Why Washington’s AI Policy And Virginia’s Cyber Order Raise Questions About Rules

🔍 Read the full analysis: Why Washington’s AI Policy And Virginia’s Cyber Order Raise Questions About Rules on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Virginia Governor Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a plan to prevent and respond to cyberattacks and asking AI companies to share safety reports they already provide to New York and the European Union. The directive lands amid a federal effort to establish a lighter national approach and challenge some state AI laws, leaving businesses without a settled federal rule that overrides state requirements.

The directive tells Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create statewide plans for cyber incident response and infrastructure protection. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent review of privacy and security practices in state data systems. Other states may be invited to participate.

Virginia is to ask AI companies for confidential reports they already submit under New York’s RAISE Act and to the EU AI Office. The directive does not set a budget or completion deadline, and it does not say that companies must produce reports they do not already file. The governor’s announcement cited recently disclosed software vulnerabilities and Anthropic’s account of agents taking unintended actions on government websites. Spanberger said no sensitive data was accessed in the Virginia Department of Education incident she referenced.

The federal government’s policy has two strands: promoting a single, less burdensome national framework while also taking steps on AI security. Executive orders have sought to challenge what the administration calls onerous state rules and encourage Congress to preempt some state requirements. But Congress has not passed a preemption law. A June 2026 order, according to the supplied source, established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models.

The Compliance Map Remains State-Based

The immediate issue for companies is not simply whether Washington or the states favor stricter AI rules. It is which requirements apply to a particular model, customer or contract, and whether they change before a company has to comply. Without federal preemption enacted by Congress, state rules and directives remain relevant even as the administration challenges some of them.

That uncertainty can affect product launch schedules, safety reporting and incident response. The source reports that California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027. Virginia’s request for reports already produced for other jurisdictions could add coordination work, though the directive does not establish a new reporting deadline or specify a penalty for failing to share them.

For residents, the dispute concerns who sets safeguards for AI systems used by government and companies. The federal administration argues that a patchwork can burden innovation; state officials are pursuing their own measures, including Virginia’s cybersecurity planning. Those are competing policy positions, not evidence that one approach has already proved more effective.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor

AmazonView Latest Price

LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Federal Push, State Rules

The administration’s approach began with Executive Order 14179 in January 2025, which revoked the prior administration’s AI order. A July 2025 AI Action Plan argued that AI was too important to be constrained by excessive bureaucracy and said federal AI funding should not go to states with burdensome regulations, while preserving room for prudent laws. In December 2025, Executive Order 14365 directed federal agencies to challenge certain state measures and established a Justice Department AI Litigation Task Force.

The White House sent Congress a framework in March 2026 calling for preemption of state laws it considers unduly burdensome, while leaving areas such as child protection, zoning and states’ own use of AI to state authorities. A Justice Department challenge to Colorado’s AI law followed in April. The state replaced that law in May with a narrower disclosure-based measure scheduled to take effect in 2027. These steps show that the federal-state dispute is active, but they have not produced a general national AI statute.

There is also a security-focused federal track. The source describes a June order creating a cybersecurity clearinghouse and voluntary checks for leading models, alongside a temporary Commerce Department cutoff of foreign access to two Anthropic models. Meanwhile, a bipartisan House proposal would preempt only a narrow category of frontier-model rules, and 26 state attorneys general have urged Congress to adopt federal safety requirements while expressly barring preemption. Those proposals are not enacted law.

““we have seen no leadership from this President and his allies in Congress.””

— Virginia Governor Abigail Spanberger

Virginia Plan Details Still Pending

Virginia’s directive does not name a budget, completion date or detailed reporting process. It is not yet clear which companies will be invited to brief the AI Task Force, how the state will handle confidential materials, or whether the requested reports will be used to create new requirements. The directive asks companies to share reports they already file; the source does not describe a new compulsory filing regime.

The reach of federal efforts is also unsettled. Congress has not enacted a law preempting state AI rules, and the source says the administration’s planned list of state laws deemed onerous had not been published in the reporting reviewed. Litigation and legislative proposals could change the legal landscape, but their eventual scope and effect remain unknown. The separate argument that lighter regulation improves US security relative to China is an opinion, not an established finding.

Plans, Briefings and Federal Action

Virginia’s public-safety secretary and AI Task Force are expected to carry out the directive by setting up the consortium, developing statewide plans and arranging recurring company briefings and an annual exercise. The directive gives no public deadline, so the timing and first milestones have not been specified in the supplied material.

At the federal level, the next consequential developments would be congressional action, further agency steps or court rulings on state laws. Until a federal statute or binding court decision changes the framework, companies will need to track the requirements relevant to each state and their particular products and contracts. The source advises maintaining incident-response procedures for differing reporting deadlines, but Virginia’s directive itself does not create a 72-hour or 15-day clock.

Key Questions

What did Virginia order?

Governor Abigail Spanberger’s October 23 Executive Directive 6 ordered officials to establish a Cyber Consortium and develop statewide plans to prevent and respond to cyberattacks. It also calls for regular AI-company briefings and an annual exercise.

Does the directive create a new mandatory AI report?

The directive says Virginia should ask companies to share confidential reports they already submit to New York’s financial regulator and the EU AI Office. The supplied source does not describe a new mandatory report or a penalty for not sharing one.

Has Washington preempted state AI laws?

No. The administration has pushed for federal preemption and challenged some state laws, but Congress has not passed a preemption law, according to the source material.

When will Virginia’s plans be completed?

The directive gives no completion date or named budget. The timeline and implementation details remain unclear.

What should companies watch next?

Companies should watch for Virginia’s implementation details, federal legislation and court decisions affecting state AI rules. For now, applicable obligations depend on the states and jurisdictions tied to their models, customers and contracts.

Source: ThorstenMeyerAI.com