🔍 Read the full analysis: The AI Rules Debate: Washington’s China Goal And Virginia’s Cyber Plan on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23, 2026, ordering a statewide cybersecurity plan and regular briefings with AI companies. The move comes amid a federal push to limit state AI regulation, while Congress has not passed a law preempting state rules; companies must continue to track different state requirements.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 ordering a statewide plan to prevent and respond to cyberattacks, including risks involving artificial intelligence, as the federal government seeks a lighter national approach to AI rules and contests some state laws. The directive adds a state-level security effort to a dispute over who sets AI rules; Congress has not enacted federal legislation preempting state requirements.
Executive Directive 6 instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and prepare plans for cyberattack response and infrastructure protection. It also tasks the state’s AI Task Force with holding briefings with AI companies at least quarterly, conducting an annual tabletop exercise and arranging an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
The directive says Virginia will ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The order does not name a budget or set a completion deadline. The governor’s announcement cited software vulnerabilities disclosed that week and Anthropic’s account of AI agents taking unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed.
At the federal level, the administration has argued for one national standard and fewer state-level restrictions. Executive orders and a White House framework have sought to challenge or preempt some state AI rules. But a proposed federal preemption law has not passed, and state requirements remain in effect. The source account reports that California and Texas laws took effect January 1, 2026, while revised laws in New York and Colorado are scheduled to begin January 1, 2027.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
States Build Cyber Plans Amid Federal Push
The immediate effect of Virginia’s directive is to organize state agencies, companies and other states around AI-related cyber risks. Its quarterly briefings, annual exercise and reviews could give officials a recurring process for sharing information and testing responses. The directive itself, however, does not establish a new statewide AI statute or specify funding, deadlines or penalties.
For businesses, the broader dispute leaves a practical compliance problem unresolved. The White House has advocated federal preemption of some state requirements, but Congress has not enacted that approach. Companies therefore cannot treat a proposed national framework as a replacement for laws already operating or scheduled to take effect. Rules may depend on where a company operates, where its customers are and which contracts or regulated sectors are involved.
The disagreement is also about the balance between innovation, security and state authority. The administration says differing rules can burden companies and impede development; Virginia’s directive reflects a state government’s decision to organize its own response to cyber threats. Neither position, by itself, settles whether a single federal standard would improve security or whether state approaches provide needed safeguards.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Diverge
The federal push for a lighter approach began with Executive Order 14179 in January 2025, which revoked the previous administration’s AI order. A July 2025 AI Action Plan called for removing barriers to development and said federal AI funding should not go to states with burdensome regulations, while distinguishing those from what it called prudent laws. In December 2025, another executive order directed the Justice Department to create an AI Litigation Task Force and the Commerce Department to identify state laws considered onerous. The source account says no such Commerce list had been published as of its reporting.
In March 2026, the White House sent Congress a framework proposing that federal rules preempt state laws deemed undue burdens, while leaving areas such as child protection and states’ own use of AI to state governments. A Senate proposal for a 10-year moratorium on state AI laws was removed from legislation in July 2025 by a 99-to-1 vote, according to the source material. That vote did not itself establish a permanent federal policy on preemption.
Federal action has also included security measures, rather than a wholly hands-off approach. The source account says a June 2026 executive order created an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. It also reports that the Commerce Department briefly restricted foreign access to two Anthropic models in June. Those measures sit alongside the administration’s push to limit state regulation.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Funding, Deadlines and Federal Limits
Virginia’s directive does not identify how much the plan will cost, when it must be completed or what resources agencies will receive. It also says AI companies are to be asked to share reports; the available account does not establish which companies will participate, what information they will provide or how confidential material will be handled.
The federal-state legal outcome is unsettled. The source material reports executive orders, a White House framework and litigation, but no enacted congressional preemption law. It is also unclear whether federal agencies will publish the proposed list of state laws they consider onerous, or how courts will resolve future challenges. The claim that lighter regulation is needed to keep pace with China is an argument advanced in a cited opinion piece, not a confirmed finding about the effects of regulation on national security.
Virginia’s Plan and Rulemaking Milestones
Virginia agencies must now develop the Cyber Consortium and the statewide cyber and infrastructure plans under the directive. The AI Task Force is instructed to convene company briefings at least quarterly and run a tabletop exercise at least once a year. The order sets no public deadline for completing the plans, so the timing and scope of those steps remain to be seen.
Companies and state officials will also be watching for changes in state law and any federal action on preemption. The source account identifies January 1, 2027, as the start date for revised New York and Colorado laws. Until Congress enacts a preemption measure or courts alter the legal landscape, the state-by-state requirements remain the relevant rules for organizations operating in those jurisdictions.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger’s October 23 directive ordered officials to establish a Cyber Consortium and develop statewide plans to prevent and respond to cyberattacks and protect infrastructure. It also calls for regular AI-company briefings and an annual exercise.
Does the directive create a new AI law?
The directive is an executive instruction to state agencies, not a new AI statute. It does not set a budget, completion deadline or penalties, and it asks companies to share existing safety reports.
Has Congress preempted state AI rules?
No federal preemption law has been enacted, according to the supplied source material. The White House has proposed preempting some state requirements, but a proposal is not a law.
What should companies expect for now?
Companies should continue to track the rules that apply in each state where they operate or serve customers. The federal policy debate has not displaced existing state requirements.
Source: ThorstenMeyerAI.com
