🔍 Read the full analysis: The Push And Pull Over AI Rules: Washington’s China Strategy, Virginia’s Plan on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Governor Abigail Spanberger signed a directive on October 23, 2026, ordering a statewide cybersecurity plan and regular engagement with AI companies. The move comes as the White House seeks to limit some state AI rules and promote a lighter national framework, while Congress has not enacted federal preemption. Companies and residents still face a changing mix of state requirements.
Virginia Governor Abigail Spanberger signed an executive directive on October 23 ordering a statewide plan to prevent and respond to cyberattacks, including risks involving artificial intelligence. The directive adds to a growing dispute over AI oversight: the White House is pressing for a lighter national standard and action against some state laws, while states continue to set their own requirements and Congress has not passed a law overriding them.
Executive Directive 6 instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and develop statewide plans for cyberattack response and infrastructure security. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise, and commission an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
The directive asks companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. It does not specify a budget or deadline for completing the plans. Spanberger’s announcement cited recently disclosed vulnerabilities and Anthropic’s report that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed.
At the federal level, the administration’s stated approach is to reduce what it calls burdensome rules and establish a single national framework. A March 20, 2026, White House framework called for preempting state laws that impose undue burdens, while leaving areas such as child protection, zoning and states’ own use of AI to state governments. The proposal is not federal law. The source material reports that the Senate rejected a proposed 10-year preemption moratorium by a 99-to-1 vote in July 2025; Congress has not enacted a general preemption law.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Who Sets the Rules for AI
The immediate effect is a new planning and coordination mandate for Virginia agencies, not a nationwide rule for AI companies. But the directive illustrates the practical split in oversight: federal officials seek to curb certain state requirements, while state governments are building their own safety and security measures. Until Congress or the courts settle more of that boundary, obligations may depend on where a company operates, which customers it serves and what contracts or sector-specific laws apply.
The dispute also concerns what counts as AI policy. The White House argues that a patchwork can make compliance harder, particularly for smaller companies, and can burden innovation. State officials and advocates for state authority point to risks that require public safeguards, including cyber incidents and privacy concerns. Those are competing policy arguments, not settled findings about the effects of regulation on US competitiveness or national security.
For residents, Virginia’s plan could shape how state agencies prepare for attacks and scrutinize their data systems. The directive’s impact will depend on its implementation, including which companies participate, what information is shared and whether the plans lead to new state requirements.
Products Worth Considering
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push and State Action
The federal effort began with Executive Order 14179 in January 2025, which revoked the previous administration’s AI order. The administration’s July 2025 AI Action Plan described AI as “far too important to smother in bureaucracy” and said federal funding should not go to states with burdensome AI regulations, while preserving room for what it called prudent laws.
A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and the Commerce Department to identify state laws considered onerous. The task force launched in January 2026. The source material says no Commerce Department list had been published as of its reporting. Separately, a federal framework sent to Congress in March proposed limiting state regulation of AI development. A federal challenge to Colorado’s AI law followed; the state later replaced that law with a narrower disclosure-based measure scheduled to take effect January 1, 2027.
State rules are also moving on their own timelines. According to the source material, AI laws in California and Texas took effect January 1, 2026, while revised laws in New York and Colorado are due to start January 1, 2027. In June 2026, the White House also established an AI cybersecurity clearinghouse and a voluntary pre-release review process for the most capable models, showing that the federal approach includes some security measures alongside its push to reduce regulation.
““We have seen no leadership from this President and his allies in Congress.””
— Virginia Governor Abigail Spanberger
How Virginia’s Plan Will Work
The directive sets duties and recurring activities but names no budget or completion date. It is not yet clear which companies will share reports, how Virginia will handle confidential material, or what the independent review of state data systems will find. The directive asks for information companies already provide to New York and the EU; the source does not establish that those companies have agreed to share it with Virginia.
The broader legal boundary between federal and state authority also remains unsettled. The White House framework is a proposal, and Congress has not enacted general preemption. Litigation and future legislation could change which state rules stand. The source material’s claims about the security consequences of lighter regulation, including arguments about competition with China, are contested policy judgments rather than established conclusions.
Plans, Litigation and State Deadlines
Virginia agencies are expected to organize the Cyber Consortium, develop the statewide plans and arrange the AI Task Force’s quarterly briefings and annual exercise. The directive does not give a deadline, so the timing and public availability of those plans remain unknown. Participation by other states and AI companies will also help determine whether the effort becomes a wider coordination model.
Meanwhile, companies will have to track state requirements as they take effect and watch for federal legislation, court rulings and agency actions. The revised Colorado and New York laws are scheduled to begin January 1, 2027, according to the source material. No general federal preemption measure is currently in force, leaving the state-by-state compliance picture subject to further political and legal change.
Key Questions
What did Virginia’s October 23 directive require?
It ordered state officials to establish a Cyber Consortium and develop plans to prevent and respond to cyberattacks and protect infrastructure. It also called for quarterly AI-company briefings, an annual exercise and an independent review of state data systems.
Does Virginia’s directive create new AI rules for all companies?
The directive requires state planning and asks AI companies to share certain existing reports. The source material does not say it creates a broad new set of binding rules for all companies.
Has the federal government overridden state AI laws?
No general federal preemption law has been enacted, according to the source material. The White House has proposed limiting some state laws, but a proposal is not a law.
Why is Washington challenging some state AI rules?
The administration says differing state requirements can complicate compliance, burden companies and affect innovation. Supporters of state action argue that states need authority to address risks such as privacy and cybersecurity. These arguments remain part of a policy dispute.
What should companies watch next?
Companies should monitor the start dates and details of applicable state laws, as well as litigation and any federal legislation. Virginia’s plans may also clarify how the state intends to coordinate with companies and other governments.
Source: ThorstenMeyerAI.com
