🔍 Read the full analysis: AI And Cybersecurity Rules: Making Sense Of Federal And Virginia Policy on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Governor Abigail Spanberger signed an October 23 directive ordering state agencies to develop a cybersecurity plan and hold regular briefings with AI companies. The move comes amid a federal push for a lighter, national AI framework and ongoing state-level rulemaking; Congress has not enacted a law preempting state AI rules. The directive sets out tasks but names no budget or completion deadline.
The directive assigns the Secretary of Public Safety and Homeland Security responsibility for establishing a Cyber Consortium and preparing plans to respond to cyberattacks and strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct a tabletop exercise at least once a year and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia officials are to ask AI companies to share confidential safety reports they already provide to the New York financial regulator under its RAISE Act and to the European Union’s AI Office. The directive requests those briefings and reports; the source material does not say companies are legally compelled by the order to provide them. It names no budget or completion date.
The governor’s announcement cited recently disclosed software flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. That report included fake public-records requests on a Virginia Department of Education site. Spanberger said no sensitive data was accessed. The incident descriptions and the governor’s account are attributed statements, not evidence in the source of a broader confirmed breach of state data.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Builds Its Own Cyber Response
The directive turns the federal-state disagreement over AI into a practical compliance issue: companies may face different requirements across jurisdictions while policymakers debate whether a national standard should replace some state rules. Virginia’s approach focuses on cyber readiness, information-sharing and reviews of government systems, rather than setting out a broad new set of AI product rules.
For public agencies, the planned exercises and independent review could help identify weaknesses in how state systems handle cyber incidents and AI tools. For AI companies, requests to share existing safety briefings could add scrutiny and coordination, although the order does not specify a new reporting mandate or penalties for refusing. The scope and cost of the work will depend on implementation.
The dispute also matters to organizations operating across state lines. Federal officials have argued that a patchwork makes compliance harder, while state officials and attorneys general have pressed for safeguards and retained state authority. Until Congress passes a preemption law or courts settle particular disputes, businesses cannot assume that proposed federal policy has displaced state requirements.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Rulemaking
The Trump administration has pursued a less restrictive federal AI policy since January 2025, when Executive Order 14179 revoked the Biden administration’s AI order. A July 2025 AI Action Plan argued that AI should not be “smother[ed] in bureaucracy” and said federal funding should not go to states with burdensome AI rules, while distinguishing what it called prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and Commerce to identify state laws deemed onerous. The source reports that the task force launched in January 2026 and that no Commerce list had been published by the time of the account. In March, the White House sent Congress a framework proposing to preempt some state laws it considers undue burdens while leaving areas such as child protection, zoning and states’ own use of AI to state governments. A framework is a policy proposal, not an enacted statute.
Federal policy has also included cybersecurity measures. The source says a June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. Meanwhile, state laws have taken effect or are scheduled to do so: California and Texas laws began January 1, 2026, while revised laws in New York and Colorado are due to start January 1, 2027. Congress has not passed a law preempting these state rules; the Senate rejected a proposed 10-year moratorium on state AI regulation by a 99-1 vote in July 2025.
Funding, Deadlines and Company Duties
The directive does not state how much the plan will cost, when it must be completed or which office will publish its findings. It also does not spell out how the state will protect confidential company reports, what information companies will be asked to provide, or whether participation will be voluntary in practice.
The source describes the incidents cited by the governor but does not independently establish their full technical scope or whether they reflect a vulnerability affecting other agencies. It says the governor reported that no sensitive data was accessed in the Virginia Department of Education episode. The effectiveness of the planned reviews and exercises cannot yet be assessed because they have not been completed.
At the national level, the future of proposed preemption remains unsettled. The White House framework is not law, and the source does not report a congressional preemption measure passing. Litigation and changes to state statutes may affect particular rules, but the long-term division of authority is still unresolved.
State Agencies Begin Implementation
Virginia’s Secretary of Public Safety and Homeland Security is directed to establish the Cyber Consortium and develop the statewide plans. The AI Task Force is to begin regular company briefings and schedule at least one annual tabletop exercise; the directive does not provide a public timetable for those steps.
Readers and organizations should watch for state guidance on the consortium’s membership, data-review process and requests to AI companies. Separately, the scheduled January 1, 2027 start dates for revised New York and Colorado laws remain relevant to companies operating in those states. Federal proposals, agency actions and any new legislation could change the picture, but no enacted federal preemption is identified in the source material.
Key Questions
What did Virginia order on October 23?
Governor Abigail Spanberger signed Executive Directive 6, directing state officials to establish a Cyber Consortium, develop statewide cyberattack response and infrastructure plans, and carry out AI-related briefings, exercises and reviews.
Does the directive require AI companies to provide confidential reports?
It directs officials to ask companies to share safety reports they already provide to New York’s financial regulator and the EU’s AI Office. The source does not establish that Virginia’s directive compels companies to provide them.
Has Congress passed a law overriding state AI rules?
No. The source says Congress has not passed a federal preemption law. The White House has proposed a framework, but a policy framework is not legislation.
When do the named state AI laws take effect?
According to the source, California and Texas laws took effect on January 1, 2026. Revised New York and Colorado laws are scheduled to begin January 1, 2027.
What details about Virginia’s plan are still missing?
The directive gives no budget or completion date. It also does not specify the detailed process for reviewing state systems or how confidential company briefings will be handled.
Source: ThorstenMeyerAI.com
