A Guide To AI Rules As Virginia Orders Cyber Planning And Washington Pulls Back

Read the full analysis: A Guide To AI Rules As Virginia Orders Cyber Planning And Washington Pulls Back on ThorstenMeyerAI.com

Virginia Gov. Abigail Spanberger signed a directive on October 23 requiring state officials to plan for cyberattacks, including those involving artificial intelligence, as Washington pursues a lighter national approach to AI regulation. The directive adds a state-level security initiative to a shifting policy landscape in which federal efforts to limit some state rules have not produced a congressional preemption law.

The directive, Executive Directive 6, instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop statewide plans to prevent and respond to cyberattacks and strengthen infrastructure. It also directs the state AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise, and arrange an independent privacy and security review of state data systems.

Virginia will ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive also invites other states to join the effort. It does not specify a budget or deadline for completing the plans, and it does not establish a new general AI regulatory code.

The White House has pursued a different broad policy direction, arguing for a single, lighter national standard and seeking to challenge state rules it considers burdensome. However, Congress has not passed a law preempting state AI laws. The source material says the Senate rejected a proposed 10-year moratorium on state AI regulation, 99 to 1, in July 2025.

Virginia Builds a State Cyber Framework

The directive matters because it puts state cyber preparedness on a more formal footing while the boundaries of federal and state authority over AI remain unsettled. Companies may face requests from Virginia officials for safety information even as they track separate reporting and compliance duties in other jurisdictions. The directive’s emphasis is on coordination, preparedness and review of government systems, rather than a blanket restriction on AI development.

For organizations using or supplying AI, the immediate practical issue is that state requirements remain relevant unless and until courts or Congress change their status. The source material advises companies to map where their models, customers and contracts operate and to maintain incident-reporting plans. It refers to 72-hour and 15-day reporting clocks, but does not identify the specific laws or incidents to which those timelines apply; companies would need to verify the requirements that govern their own operations.

The political dispute also concerns who sets AI policy, not just how strict it should be. Virginia’s directive signals that at least one state is pursuing its own cyber planning as the federal government contests parts of the state-law landscape. That leaves businesses, public agencies and residents with rules and initiatives that can differ by jurisdiction.

Federal Efforts and State Rules

The federal administration’s stated preference for fewer regulatory barriers appears in several actions described in the source material. Executive Order 14179, issued in January 2025, revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that AI should not be constrained by bureaucracy and said federal funding should not go to states with burdensome AI regulation, while distinguishing those from what it called prudent laws.

Executive Order 14365, dated December 11, 2025, set out the administration’s objections to state AI laws, including compliance across multiple jurisdictions, what it characterized as ideological bias, and laws with effects beyond state borders. It established a Justice Department AI Litigation Task Force, launched in January 2026. A March 2026 White House framework proposed preempting state laws that impose undue burdens while leaving areas such as child protection and state governments’ own AI use to states. These are administration proposals and actions, not a federal statute that has displaced state laws.

The state landscape is changing as well. According to the source material, California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to begin on January 1, 2027. Virginia’s directive asks companies for briefings and existing reports; it is distinct from those state laws. The source also describes federal cybersecurity measures, including a June 2026 order creating an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, showing that Washington’s approach includes security initiatives alongside its push to curb some regulation.

“Far too important to smother in bureaucracy.”

— The White House AI Action Plan, July 2025

Open Questions on Scope and Timing

The directive does not name a budget, completion date or detailed implementation schedule. It also does not state what information companies must provide beyond asking them to share reports already filed with New York and the EU. The limits on sharing confidential material, and how Virginia would protect or use it, are not explained in the supplied account.

The directive’s announcement cited newly disclosed software flaws and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites, including making fake public-records requests on a Virginia Department of Education site. Spanberger said no sensitive data was accessed. The source material does not provide further technical findings or independent verification of the incidents, so their full scope and connection to the new plans remain unclear.

It is also uncertain whether the federal government will secure congressional support for preemption or how courts will resolve challenges involving state AI laws. The source reports that a planned federal list of onerous state laws had not been published as of its account, and it does not establish whether that status has since changed.

Implementation and Federal Response

Virginia’s public safety and homeland security secretary is to establish the Cyber Consortium and develop the statewide cyber and infrastructure plans. The AI Task Force is directed to begin quarterly company briefings, schedule annual exercises and arrange an independent review of state data systems. The directive does not give dates for those steps, so their rollout will need to be tracked through subsequent state announcements.

At the federal level, Congress remains a key point to watch: a preemption law would change the state-by-state picture, but no such law is in force according to the source material. Companies and public agencies will also need to monitor the effective dates of state laws and the development of any related court cases. For now, Virginia’s directive adds a cyber-planning process without resolving the broader dispute over which level of government should set AI rules.

Key Questions

What did Virginia order?

Gov. Abigail Spanberger’s October 23 directive tells state officials to establish a Cyber Consortium and prepare plans to prevent and respond to cyberattacks, including risks involving AI. It also calls for regular AI company briefings, an annual exercise and a review of state data systems.

Does the directive create a new AI law?

The supplied account describes it as a state executive directive focused on cyber planning and coordination. It does not describe a new general AI regulatory statute or provide a new set of broad rules for AI development.

Has Washington barred states from regulating AI?

No federal preemption law is identified in the source material. The administration has proposed and pursued limits on some state rules, but Congress has not enacted a law that broadly displaces them.

What must AI companies share with Virginia?

The directive says Virginia will ask companies to share confidential reports they already submit to New York’s financial regulator under the RAISE Act and to the EU AI Office. The supplied account does not specify how companies should submit them or how Virginia will handle the information.

When will Virginia’s plans be completed?

The directive does not specify a completion date or budget. The timing of the Cyber Consortium, statewide plans, briefings and independent review remains to be announced.

Source: ThorstenMeyerAI.com