🔍 Read the full analysis: AI Policy Showdown: Federal Calls For Less Regulation, Virginia’s Cyber Order on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Virginia Gov. Abigail Spanberger signed an order on Oct. 23 directing state officials to develop a cyberattack response plan and hold regular briefings with AI companies. The directive comes as the federal government seeks to limit some state AI rules, while Congress has not passed a law preempting them and states continue to set their own requirements.
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including attacks involving artificial intelligence. The order highlights a growing divide: the federal government is pressing for a lighter national approach to AI regulation, while states continue to develop their own rules and security measures.
The directive tells Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and prepare plans for cyberattack response and infrastructure protection. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are invited to participate on a bipartisan basis.
Virginia officials are to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. The directive does not specify a budget or deadline for completing the plans. Spanberger’s announcement cited recently disclosed PHP flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said no sensitive data was accessed in the Virginia Department of Education incident she referenced.
At the federal level, the administration has argued for one national standard and against state laws it considers burdensome. Executive orders and a 2025 federal AI action plan have called for challenging some state regulations, but Congress has not enacted a broad preemption law. The Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025, according to the source material.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Builds Its Own Cyber Safeguards
The directive adds a practical state response to a national argument over who should set AI rules. For businesses, the immediate issue is that state requirements remain in force unless changed by courts or legislation. A federal push to limit state regulation has not, on the information available, replaced those rules with a single national framework.
Virginia’s focus is on cyber readiness as well as oversight. Regular company briefings, preparedness exercises and reviews of state systems could give agencies a clearer picture of risks, but the directive does not establish new penalties or set out a funded implementation schedule. Its effects will depend on how state officials carry it out and what information companies agree or are required to share.
The conflict also matters to residents and public agencies because it concerns the security of government systems and the handling of personal data. The directive responds to reported AI-related activity, but the available account does not establish that sensitive information was accessed. The distinction between a reported incident, a potential vulnerability and a confirmed breach remains important.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Rulemaking
The administration’s policy case is set out in federal orders and plans. Executive Order 14179, issued in January 2025, revoked the previous administration’s AI order. A July 2025 AI Action Plan argued that AI should not be slowed by excessive bureaucracy and said federal funding should not support states with burdensome AI regulations, while also recognizing what it called prudent laws.
A later order, Executive Order 14365, argued that differing state requirements can complicate compliance, particularly for start-ups, and can affect model development across state borders. It established a Justice Department AI Litigation Task Force. The White House sent Congress a framework in March 2026 proposing limits on some state rules while leaving areas such as child protection and state government use of AI to states. Those proposals are not, by themselves, a federal statute preempting state laws.
State policies have continued to change. California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to begin on January 1, 2027. In the Colorado dispute, xAI sued over the state’s AI law and the Justice Department intervened; Colorado later replaced the law with a narrower disclosure-focused measure. Separately, 26 attorneys general have called for federal safety rules and an explicit bar on preemption, while a bipartisan House proposal would preempt only a narrower category of frontier-model rules.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Funding, Deadlines and Federal Limits
Virginia’s directive names no budget or completion date, and the source material does not say when the Cyber Consortium will be formed or when its plans will be delivered. It also remains unclear how many companies will share confidential reports, what information those reports contain, and how Virginia will handle any sensitive material.
The broader federal-state dispute is unresolved. The source material says the administration ordered Commerce to identify state laws it considered onerous, but reports that no list had been published. It also describes proposed federal legislation and litigation rather than a law that has settled the scope of state authority. The full details and outcomes of later federal cybersecurity measures are not provided here.
The reported Anthropic activity on the Virginia education website was described as unintended, and the governor said sensitive information was not accessed. The material does not provide an independent technical account, specify exactly what actions occurred, or establish whether the event constituted a breach.
Virginia’s Plans and Congress’s Role
Virginia agencies are expected to establish the consortium, develop the cyber plans and begin the directive’s regular briefings and exercises. The order calls for quarterly company briefings and an annual tabletop exercise, but it does not give calendar dates for their first sessions. State officials’ implementation choices should clarify how the proposed information-sharing process will work.
At the federal level, Congress would need to pass legislation to create a broad national preemption rule; the administration’s policy documents and litigation efforts have not done that on their own. Court proceedings, state law changes and any new federal legislation could alter the compliance picture. Until then, companies operating across jurisdictions will need to track the rules that apply in each state.
Key Questions
What did Virginia’s Executive Directive 6 order?
It directs state officials to establish a Cyber Consortium, prepare statewide cyberattack response and infrastructure protection plans, hold quarterly AI company briefings, conduct annual exercises and review state data systems for privacy and security.
Does the directive require AI companies to disclose all safety information?
The directive says companies are to be asked to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The source material does not describe a blanket disclosure mandate or explain how many companies will comply.
Has the federal government replaced state AI laws with one national rule?
No federal preemption law is identified in the source material. The administration has called for a national approach and challenged some state laws, but state requirements continue to apply unless changed through legislation, court action or state lawmaking.
Was sensitive information accessed in the Virginia website incident?
Spanberger said no sensitive data was accessed in the incident she cited involving Anthropic agents and a Virginia Department of Education site. The source material does not include an independent technical account or further details about the agents’ actions.
Source: ThorstenMeyerAI.com
