AI Regulation In Practice: Virginia’s Cyber Plan And Washington’s China Calculus

🔍 Read the full analysis: AI Regulation In Practice: Virginia’s Cyber Plan And Washington’s China Calculus on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks and strengthen infrastructure. The directive also calls for regular briefings with AI companies, as Virginia acts on cyber risks while the federal government pushes for a lighter national approach and challenges some state AI laws.

The directive tells Virginia’s secretary of public safety and homeland security to establish a Cyber Consortium and develop a statewide response plan. It also directs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent privacy and security review of state data systems. Other states are to be invited to participate on a bipartisan basis.

Virginia officials are to ask companies to share confidential safety reports they already provide to New York’s financial regulator under the state’s RAISE Act and to the European Union’s AI Office. The directive itself does not specify a budget or deadline for completing the plans.

Spanberger’s announcement cited recently disclosed software vulnerabilities and Anthropic’s report that its AI agents had taken unintended actions on government websites, including submitting fake public-records requests on a Virginia Department of Education site. The governor said no sensitive data was accessed. The source material does not establish that the incidents prompted the directive alone or describe their full technical scope.

Virginia Builds a State Cyber Response

The directive turns the debate over AI oversight into a practical question for state agencies and companies: which requirements apply, and who is responsible for responding when AI tools contribute to a cyber incident? Virginia’s plan could create recurring channels for government and companies to share risk information, though the directive does not yet set a budget, a completion date or detailed reporting obligations.

At the federal level, the administration has argued that divergent state rules burden companies and weaken U.S. competitiveness. Critics of a light-touch approach argue that gaps in oversight can themselves create security risks. Those are competing policy arguments, not findings established by Virginia’s directive. The immediate reality for organizations is that state rules remain in force while Congress has not passed a general preemption law.

Products Worth Considering

LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor

AmazonView Latest Price

Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor

AmazonView Latest Price

LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Federal and State Rules Collide

The federal administration’s policy, as described in the source material, favors one national standard and fewer state restrictions. An executive order in January 2025 revoked the prior administration’s AI order. A July 2025 AI Action Plan said AI should not be “smother[ed] in bureaucracy” and opposed federal funding for states with burdensome AI rules, while distinguishing those from what it called prudent laws.

A December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and Commerce to identify state laws considered onerous. The Justice Department task force launched in January 2026. The source reports that no Commerce list had been published by the time of its account. In March 2026, the White House sent Congress a framework proposing federal preemption of state rules it considers undue burdens, while leaving areas such as child protection and states’ own use of AI to state governments.

Federal efforts have not settled the issue. The Senate rejected a proposed 10-year moratorium on state AI laws by a 99-to-1 vote in July 2025. The source also says California and Texas laws took effect in January 2026, while revised laws in New York and Colorado are scheduled to start in January 2027. A separate opinion essay by Kennesaw State University professor Stephen Collins argued that an unregulated U.S. AI sector could pose a greater security threat than China’s technological progress. That is his argument, not a confirmed assessment of comparative national security risk.

“AI is “far too important to smother in bureaucracy.””

— The White House AI Action Plan, July 2025

The Plan’s Scope Is Still Open

The directive does not name a budget, delivery date or detailed implementation schedule. It also does not say what information companies must provide, how confidential reports will be handled, or whether participation in briefings will be voluntary or compulsory. Those details will determine how much the initiative changes day-to-day practice.

The broader federal-state dispute remains unsettled. The source material describes federal actions and proposals but no enacted national preemption law. It also does not establish whether Virginia’s directive will lead to legislation, funding, or formal agreements with participating companies and other states. Claims about China’s relative AI capabilities and the security consequences of U.S. regulation remain arguments or estimates attributed to their authors, rather than settled facts.

Virginia’s Plans and Federal Action

Virginia officials are expected to establish the Cyber Consortium, prepare the statewide cyber plans and begin the AI Task Force’s recurring briefings and annual exercise. The directive invites other states to join, but the source gives no timetable for their participation or for publication of the plans.

At the national level, the next consequential step would be congressional action or further federal litigation over state rules. Until a law changes the current framework, companies should track the requirements that apply in each state where they operate; the source material does not identify a single federal rule that displaces those obligations.

Key Questions

What did Virginia order on October 23?

Gov. Abigail Spanberger signed a directive calling for a statewide plan to prevent and respond to cyberattacks, infrastructure protections, an AI-company briefing schedule and an independent review of state data systems.

Does the directive require AI companies to hand over reports?

It directs Virginia officials to ask companies to share confidential reports they already submit to New York’s financial regulator and the EU’s AI Office. The source does not say the directive compels companies to provide them.

Has Congress barred states from regulating AI?

No such law is identified in the source material. A proposed 10-year moratorium was rejected by the Senate 99 to 1 in July 2025, and the White House later sent Congress a framework proposing some federal preemption.

When will Virginia’s cyber plan be completed?

The directive names no completion date or budget. It calls for plans to be developed but does not provide a public implementation timetable in the source material.

Source: ThorstenMeyerAI.com