is not simply an absence of federal action. The effects of those measures and their interaction with state requirements remain developing.
Spanberger cited reports about AI agents acting on government websites, but her office said no sensitive data was accessed in the Virginia case. The available information does not establish broader harm from that incident. Separately, arguments that lighter rules help or harm national security remain disputed assessments, not settled conclusions.
Virginia Plans and Congress’s Next Move
Virginia’s agencies and AI Task Force are expected to carry out the directive by organizing the consortium, preparing the statewide plans and scheduling company briefings and exercises. The directive calls for briefings at least quarterly and a tabletop exercise at least annually; it does not give a date for the plans’ completion.
Federal policy will depend in part on whether Congress considers legislation to set national AI rules or preempt some state requirements. Until a law is enacted, companies and residents will continue to face a policy landscape shaped by existing state laws, federal actions and ongoing disputes over authority. The source article also notes that 26 state attorneys general had asked Congress for federal safety rules while opposing preemption, illustrating that support for national standards does not necessarily mean support for removing state powers.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger’s Executive Directive 6 tells state officials to establish a Cyber Consortium and develop plans to prevent and respond to cyberattacks, including plans to protect infrastructure. It also directs regular AI company briefings and an annual exercise.
Does Virginia’s directive create a new AI law for companies?
The directive primarily orders state planning, exercises and briefings. It asks companies to share safety reports they already provide to New York’s financial regulator and the EU’s AI Office; the source does not describe it as a broad new AI compliance statute.
Has the federal government preempted state AI laws?
No federal preemption law has been enacted, according to the source article. The administration has called for limits on some state rules, but Congress removed a proposed 10-year moratorium from legislation in a 99-1 Senate vote in July 2025.
What does the policy split mean for AI companies?
For now, companies may need to account for applicable state requirements as well as federal actions. The source recommends tracking where models, customers and contracts are located, but specific obligations depend on the laws and activities involved.
Source: ThorstenMeyerAI.com
