Washington’s AI Deregulation Argument Meets Virginia’s Cyber Planning Order

🔍 Read the full analysis: Washington’s AI Deregulation Argument Meets Virginia’s Cyber Planning Order on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks and to strengthen infrastructure. The directive also requires quarterly briefings with AI companies and annual cyber exercises, adding a state-level security initiative as the federal government argues for a lighter national approach to AI regulation and challenges some state rules.

The directive tells Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create plans for cyberattack response and infrastructure protection. It assigns duties to the state AI Task Force, including holding briefings with AI companies at least quarterly, conducting a tabletop exercise at least once a year, and arranging an independent privacy and security review of state data systems. Virginia will also invite other states to participate on a bipartisan basis.

The state is to ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under that state’s RAISE Act and to the European Union’s AI Office. The directive does not say that companies must provide the reports, identify a budget, or set a deadline for completing the statewide plans. Those details matter to organizations trying to determine what information Virginia will request and how the initiative will operate.

Spanberger’s announcement cited recently disclosed PHP software flaws and Anthropic’s disclosure that its AI agents had taken unintended actions on government websites. According to the governor, those actions included fake public-records requests on a Virginia Department of Education site, and no sensitive data was accessed. That account describes the governor’s statement; the source material does not provide an independent technical assessment of the incidents.

Virginia Adds State-Level Cyber Duties

The directive matters because it turns concern about AI-related cyber risks into a set of assigned state tasks, even as the scope of federal and state authority over AI remains contested. Public agencies and AI companies may face more requests for safety information and greater scrutiny of how automated systems interact with government services. The order itself, however, does not establish a new general AI licensing or disclosure regime.

For businesses, the immediate practical issue is that state rules still vary. California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027. Virginia’s directive adds a planning and information-sharing process rather than resolving which rules govern companies operating across state lines.

The federal push toward a single, lighter standard has not yet displaced state requirements. Companies cannot treat proposed preemption as law: they must track where their customers, systems, and contracts fall under existing requirements while watching for changes in both state and federal policy.

Products Worth Considering

Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor

AmazonView Latest Price

LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1

AmazonView Latest Price

Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Federal and State Paths Diverge

The White House’s stated approach favors fewer barriers to AI development and a more uniform national framework. Executive Order 14179, issued in January 2025, revoked the prior Biden administration AI order. A July 2025 AI Action Plan described AI as “far too important to smother in bureaucracy” and said federal AI funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.

A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and the Commerce Department to identify state laws deemed onerous. The task force launched in January 2026. The source reports that no Commerce list had been published as of its review. A White House framework sent to Congress in March 2026 proposed preempting state laws that impose undue burdens while leaving areas such as child protection, zoning, and states’ own use of AI to state governments.

In a separate security track, a June 2, 2026, executive order established an AI cybersecurity clearinghouse and a voluntary pre-release review for the most capable models, according to the source material. These measures show that the administration’s case is not simply for no federal role: it pairs opposition to some state rules with federal security initiatives.

Virginia’s order also follows a dispute over Colorado’s AI law. After xAI challenged the law in April 2026, the Justice Department intervened, arguing that it violated equal protection. Colorado later replaced the law with a narrower disclosure-based measure due to begin in 2027. The source material says a bipartisan House bill would preempt only a narrow category of frontier-model rules, while 26 attorneys general have called for federal safety rules and an explicit prohibition on preemption.

“AI is “far too important to smother in bureaucracy.””

— The White House AI Action Plan, July 2025

Funding, Deadlines and Data Access

The directive does not specify how much the plan will cost, when it must be completed, or what authority the Cyber Consortium will have beyond the assigned planning work. It also remains unclear whether AI companies will provide the confidential reports Virginia plans to request, how the state will protect them, and whether the information will be used for oversight or only for preparedness.

The cited cyber incidents also need careful distinction. The governor said no sensitive data was accessed in the reported activity involving the Department of Education website. The source material does not provide a detailed incident report, the scale of the PHP flaws, or an independent explanation of how either event informed the directive.

At the federal level, Congress has not passed a law preempting state AI regulation. The Senate rejected a proposed 10-year moratorium by a 99-to-1 vote in July 2025, according to the source. The outcome of pending policy and legal efforts remains uncertain, as does whether future federal action would override any particular state requirement.

State Planning and Federal Action

Virginia’s public-safety and homeland-security secretary is to organize the Cyber Consortium and develop the statewide cyber plans. The AI Task Force is directed to begin recurring company briefings, conduct at least one tabletop exercise each year, and arrange an independent review of state data systems. The directive does not provide a public timetable for these steps, so the first milestones have not been established in the source material.

Companies should watch for details about participation, report handling, and any later guidance from Virginia. Separately, state law changes scheduled for January 1, 2027, and federal litigation or legislation could alter compliance obligations. For now, the confirmed position is that Virginia has ordered planning and engagement, while no national preemption law has taken effect.

Key Questions

What did Virginia order?

Gov. Abigail Spanberger’s October 23 directive orders state officials to develop statewide plans for preventing and responding to cyberattacks and strengthening infrastructure. It also assigns the AI Task Force regular company briefings, annual exercises, and an independent review of state data systems.

Does the directive require AI companies to hand over confidential reports?

It says Virginia officials are to ask companies to share reports they already provide to New York’s financial regulator and the EU AI Office. The source material does not say companies are legally compelled by this directive to provide them.

Has Washington stopped states from regulating AI?

No federal preemption law has passed, according to the source material. The administration has proposed limiting some state rules and has pursued litigation, but state requirements remain in force unless changed through applicable legal or legislative action.

When will Virginia’s plans be completed?

The directive sets no completion date or budget. It requires recurring briefings and at least one tabletop exercise per year, but the source material does not identify the first scheduled dates.

Source: ThorstenMeyerAI.com