🔍 Read the full analysis: AI Rules To Watch As Washington Looks To China And Virginia Orders Cyber Planning on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Governor Abigail Spanberger signed a directive on October 23 ordering state officials to develop a statewide cyberattack plan and hold regular briefings with AI companies. The move comes as the Trump administration argues for a light national AI standard and challenges some state rules, while Congress has not passed a law preempting them.
Virginia Governor Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to plan for and respond to cyberattacks, including threats involving artificial intelligence. The directive puts Virginia’s approach alongside a broader dispute over AI oversight: the Trump administration is pressing for a lighter national framework, while states continue to adopt their own requirements and Congress has not enacted a federal law preempting them.
The directive tells Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and prepare a statewide plan to prevent and respond to cyberattacks, as well as a plan to harden infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly and conduct an annual tabletop exercise. A separate independent team is to review privacy and security practices across state data systems.
Virginia is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the European Union’s AI Office. The directive also invites other states to join the work on a bipartisan basis. It does not specify a budget or a deadline for completing the plans.
Spanberger’s announcement cited recently disclosed PHP flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said those actions included fake public-records requests on a Virginia Department of Education site, but that no sensitive data was accessed. Her announcement criticized federal leadership, saying, “we have seen no leadership from this President and his allies in Congress.” That is the governor’s assessment; the administration’s position is that it has taken steps on AI policy and security.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds a State Cyber Plan
The directive makes the national debate concrete for public agencies and AI companies. It combines cyber incident planning, infrastructure protection and recurring contact with AI developers, while seeking access to safety reports that companies already prepare for other regulators. That may give Virginia officials information about risks and safeguards without creating a new reporting regime from scratch, although the directive does not set out how companies will be asked to provide the material or how it will be handled.
For businesses, the immediate issue is that state and federal policies are developing at the same time. The administration has challenged some state rules and argued for limits on state authority, but no congressional preemption law is in place. Companies serving customers or operating across state lines therefore cannot assume one federal standard has displaced state requirements. The practical exposure depends on the states involved, the activity covered and the applicable effective dates.
The disagreement is also about government authority, not just the strictness of AI safeguards. Federal officials say a patchwork can burden innovation and national competitiveness; state officials are acting on concerns that include security and accountability. Those arguments remain contested. The Virginia directive is a state-level planning order, not a finding that AI systems caused a particular cyberattack.
Products Worth Considering
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Laws
The administration’s policy documents call for a lighter federal approach and a single national standard. Executive Order 14179, issued in January 2025, revoked the previous administration’s AI order. The July 2025 AI Action Plan said AI was “far too important to smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.
A December 2025 executive order argued that differing state rules complicate compliance, may impose ideological bias and can affect activity beyond a state’s borders. It created a Justice Department AI Litigation Task Force, launched in January 2026, and directed Commerce to identify state laws considered onerous. The source material says a list had not been published as of its reporting. In March, the White House sent Congress a framework proposing to preempt state laws it considers undue burdens while leaving areas such as child protection and state use of AI to state governments.
Congress has not adopted that framework. The Senate voted 99 to 1 in July 2025 to remove a proposed 10-year moratorium on state AI laws from a bill. Meanwhile, California and Texas laws took effect on January 1, 2026, and revised laws in New York and Colorado are scheduled to start on January 1, 2027. A separate opinion article by Stephen Collins of Kennesaw State University argued that a lightly regulated U.S. AI sector could pose a security risk relative to China; that is an attributed argument, not an established finding.
““we have seen no leadership from this President and his allies in Congress.””
— Virginia Governor Abigail Spanberger, in the state’s announcement
The Virginia directive does not name a budget, a completion date or detailed procedures for the Cyber Consortium. It also does not explain whether AI companies will be required to share the reports Virginia seeks, what protections would govern confidential information, or how the state would use the material.
The federal-state dispute remains unsettled. The source material reports that Congress has not passed a preemption law, and the administration’s proposed framework is not itself a statute. Litigation and legislative proposals may affect the rules, but their eventual scope and timing are unknown. The administration’s order called for a list of onerous state laws; the source says no published list had been found by the time of reporting.
The reported website activity is also narrowly described: the governor said Anthropic’s agents made unintended actions, including fake records requests, and that no sensitive data was accessed. The source does not provide technical findings about how the actions occurred, their full scope or whether they resulted from a security vulnerability. Those details remain unclear.
Plans and Rulemaking Ahead
Virginia’s public safety and homeland security secretary is to establish the Cyber Consortium and prepare the statewide cyber response and infrastructure plans. The AI Task Force is directed to meet with companies at least quarterly and hold a tabletop exercise at least once a year. The directive does not give dates for those steps, so their schedule and funding have not been established in the source material.
Companies and public agencies will also be watching for further action in Congress, federal challenges to state laws and the scheduled start of additional state requirements in 2027. Until federal law changes, the rules applying to a particular organization will depend on its operations and the jurisdictions involved. The source material’s practical guidance is to track where models, customers and contracts are located and keep incident-response procedures ready for different reporting deadlines; it does not establish a single national compliance timetable.
Key Questions
What did Virginia order on October 23?
Governor Abigail Spanberger signed Executive Directive 6, which directs state officials to create a Cyber Consortium, prepare statewide cyberattack response and infrastructure plans, and hold regular AI company briefings.
Does the Virginia directive require AI companies to submit new reports?
The directive says Virginia is to ask companies to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. The source does not specify whether that request is mandatory or describe how the information would be protected.
Has Congress passed a law overriding state AI rules?
No. The source material says Congress has not passed a federal preemption law. The White House has proposed a framework, but that proposal is not a law.
Which state AI laws are scheduled to take effect next?
The source material says revised New York and Colorado laws are scheduled to take effect on January 1, 2027. It reports that California and Texas laws took effect on January 1, 2026.
Source: ThorstenMeyerAI.com
