Washington’s AI Policy: Regulate Less To Beat China, While Virginia Plans For Cyber

🔍 Read the full analysis: Washington’s AI Policy: Regulate Less To Beat China, While Virginia Plans For Cyber on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Virginia Governor Abigail Spanberger signed Executive Directive 6 on October 23, ordering a statewide plan to prevent and respond to cyberattacks as the Trump administration pushes to limit state AI regulation in favor of a lighter national framework. The parallel moves leave businesses and public agencies facing uncertainty over which rules will apply: Congress has not passed a federal law overriding state AI requirements, and Virginia’s directive sets no budget or completion date.

The Virginia directive tasks the state’s Secretary of Public Safety and Homeland Security with establishing a Cyber Consortium and developing plans to respond to cyberattacks and strengthen infrastructure. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent review of privacy and security in state data systems. Virginia is to invite other states to participate on a bipartisan basis.

The directive says Virginia will ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the EU AI Office. The order does not say that companies must provide the reports, identify a budget or specify when the plans must be completed.

At the federal level, the administration has argued that varied state requirements create compliance burdens and can impede AI development. Its March 20, 2026 framework called for preempting state laws that impose undue burdens while leaving areas such as child protection and states’ own use of AI to state governments. That remains a proposal: Congress has not enacted a preemption law, and the Senate rejected a proposed 10-year moratorium on state AI laws by 99-1 in July 2025.

Federal Goals, State Cyber Plans

The conflict is about who sets AI rules as much as how restrictive those rules should be. If Congress eventually adopts a federal standard that overrides some state laws, companies could face fewer separate requirements. If it does not, state laws and directives will continue to shape obligations, even as federal agencies pursue their own security initiatives.

Virginia’s directive also shows that a push for less regulation does not mean the federal government or states have abandoned AI security work. The administration’s June 2026 order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, according to the source material. Virginia, meanwhile, is seeking coordination with companies and other states, though the directive’s practical reach depends partly on whether firms share requested reports and how the plan is carried out.

For organizations deploying AI, the immediate effect is a need to track jurisdictions, customers and contracts rather than assume a single national framework is in place. The source material advises companies to maintain incident-reporting plans for differing 72-hour and 15-day deadlines. Those timelines are not a uniform rule for every organization; applicable duties depend on the relevant law and circumstances.

Popular right now

Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation

AmazonView Latest Price

Dyson V8 Cyclone Cordless Vacuum

AmazonView Latest Price

Samsung 48-Inch S90H OLED 4K Smart TV (2026)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Policy Divide Developed

The administration’s approach began with Executive Order 14179 in January 2025, which revoked the previous administration’s AI order. A July 2025 AI Action Plan argued that AI should not be smothered in bureaucracy and said federal AI funding should not go to states with burdensome AI regulations, while distinguishing those from what it called prudent laws.

In December 2025, Executive Order 14365 directed the Justice Department to establish an AI Litigation Task Force and the Commerce Department to identify state laws deemed onerous. The task force launched in January 2026. The source material says a list of state laws had not been published as of the reporting date. In March, the White House sent Congress a framework proposing federal preemption of some state rules, but it has not become law.

State requirements are moving on a separate timetable. California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to begin on January 1, 2027. Virginia’s directive came after the governor cited recently disclosed software flaws and an Anthropic disclosure that its agents had taken unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. The governor said no sensitive data was accessed.

Open Questions on Scope and Enforcement

It is not clear when Virginia will complete its statewide plans, what resources will support them or how many companies will share confidential reports. The directive asks firms to provide information they already submit to regulators elsewhere, but the supplied account does not establish a compulsory disclosure mechanism or explain how Virginia would handle the material.

Federal preemption also remains unresolved. The White House framework is a proposal, not enacted legislation, and the Senate’s rejection of a moratorium does not settle the broader question of whether Congress will pass narrower limits on state authority. The source material describes a bipartisan House bill that would preempt only a limited category of frontier-model rules, but does not provide its status or text.

The security claims behind the policy debate require careful attribution. Spanberger cited the reported AI-agent activity and software flaws as reasons for action; the account says no sensitive data was accessed in the Virginia website incident. The argument that lighter regulation is needed to beat China is also a contested position, not an established conclusion about national security.

Next Steps for States and Congress

Virginia’s Secretary of Public Safety and Homeland Security is expected to organize the Cyber Consortium and develop the statewide response and infrastructure plans. The AI Task Force is directed to begin quarterly company briefings and hold a tabletop exercise at least once a year, but the directive gives no first-meeting date.

In Washington, the next meaningful milestone would be congressional action on federal AI rules or preemption. Until legislation changes the legal landscape, state statutes and agency requirements remain relevant. Companies and public bodies will need to monitor those rules and any new federal guidance rather than assume that the debate has produced one controlling national standard.

Key Questions

What did Virginia order on October 23?

Governor Abigail Spanberger signed a directive requiring state officials to develop a cybersecurity and infrastructure plan, establish a Cyber Consortium and arrange recurring AI-company briefings and security reviews.

Has the federal government overridden state AI laws?

No. The administration has proposed preempting some state requirements, but Congress has not passed a preemption law. State rules therefore remain in effect where applicable.

Will AI companies have to give Virginia their confidential reports?

The directive says Virginia will ask companies to share reports they already provide to New York’s financial regulator and the EU AI Office. The supplied account does not establish that the request is compulsory.

When do other state AI laws take effect?

According to the source material, California and Texas laws took effect on January 1, 2026. Revised laws in New York and Colorado are scheduled to start on January 1, 2027.

What should businesses expect next?

For now, businesses should track the laws and reporting duties that apply in each jurisdiction where they operate. The timing and scope of any federal preemption remain unsettled.

Source: ThorstenMeyerAI.com