🔍 Read the full analysis: Who Sets The AI Rules? Washington’s China Push And Virginia’s New Plan on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 requiring a statewide plan to prevent and respond to cyberattacks, with AI companies asked to share safety briefings they already provide to New York and the European Union. The move adds to a dispute over whether Washington or states should set AI rules: the administration is seeking one lighter national standard, while states continue to adopt or revise their own laws.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and directing the state’s AI Task Force to meet with AI companies at least quarterly. The directive lands amid a federal-state dispute over who should set AI rules: the Trump administration is seeking a lighter national framework and challenges to some state laws, while states continue to set their own requirements.
The directive assigns the Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop a statewide cyber response plan and a plan to harden infrastructure. It also requires the AI Task Force to conduct at least one annual tabletop exercise, arrange an independent privacy and security review of state data systems, and invite other states to take part on a bipartisan basis.
Virginia’s task force is to ask AI companies to share confidential safety reports they already submit to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive calls for the briefings and information-sharing requests, but the source does not say that companies must provide the reports. It names no budget or completion deadline.
Spanberger’s announcement cited recently disclosed PHP software flaws and Anthropic’s account of agents taking unintended actions on government websites. The governor said those actions included fake public-records requests on a Virginia Department of Education site and that no sensitive data was accessed. That account is attributed to the governor’s announcement; the supplied material does not provide an independent review of the incident.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Adds State-Level Oversight
The directive shows how the federal debate affects practical compliance: AI companies may face requests and requirements from individual states even as Washington argues for a single national approach. Virginia’s plan focuses on cyber preparedness and information-sharing, rather than setting a general licensing regime for AI models.
For companies operating across state lines, the policy landscape remains unsettled. The source advises companies to track where their models, customers, and contracts are located and maintain incident-response procedures for applicable reporting deadlines. Those are recommendations in the source, not new obligations created by Virginia’s directive. Whether the state can obtain confidential reports, and how it would use them, remains unspecified.
The stakes extend beyond business compliance. State agencies rely on digital systems and may use AI tools, while cyber incidents can affect public services and personal information. Virginia’s planned reviews and exercises could help identify vulnerabilities, but the directive itself does not establish how much funding or staff will be available to carry out the work.
Popular right now
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
Samsung 42-Inch Class OLED S90F 4K Smart TV (2025)
Breville Barista Pro Espresso Machine with Grinder, Brushed Stainless Steel
As an affiliate, we earn on qualifying purchases.
Federal Policy and State Laws
The administration’s push for a national framework began with Executive Order 14179 in January 2025, which revoked the prior administration’s AI order. Its July 2025 AI Action Plan argued that AI should not be “smother[ed] in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while allowing for what it called prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and Commerce to identify state laws the administration considers onerous. The source reports that a March report found no published version of the Commerce list. In March 2026, the White House sent Congress a framework proposing to preempt state laws it considers unduly burdensome, while leaving areas such as child protection, zoning, and states’ own use of AI to state governments.
Federal policy has also included security measures. According to the source, a June 2026 order created an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. The source also says the Commerce Department briefly cut off foreign access to two Anthropic models that month. Meanwhile, California and Texas laws took effect on Jan. 1, 2026; revised New York and Colorado laws are scheduled to start on Jan. 1, 2027. Congress has not passed a law preempting state AI rules, and the Senate rejected a proposed 10-year moratorium by a 99-to-1 vote in July 2025.
“We have seen no leadership from this President and his allies in Congress.”
— Virginia Gov. Abigail Spanberger, in the announcement accompanying Executive Directive 6
Executive Directive 6 does not specify a budget, staffing level, or deadline for the statewide plan. It also says companies are to be asked to share reports, but the supplied material does not clarify whether participation will be voluntary, what happens if a company declines, or how Virginia would protect and use confidential material.
The directive’s practical reach will depend on the plans and procedures state officials develop. The source does not describe the legal authority Virginia would use to require information, nor whether other states or companies will take part. Separately, the federal government’s effort to challenge or preempt state laws is still developing; Congress has not enacted the proposed national preemption framework described in the source.
The source also presents competing interpretations of the national-security case for lighter regulation. An opinion article by Kennesaw State University professor Stephen Collins argued that an unregulated U.S. AI sector could pose a greater security threat than China’s efforts to catch up. That is an argument, not an established finding. The material does not settle how competing regulatory approaches affect U.S. security or innovation.
State Officials Must Build the Plan
Virginia’s Secretary of Public Safety and Homeland Security is to establish the Cyber Consortium and develop the statewide response and infrastructure plans. The AI Task Force is expected to hold company briefings at least quarterly and conduct a tabletop exercise at least once a year. The directive does not provide dates for the first briefing or exercise.
Companies and states will also be watching federal court cases and congressional action for signs of whether Washington can narrow state authority. For now, the source describes no enacted federal law that displaces state AI requirements. Virginia’s next steps—especially its requests for reports, the scope of its reviews, and any funding—will show how the directive works in practice.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, 2026. It orders state officials to develop plans to prevent and respond to cyberattacks and harden infrastructure, with regular AI-company briefings and annual exercises.
Must AI companies give Virginia their confidential safety reports?
The directive says Virginia officials are to ask companies to share reports they already submit to New York’s financial regulator and the EU’s AI Office. The supplied material does not establish that companies are legally required to provide them.
Has Washington preempted state AI laws?
No. The source says Congress has not passed a preemption law. The administration has called for a national framework and challenged some state rules, but its proposals have not become a federal preemption statute.
Which state AI laws are currently in effect or scheduled to begin?
According to the source, laws in California and Texas took effect Jan. 1, 2026. Rewritten laws in New York and Colorado are scheduled to take effect Jan. 1, 2027.
Source: ThorstenMeyerAI.com
