🔍 Read the full analysis: How Federal And Virginia AI Policies Meet In The Cybersecurity Debate on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to plan for AI-driven cyberattacks and seek safety briefings from AI companies. The directive lands amid a federal push for a lighter national AI framework and efforts to limit some state rules; Congress has not enacted a law preempting state AI policies.
Virginia Gov. Abigail Spanberger signed an executive directive on October 23 ordering state officials to develop a plan to prevent and respond to cyberattacks, including those involving artificial intelligence. The move adds a state-level cybersecurity initiative to a national dispute over AI oversight, as the federal government pursues a lighter, more uniform approach but Congress has not passed a law preempting state AI rules.
Executive Directive 6 instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create a statewide plan for cyberattack response and infrastructure protection. It also assigns responsibilities to the state’s AI Task Force: hold briefings with AI companies at least quarterly, run an annual tabletop exercise, and arrange an independent privacy and security review of state data systems. Virginia plans to invite other states to participate on a bipartisan basis.
The directive asks AI companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the European Union’s AI Office. The directive does not name a budget or set a deadline for completing the plans. Those omissions leave the schedule, resources and practical scope of the work unsettled.
The governor’s announcement cited recently disclosed software vulnerabilities and Anthropic’s report that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed. The cited incidents help explain the directive’s focus, but do not by themselves establish the scale of the risk or the effectiveness of the proposed response.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Virginia’s Plan Meets Federal Policy
The directive matters because it makes the federal-state dispute concrete for agencies and companies operating across jurisdictions. Washington has argued for a single, lighter national standard and has challenged some state requirements; Virginia is asking companies to share existing safety information and is directing state agencies to prepare for cyber incidents. For now, businesses may have to track both federal policy and state-specific obligations.
That uncertainty affects planning, not just legal arguments. Companies selling AI systems to governments or operating in regulated sectors may need to account for different reporting, disclosure and security expectations. Virginia’s request relies on reports companies already submit elsewhere, but the directive does not specify how the state will handle the information or whether companies must provide it. Those details will shape the burden and the value of the plan.
The debate also concerns the division of authority. The federal government’s stated concerns include fragmented compliance and rules it considers burdensome or beyond state borders. State officials, including Spanberger, argue that local governments need tools to address risks in the absence of federal leadership. Those are competing political positions; the directive does not settle which level of government will ultimately control AI safety policy.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Policy Dispute Behind the Directive
The federal approach outlined in the source material began with Executive Order 14179 in January 2025, which revoked the previous administration’s AI order. A July 2025 AI Action Plan called for reducing regulatory barriers, and a December 2025 order directed federal agencies to challenge certain state AI laws. The Justice Department created an AI Litigation Task Force in January 2026. The source reports that a White House framework sent to Congress in March proposed preempting state laws it considers burdensome, while leaving areas such as child protection and states’ own use of AI to state authorities.
Those actions have not produced a general federal preemption statute. The source says the Senate rejected a proposed 10-year AI moratorium in July 2025 by a vote of 99 to 1. It also describes a separate federal cybersecurity track: a June 2026 order set up an AI cybersecurity clearinghouse and a voluntary pre-release review for the most capable models. These initiatives suggest the federal posture is not simply an absence of security activity; the dispute is also over the form and level of regulation.
State policies continue to develop. According to the source, California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start January 1, 2027. Virginia’s directive seeks briefings linked to existing New York and EU reporting arrangements rather than announcing a new comprehensive AI statute. The source also says 26 state attorneys general have urged Congress to set federal safety rules while expressly barring preemption, underscoring that states do not all take the same position on federal authority.
Funding, Deadlines and Data Protections
The directive does not identify funding, a completion date or detailed implementation rules. It is also unclear which companies will be asked to provide reports, what information Virginia will receive, how confidential material will be protected, and whether the state will publish findings. The text calls for companies to be asked to share reports; it does not establish a new compulsory reporting requirement.
The broader federal-state dispute remains unresolved. The source says a federal list of state laws deemed onerous had not been published in the reporting reviewed, and Congress had not enacted the proposed preemption framework. Future legislation, court decisions or agency actions could change which rules apply. The source’s account of the federal cybersecurity order also does not specify how its clearinghouse or voluntary reviews will interact with Virginia’s plan.
Claims about AI and national security remain contested as well. The source describes an opinion argument that weak regulation could create a greater security risk than competition from China, but identifies it as an argument rather than an established finding. The cited concerns about model capabilities and cyber incidents should not be treated as proof of a settled comparison between countries or of the likely impact of any single policy.
Virginia’s Plans and Federal Response
The next concrete steps depend on the state agencies tasked with carrying out Directive 6. They are expected to form the Cyber Consortium, develop the statewide cyberattack and infrastructure plans, begin the AI company briefings and schedule an annual exercise. The directive sets no public deadline, so the timing of those milestones has not been established.
Federal policy may develop through Congress, executive agencies and litigation over state laws. Companies and public agencies will need to monitor those developments alongside state implementation, rather than assume that a national preemption law is imminent. For now, the directive establishes Virginia’s requested process; its operational requirements and relationship to other AI rules remain to be worked out.
Key Questions
What did Virginia’s Executive Directive 6 order?
It directs state officials to establish a Cyber Consortium and develop plans to prevent and respond to cyberattacks and protect infrastructure. It also calls for quarterly AI company briefings, an annual exercise and an independent review of state data systems.
Does the directive require AI companies to submit new reports?
Not expressly. It asks companies to share safety reports they already provide to New York’s financial regulator and the EU’s AI Office. The directive does not specify which firms will be approached or make the request a new compulsory filing requirement.
Has Congress stopped states from regulating AI?
No federal law broadly preempting state AI rules has been enacted, according to the source material. The White House has advocated preemption, while lawmakers and state officials remain divided over its scope.
When will Virginia’s plan be completed?
The directive does not give a completion date or budget. The timing and details of the plans remain to be set by the state officials responsible for carrying them out.
Source: ThorstenMeyerAI.com
