🔍 Read the full analysis: Washington Says Regulate Less; Virginia Orders AI Cyber Planning. What Applies? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering statewide planning for cyberattacks involving AI and other threats, while asking AI companies to share existing safety briefings. The federal government is also pursuing a lighter, more uniform approach to AI regulation, but Congress has not passed a law preempting state rules, so companies still face a changing state-by-state landscape.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 requiring state officials to plan for cyberattacks, including those involving AI, while the Trump administration presses for a lighter national approach to AI rules. Congress has not enacted a federal law overriding state AI regulations, leaving organizations to navigate existing state requirements as new rules take effect.
Executive Directive 6 tells Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop statewide plans to prevent and respond to cyberattacks and strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, run an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states may be invited to take part.
The directive says officials should ask AI companies to share confidential safety reports they already provide to New York’s financial regulator and the European Union’s AI Office. It does not specify a budget or deadline for completing the plans. Spanberger’s announcement cited recently disclosed software flaws and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites. The governor said no sensitive data was accessed in the Virginia incident she cited.
At the federal level, executive orders and a White House framework have sought to reduce what the administration describes as burdensome state rules and promote a more uniform national standard. But the administration’s effort has not produced congressional preemption. A proposed 10-year moratorium on state AI regulation was removed from a Senate bill in July 2025 by a 99-to-1 vote, according to the source material. State laws remain in force unless changed or blocked through other legal or legislative action.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia Adds a Cyber Planning Layer
The directive adds a statewide planning process at a time when governments and businesses are weighing how AI systems could affect cyber risks and public services. Its requirements focus on coordination, exercises and information-sharing; the directive does not itself create a general set of AI product rules or establish penalties for companies that do not provide the requested reports.
For companies, the immediate regulatory picture is not a single national code. The source material says California and Texas laws took effect on January 1, 2026, while rewritten laws in New York and Colorado are due to start on January 1, 2027. Which requirements apply can depend on a company’s activities, customers, contracts and the jurisdictions involved. The federal push could change that picture, but a policy framework or executive order is not the same as a law passed by Congress.
The disagreement also concerns who should set AI policy. The White House has argued that varied state rules can burden innovation and businesses, while Virginia is asking companies to share existing safety information as the state builds its response plans. Those positions are not mutually exclusive: federal officials can seek fewer state rules while state governments continue to prepare for cyber incidents under their current authority.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push, State Rules
The administration’s policy developed through executive actions and proposals. Executive Order 14179, issued in January 2025, revoked the previous administration’s AI order. A July 2025 AI Action Plan called AI too important to “smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while recognizing what it called prudent state laws.
Executive Order 14365, dated December 11, 2025, directed the Justice Department to create an AI Litigation Task Force and told the Commerce Department to identify state laws the administration considers onerous. The source material reports that a list had not been published as of the reporting cited. In March 2026, the White House sent Congress a framework proposing that federal action preempt some state restrictions on AI development, while leaving areas such as child protection and state governments’ own use of AI to the states.
That proposal has not settled the dispute. The source material also describes a separate federal security effort launched in June 2026, including an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. Separately, it says 26 state attorneys general asked Congress for federal AI safety rules and an explicit ban on preemption. A bipartisan House bill would preempt only a narrower set of rules covering frontier models. These remain distinct proposals and actions, not one enacted national regime.
Deadlines, Funding and Federal Reach
Virginia’s directive does not set a budget or completion date, and the source material does not establish when the Cyber Consortium or statewide plans will be operational. It is also not clear how many companies will share confidential reports, what information they will provide, or how the state will handle those materials.
The broader federal-state dispute remains unresolved. The administration’s executive actions and framework do not amount to congressional preemption, and proposed federal legislation could change before passage or fail to become law. The source material does not establish the current status of every state measure, court challenge or federal proposal beyond the developments it describes.
Spanberger cited Anthropic’s disclosure about unintended agent actions on government websites and said no sensitive data was accessed in the Virginia incident. The full technical details, scope and any subsequent investigation findings are not provided in the source material. The federal government and Virginia also differ in their assessments of federal leadership; those are political positions, not settled factual conclusions.
State Planning and Congress
Virginia agencies are directed to organize the consortium, prepare cyber response and infrastructure plans, schedule quarterly company briefings and conduct an annual exercise. The directive also calls for an independent review of state data systems. The next practical indicators will be the state’s implementation schedule, any funding decisions and whether companies provide the requested reports.
At the federal level, Congress would need to pass legislation to establish statutory preemption of state AI laws. Until that happens, companies should track the laws that apply to their operations and monitor court cases and agency actions, rather than treating the administration’s proposed national framework as binding law. The source material gives no confirmed date for a congressional vote or a final resolution of the federal-state dispute.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed a directive requiring a statewide cyber planning effort. It calls for a Cyber Consortium, plans to prevent and respond to attacks, regular AI company briefings, an annual exercise and an independent review of state data systems.
Does the directive create new AI product regulations?
The directive is focused on state cybersecurity planning and information-sharing. The source material does not describe it as a general AI product regulation or say that it creates new company penalties.
Has Washington overridden state AI laws?
No congressional preemption law is reported in the source material. The administration has used executive actions and proposed a federal framework, but those steps have not themselves replaced state statutes with one national law.
Which state AI laws are in effect or scheduled to start?
The source material says California and Texas laws took effect on January 1, 2026. Rewritten laws in New York and Colorado are scheduled to begin on January 1, 2027. Specific obligations depend on the law and the organization’s activities.
When will Virginia’s plans be completed?
The directive does not provide a completion date or budget. The timing will depend on how Virginia agencies implement its requirements.
Source: ThorstenMeyerAI.com
