AI Rules At A Crossroads: Washington Calls For Less, Virginia Orders A Cyber Plan

🔍 Read the full analysis: AI Rules At A Crossroads: Washington Calls For Less, Virginia Orders A Cyber Plan on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Virginia Gov. Abigail Spanberger signed a directive on Oct. 23 ordering state officials to develop plans to prevent and respond to cyberattacks, including risks involving artificial intelligence. The move comes as the White House pushes for fewer state-level AI restrictions and a common national standard, while Congress has not enacted a law overriding state rules.

The directive, Executive Directive 6, instructs Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and prepare a statewide cyberattack response plan, alongside a plan to strengthen infrastructure. Virginia’s AI Task Force must hold briefings with AI companies at least quarterly and conduct a tabletop exercise at least annually. The directive also calls for an independent review of privacy and security across state data systems and invites other states to participate.

Companies are to be asked to share safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive does not specify a budget or a deadline for completing the plans. Spanberger’s office cited newly disclosed software vulnerabilities and Anthropic’s disclosure that its agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education website. The governor said no sensitive data was accessed.

At the federal level, the administration has pursued executive actions to reduce what it calls burdensome state regulation and to promote one national approach. A June 2026 executive order also created an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source account. Those steps show that the federal approach is not limited to deregulation; the dispute concerns both the extent of oversight and which level of government sets it.

Virginia Builds Its Own Cyber Safeguards

The directive gives Virginia a defined process for coordinating cyber response and scrutinizing risks tied to AI systems used by government and companies. Its quarterly briefings, annual exercise and proposed review of state data systems could help officials prepare for incidents, though the directive itself does not establish a budget, finish date or new binding duties for private AI developers.

For businesses, the immediate issue is the state-by-state patchwork. The source reports that California and Texas laws took effect on Jan. 1, 2026, while revised New York and Colorado laws are scheduled to start on Jan. 1, 2027. A federal preemption measure has not passed, so the White House’s stated goal of a single standard has not yet displaced existing or upcoming state requirements.

The policy disagreement also affects how cybersecurity is handled. Virginia is seeking information and coordination at the state level, while federal measures include a voluntary model review and a clearinghouse. The source says 26 attorneys general have asked Congress for federal safety rules and an explicit bar on preemption; a bipartisan House proposal would override only a narrow range of frontier-model rules. These competing approaches leave the scope and authority of future oversight unsettled.

Products Worth Considering

DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle

AmazonView Latest Price

Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor

AmazonView Latest Price

Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Federal Push Meets State AI Laws

The White House’s approach began with Executive Order 14179 in January 2025, which revoked the prior administration’s AI order. The administration’s July 2025 AI Action Plan said AI should not be constrained by excessive bureaucracy and proposed withholding some federal AI funding from states with burdensome regulations, while preserving what it described as prudent laws.

A December 2025 order directed the Justice Department to create an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The task force launched in January 2026. The source reports that a list of targeted state laws had not been published by the time of its account. In March 2026, the White House sent Congress a framework calling for preemption of state laws that impose undue burdens, while leaving areas such as child protection, zoning and state use of AI to state governments.

The debate has also appeared in court and in public commentary. The Justice Department intervened in a challenge to Colorado’s AI law in April 2026; the state later replaced that law with a narrower disclosure-based measure scheduled to take effect in 2027. Separately, a commentary article by Kennesaw State University professor Stephen Collins argued that an unregulated U.S. AI sector could pose a greater security risk than China’s AI progress. That is an argument, not an established finding, and the source describes the comparison as contested.

“Far too important to smother in bureaucracy.”

— The White House’s July 2025 AI Action Plan

Funding, Deadlines and Federal Authority

Virginia’s directive does not say how much the Cyber Consortium or the required reviews will cost, when the statewide plans must be completed, or how agencies will carry out recommendations. It asks companies to share reports they already prepare; the source does not establish that every company will comply or that Virginia has created a new mandatory reporting regime.

It is also unclear whether Congress will enact a federal AI law, whether any such law would preempt state measures, or how courts will resolve challenges to state rules. The administration’s proposed state-law list was reported as unpublished in the source account, and the described congressional framework is not itself a statute. The scale of any cybersecurity threat cited by Virginia, and the effect of the federal clearinghouse and voluntary checks, are not quantified in the material.

The source account is dated Oct. 27, 2026. Its descriptions of current state-law timelines and federal actions should be read as a snapshot; later changes are not established by the material provided.

State Plans and Congress Take Shape

Virginia’s public-safety and homeland-security secretary is directed to organize the Cyber Consortium and develop the statewide plans. The AI Task Force is to begin quarterly company briefings and arrange at least one tabletop exercise each year. The directive also calls for a privacy and security review of state data systems, but does not give a completion date.

At the federal level, Congress remains the key venue for any binding national standard or preemption law. The White House framework and the bipartisan House proposal may inform that debate, but the source does not report a passed bill or a scheduled vote. Companies and public agencies will need to track changes in state laws and any federal legislation rather than assume that a national override is imminent.

Key Questions

What did Virginia order on Oct. 23?

Gov. Abigail Spanberger signed Executive Directive 6, directing officials to establish a Cyber Consortium and prepare plans to prevent and respond to cyberattacks, including measures to strengthen infrastructure.

Does Virginia’s directive create new mandatory reporting rules for AI companies?

The directive says companies are to be asked to share safety reports they already provide to New York’s financial regulator and the EU’s AI Office. The source does not describe a new mandatory reporting requirement for companies.

Has Congress overridden state AI laws?

No federal preemption law is reported as having passed. The White House has proposed limiting some state rules, and a House proposal would address a narrower category, but those efforts have not established a national override.

When do the state laws cited in the source take effect?

The source says California and Texas laws took effect Jan. 1, 2026. Revised New York and Colorado laws are scheduled to begin Jan. 1, 2027; the timelines may change after the source account’s Oct. 27, 2026 date.

Source: ThorstenMeyerAI.com