🔍 Read the full analysis: The AI Regulation Divide Between Washington’s China Strategy And Virginia’s Plan on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Gov. Abigail Spanberger signed a directive on October 23 calling for a statewide plan to prevent and respond to cyberattacks involving AI, while asking companies to share safety briefings provided to New York and the EU. The directive comes amid a federal push to limit state AI regulation, but Congress has not passed a law preempting state rules. How the competing approaches will affect companies and which federal proposals will advance remain unresolved.
Virginia Gov. Abigail Spanberger signed a directive on October 23 ordering state officials to develop a plan to prevent and respond to cyberattacks, including those involving AI, as Washington seeks to limit state-level AI regulation. The directive asks AI companies to share safety briefings they already provide to New York regulators and the European Union, highlighting a dispute over who sets AI rules while Congress has yet to pass a federal law overriding state requirements.
Executive Directive 6 instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and prepare a statewide cyberattack response plan, alongside a plan to strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
The directive says companies should be asked to share confidential safety reports they already submit to New York’s financial regulator under its RAISE Act and to the EU AI Office. It does not set a budget or a deadline for completing the plans. The governor’s announcement cited recently disclosed software flaws and Anthropic’s report that its agents took unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed.
Washington’s policy documents call for a lighter, more uniform national approach and for challenging state rules considered burdensome. But the federal government has also pursued cybersecurity measures: a June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source material. Congress has not enacted a law preempting state AI rules, leaving companies to contend with existing and forthcoming state requirements.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Who Sets the Rules Companies Face
The dispute affects which requirements apply to AI developers and users, and whether companies can rely on one national framework or must track different state rules. Virginia’s directive adds a state-led cybersecurity planning process even as the administration argues that a patchwork of rules can burden businesses and impede innovation.
For now, the conflict is not settled by a federal preemption statute. California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027, according to the source material. That means companies’ immediate obligations depend on the laws already in force and the jurisdictions in which they operate; proposals to replace that system remain subject to political and legal developments.
The disagreement also concerns the scope of security oversight. The federal government describes its approach as reducing barriers while pursuing targeted security measures. Virginia’s plan, by contrast, emphasizes state coordination, company briefings and review of state data systems. Whether those efforts produce new binding obligations is not specified in the directive as described.
Products Worth Considering
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
FLEXISPOT 32-Inch Electric Standing Desk Converter with Keyboard Tray
FLEXISPOT 36-Inch Electric Standing Desk Converter, Black
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Action
The administration’s approach began with Executive Order 14179 in January 2025, which revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that AI was “far too important to smother in bureaucracy” and called for withholding some federal AI funding from states with burdensome regulations, while recognizing “prudent laws.”
A later executive order, dated December 11, 2025, directed the Justice Department to create an AI Litigation Task Force and instructed the Commerce Department to identify state laws viewed as onerous. The Justice Department task force launched on January 9, 2026. The source material says a list of state laws had not been published as of the account’s reporting, despite the order’s timetable.
In March 2026, the White House sent Congress a framework proposing to preempt state rules that impose undue burdens and bar states from regulating AI development, while leaving areas such as child protection and state use of AI to state governments. A dispute over Colorado’s law followed: xAI sued in April, and the Justice Department intervened. Colorado later repealed and replaced its law with a narrower disclosure-based measure due to take effect in 2027. The federal framework remains a proposal, not an enacted preemption law.
“AI is “far too important to smother in bureaucracy.””
— The White House AI Action Plan, July 2025
Deadlines, Funding and Legal Reach
Virginia’s directive provides no budget or completion date, and the source material does not specify when the Cyber Consortium will be established or when the statewide plans will be ready. It also remains unclear whether companies will share the requested reports voluntarily, what information the state will receive, or how those materials will be protected.
At the federal level, Congress has not passed a law preempting state AI rules. The source material describes a White House framework and executive actions, but does not establish that they have displaced state statutes. The scope and outcome of legal challenges, including the federal government’s challenge to state regulation, also remain unsettled. The source’s account of a Virginia-linked incident says no sensitive data was accessed, but does not detail the full extent of the agents’ actions or any resulting changes to government systems.
Virginia’s Planning Process Begins
Virginia’s next steps are for state officials to organize the Cyber Consortium, schedule the AI Task Force’s company briefings and develop its cyber response and infrastructure plans. The directive calls for briefings at least quarterly and a tabletop exercise at least annually, but does not provide dates for the first sessions.
At the national level, the next key development would be congressional action on the White House framework or other proposals to define federal authority over state AI laws. Until a preemption law is enacted, companies will need to monitor state requirements and changes to litigation or federal policy rather than assume a single national rule has replaced them.
Key Questions
What did Virginia order on October 23?
Gov. Abigail Spanberger signed a directive directing state officials to form a Cyber Consortium and develop plans to prevent and respond to cyberattacks, including threats involving AI. It also calls for regular company briefings, an annual exercise and a review of state data systems.
Does Virginia’s directive create a new AI law for companies?
The directive, as described in the source material, orders state planning and asks companies to share safety reports they already provide to New York and the EU. It does not specify a new general compliance rule or penalty for AI companies.
Has Congress overridden state AI laws?
No federal preemption law has been passed, according to the source material. The White House has sent Congress a framework, but that proposal is not itself an enacted law.
Why does the dispute matter to AI companies?
Without a federal law replacing state requirements, companies may need to track rules in each jurisdiction where they operate or serve customers. State laws already in effect and laws scheduled to begin in 2027 make the policy dispute relevant to current planning.
Source: ThorstenMeyerAI.com
