🔍 Read the full analysis: Washington Says Less Regulation Beats China As Virginia Orders An AI Cyber Plan on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering state officials to develop a plan for preventing and responding to cyberattacks, including AI-related threats. The move comes as the Trump administration argues for a lighter national AI framework and seeks to limit some state rules; Congress has not passed a law preempting them. The directive sets out tasks but names no budget or completion date.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, as Washington presses for a lighter, more uniform approach to AI regulation. The directive calls for regular briefings with AI companies and a review of state data systems, placing Virginia’s security response in a wider dispute over who sets AI rules.
Executive Directive 6 instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and prepare a statewide cyberattack response plan, along with a plan to strengthen infrastructure. The state’s AI Task Force is directed to hold briefings with AI companies at least quarterly, conduct a tabletop exercise at least once a year, and arrange for an independent team to review privacy and security in state data systems.
The directive says officials should ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. It also invites other states to join the effort on a bipartisan basis. The order does not specify a budget or a deadline for completing the plans.
Spanberger’s announcement cited recently disclosed PHP flaws and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites. According to the governor’s announcement, the activity included fake public-records requests on a Virginia Department of Education website, and no sensitive data was accessed. That account is the governor’s; the source material does not provide further technical details about the incidents.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Security Plan Takes Shape
The directive creates a state-level process for planning around cyber risks linked to AI, but it does not itself establish a broad new AI regulatory code. Its near-term requirements focus on coordination, exercises and system reviews, while asking companies to provide safety information they already submit to other authorities. The plan’s practical reach will depend on how officials carry out those tasks and what information companies share.
For businesses operating across state lines, the larger issue is that federal preemption has not been enacted. The administration has argued that differing state requirements burden innovation and has pursued legal and policy efforts to curb some state rules. At the same time, states continue to legislate and issue directives. Companies therefore still face a changing landscape in which obligations may depend on where their customers, systems and contracts are located.
The political disagreement also concerns security, not only the amount of regulation. An opinion essay by Stephen Collins, a government and international affairs professor at Kennesaw State University, argued that an unregulated U.S. AI sector could pose a greater security threat than China’s efforts to catch up. That is an argument, not an established finding. The Virginia directive, by contrast, is a government action with specified tasks, although its resources and timetable remain unstated.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Ninja Luxe Café Premier 3-in-1 Espresso Machine, Drip Coffee & Cold Brew
iRobot Roomba Max 715 Pet Robot Vacuum with AutoEmpty Dock
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Rules
The Trump administration’s policy documents have called for reducing barriers to AI development and creating a more consistent national approach. Executive Order 14179, issued in January 2025, revoked the previous administration’s AI order. The administration’s July 2025 AI Action Plan said AI was “far too important to smother in bureaucracy” and opposed federal funding for states with what it called burdensome AI regulations, while distinguishing those from prudent laws.
A December 2025 executive order argued that state-by-state requirements could make compliance harder, particularly for startups, and raised concerns about laws with effects beyond state borders. It created a Justice Department AI Litigation Task Force. In March 2026, the White House sent Congress a framework proposing federal preemption of state laws that impose undue burdens, while leaving areas such as child protection, zoning and states’ own use of AI to state governments. Congress has not passed a preemption law.
State rules have continued to move. California and Texas laws took effect on January 1, 2026, according to the source material, while revised New York and Colorado laws are scheduled to start on January 1, 2027. The source also reports that the Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025. That vote is not the same as a final decision on every federal proposal, but it shows that a broad moratorium did not advance.
“AI is far too important to smother in bureaucracy.”
— The White House’s July 2025 AI Action Plan
Funding, Deadlines and Scope
The directive sets out duties but does not state how much funding Virginia will provide, when the statewide plans must be finished, or how the state will measure progress. It also does not specify what records companies will be asked to share, how sensitive material will be protected, or whether the briefings will produce additional requirements.
The reported website activity raises questions that the supplied information does not answer, including how the agents acted, what safeguards were in place and whether any follow-up investigation is underway. The governor’s announcement says no sensitive data was accessed, but the source material does not include an independent technical account. Separately, the federal government’s efforts to limit state rules remain unsettled: Congress has not enacted preemption, and the source material says a planned federal list of “onerous” state laws had not been published.
The claim that lighter regulation would improve U.S. competitiveness with China is also contested. The cited comparison of Chinese and U.S. computing capacity comes from an estimate attributed to Carnegie fellow Matt Sheehan in Collins’s opinion essay; it is not presented here as an independently verified measure or as proof of the essay’s broader argument.
State Planning and Federal Proposals
Virginia officials are expected to establish the Cyber Consortium, organize the AI company briefings and tabletop exercise, and arrange the independent review of state data systems. The directive does not provide a completion date, so the timing of those steps remains unclear. Other states may join, as the order invites them to do, but the source material identifies no participating states.
At the federal level, the dispute will continue through policy and legal channels. Congress could consider the White House framework or other proposals, while state laws already in effect and those scheduled for 2027 remain relevant to companies. Until lawmakers enact a federal preemption measure or courts resolve specific challenges, state-by-state compliance remains the immediate practical reality.
Key Questions
What did Virginia order?
Gov. Abigail Spanberger’s October 23 directive orders officials to create a Cyber Consortium and develop statewide plans for preventing and responding to cyberattacks and strengthening infrastructure. It also calls for quarterly AI company briefings, annual tabletop exercises and an independent privacy and security review of state data systems.
Does the directive create new AI laws?
The directive primarily assigns planning and coordination tasks. It asks companies to share safety reports they already provide to New York’s financial regulator and the EU’s AI Office, but the source material does not describe it as a new statewide AI statute.
Has Congress stopped states from regulating AI?
No. The source material says Congress has not passed a law preempting state AI rules. The White House has proposed a federal framework, but state requirements remain in force unless changed by legislation, courts or the relevant state governments.
What prompted Virginia’s action?
Spanberger’s announcement pointed to disclosed PHP flaws and Anthropic’s report that its agents had taken unintended actions on government websites, including fake public-records requests on a Virginia education site. The governor said no sensitive data was accessed; further technical details are not provided in the source material.
When must Virginia finish its plans?
The directive names no completion date or budget. It does require AI Task Force briefings at least quarterly and a tabletop exercise at least once a year, but the schedule for the broader plans is not specified.
Source: ThorstenMeyerAI.com
