🔍 Read the full analysis: Can Washington’s Deregulation Push And Virginia’s AI Plan Both Apply? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Virginia Governor Abigail Spanberger signed a directive on October 23 calling for a statewide plan to prevent and respond to cyberattacks, including risks involving AI. The move comes as the White House seeks a lighter national AI framework and challenges some state rules, but Congress has not passed a law preempting them.
Virginia Governor Abigail Spanberger signed Executive Directive 6 on October 23, ordering work on a statewide plan to prevent and respond to cyberattacks, while the White House is pressing for lighter, more uniform AI rules and challenging some state regulations. The directive adds to a growing federal-state dispute, but Congress has not passed a law preempting state AI rules, so companies must still account for requirements in the states where they operate.
The directive tasks Virginia’s Secretary of Public Safety and Homeland Security with establishing a Cyber Consortium and developing plans to respond to cyberattacks and strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise, and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.
Virginia intends to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or deadline for completing the plans. Spanberger’s announcement cited recently disclosed software flaws and Anthropic’s report that its AI agents had taken unintended actions on government websites. The governor said no sensitive information was accessed in the Virginia Department of Education incident she referenced.
At the federal level, the administration has called for a single, lighter national standard and has taken steps to challenge what it considers burdensome state rules. A White House framework sent to Congress in March proposed preempting some state laws, but it is not legislation. A separate Senate proposal for a 10-year moratorium on state AI laws was rejected 99 to 1 in July 2025. No federal preemption law has since been enacted, according to the source account.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
State AI Duties Persist Without Preemption
The immediate practical consequence is that Virginia’s directive and existing state requirements remain relevant even as federal officials argue for fewer separate rules. A national preemption law could change which governments set AI obligations, but the administration’s stated preference and its legal challenges do not by themselves cancel state laws.
That leaves organizations using or supplying AI with a jurisdiction-by-jurisdiction compliance problem. They may need to track where their systems are used, which customers or public agencies rely on them, and what reporting duties apply. The source account notes that some state rules use different reporting timelines, including 72-hour and 15-day clocks; exact obligations depend on the law and the incident. Virginia’s directive asks companies for existing briefings, but does not itself set out a new general reporting deadline for private firms.
The policy disagreement also has a security dimension. Spanberger’s directive frames cyber preparedness as a state responsibility and calls for coordination with AI companies and other states. The White House has also pursued federal cybersecurity measures, so the dispute is not simply about whether government should address AI risk. It concerns which level of government sets the rules, how broad those rules should be, and whether state requirements will be displaced.
Products Worth Considering
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal and State Rules Diverge
The White House’s approach began with Executive Order 14179 in January 2025, which revoked the prior administration’s AI order. Its July 2025 AI Action Plan argued that AI should not be burdened by excessive bureaucracy and said federal funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws. A later executive order, dated December 11, 2025, directed the Justice Department to form an AI Litigation Task Force and asked the Commerce Department to identify state laws it considered onerous. The source says no such list had been published as of its reporting.
In March 2026, the White House sent Congress a framework proposing that federal action preempt some state rules, while leaving areas such as child protection, zoning and states’ own use of AI to state governments. A legal challenge followed in Colorado: xAI sued over the state’s AI law, and the Justice Department intervened, arguing the law violated equal protection. After enforcement was suspended by agreement, Colorado replaced the law with a narrower disclosure-based measure scheduled to take effect January 1, 2027.
States have continued legislating. The source reports that California and Texas AI laws took effect on January 1, 2026, while revised laws in New York and Colorado are due to start in 2027. It also says 26 attorneys general urged Congress to adopt federal safety rules and explicitly prohibit preemption, while a bipartisan House bill would preempt only a narrower set of frontier-model rules. Those proposals are not equivalent to enacted federal law.
“We have seen no leadership from this President and his allies in Congress.”
— Virginia Governor Abigail Spanberger
Funding, Deadlines and Legal Reach
The Virginia directive sets out tasks but does not provide a budget, completion date or detailed implementation schedule. It is also unclear which companies will be asked to provide reports, how Virginia will handle confidential material, or what the state will do if firms decline to share it. The directive’s call for quarterly briefings and an annual exercise does not, on its own, establish the final scope or legal force of every planned measure.
The broader federal-state balance is unsettled. The White House has proposed preemption and pursued litigation, but proposals and executive actions are not the same as a comprehensive law passed by Congress. The effect of ongoing or future court cases, and whether Congress will act, remains unknown. A separate security-focused federal order and state initiatives may also overlap; the source material does not establish how those efforts will be coordinated with Virginia’s plan.
The argument that lighter regulation is necessary to compete with China is also a contested policy claim, not a settled conclusion. The source article attributes that argument to an opinion essay and notes that its reasoning is disputed. The available material does not resolve how federal deregulation, state safety rules and national security outcomes should be weighed against one another.
Virginia Begins Building Its Plan
The next steps under Executive Directive 6 are for Virginia officials to establish the Cyber Consortium and develop the cyber response and infrastructure plans. The AI Task Force is directed to begin recurring company briefings and schedule at least one tabletop exercise each year. The directive also calls for an independent review of state data systems and invitations to other states to join the effort.
For companies, the near-term position remains compliance with applicable state rules while federal proposals and legal challenges proceed. Businesses will need to check which laws apply to their systems and customers rather than assume Congress will soon replace them with one standard. The source material gives no confirmed date for a federal preemption bill to become law or for Virginia to complete its plans.
Key Questions
What did Virginia’s Executive Directive 6 require?
It directed state officials to create a Cyber Consortium and statewide cyberattack response and infrastructure plans. It also calls for quarterly AI company briefings, an annual tabletop exercise and an independent privacy and security review of state data systems.
Does the directive create a new reporting deadline for AI companies?
The source material says Virginia plans to ask companies to share confidential reports they already provide to New York’s financial regulator and the EU’s AI Office. It does not describe Executive Directive 6 as setting a new general private-sector reporting deadline.
Has Congress preempted state AI laws?
No. The source reports that Congress has not passed a federal preemption law. White House proposals and litigation do not by themselves repeal state requirements.
Why does the federal-state disagreement matter to companies?
Until the law changes, requirements can vary by state. Companies may need to map where their AI systems are used and check the reporting and other duties that apply in each jurisdiction.
Source: ThorstenMeyerAI.com
