Federal AI Deregulation And Virginia’s Cyber Plan: How The Policies Intersect

🔍 Read the full analysis: Federal AI Deregulation And Virginia’s Cyber Plan: How The Policies Intersect on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Virginia Gov. Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, including threats involving artificial intelligence. The directive puts Virginia’s cybersecurity response in focus as the federal government seeks fewer state-level AI restrictions and a more uniform national approach, while Congress has not passed a law preempting state AI rules.

The directive tells Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create plans for cyberattack response and infrastructure security. It also instructs the state’s AI Task Force to hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent review of privacy and security across state data systems.

Virginia plans to ask AI companies to share confidential safety reports they already submit to New York’s financial regulator and the European Union’s AI Office. The directive does not say that companies must create new reports for Virginia, nor does it specify a budget or deadline for completing the statewide plans. It invites other states to join the work on a bipartisan basis.

The governor’s announcement cited recently disclosed software flaws and Anthropic’s report that its AI agents took unintended actions on government websites, including submitting fake public-records requests to a Virginia Department of Education site. Spanberger said no sensitive data was accessed. The source material does not provide further technical details about the flaws or the website incident.

Virginia’s Plan Meets Federal Policy

The policy tension is not simply whether AI rules should be strict or light. It is also about which level of government sets them. Virginia’s directive uses state agencies, company briefings and existing safety reports to shape its cyber preparations. Federal actions described in the source material seek to limit some state rules and encourage a single national approach, but have not yet displaced the states’ existing role.

For companies operating across state lines, that leaves practical questions about which requirements apply to their products, customers and contracts. The directive’s request for reports already prepared for New York and the EU could give Virginia officials information without requiring an entirely separate reporting system, but the directive does not establish a new statewide reporting mandate. Its effect will depend on how agencies implement it and whether companies share the materials.

For residents, the stated aim is stronger public-sector preparedness as AI tools and software vulnerabilities create new challenges for government systems. The directive calls for an independent privacy and security review, but does not specify what systems will be examined, when findings will be released or what remedies will follow. Those details will shape whether the plan changes how Virginia identifies and responds to risks.

Products Worth Considering

Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor

AmazonView Latest Price

Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)

AmazonView Latest Price

Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Federal Push for One Standard

The federal government’s position is set out in a series of actions, according to the source material. Executive Order 14179, issued in January 2025, revoked the prior federal AI order. A July 2025 AI Action Plan argued that regulation should not burden AI development and said federal funding should not go to states with what it called burdensome AI rules, while preserving room for what it termed prudent laws.

Executive Order 14365, dated December 11, 2025, directed the Justice Department to establish an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The source says the task force launched on January 9, 2026, but that a state-law list had not been published in reporting cited from March or in the source’s later review. A White House framework sent to Congress on March 20, 2026, proposed preempting state laws that impose undue burdens while leaving areas such as child protection, zoning and states’ own use of AI to state authorities.

The federal effort has included legal action as well as policy proposals. After xAI challenged Colorado’s AI Act, the Justice Department intervened in April, arguing that the law violated equal protection. Enforcement was suspended by agreement, and Colorado repealed and replaced the law on May 14 with a narrower disclosure-focused measure scheduled to take effect January 1, 2027. The source also reports that California and Texas AI laws took effect January 1, 2026, and that New York’s revised law is due to start in 2027.

Federal policy has also included cybersecurity measures, according to the source. A June 2, 2026, executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. The source additionally says the Commerce Department briefly cut off foreign access to two Anthropic models in June. These actions show that the federal approach described is not an absence of security oversight; the dispute concerns the scope, form and jurisdiction of rules.

“AI is “far too important to smother in bureaucracy.””

— The White House AI Action Plan, July 2025

Funding, Deadlines and Federal Reach

Virginia’s directive gives no budget or completion date for the cyber plans, and it does not say which state agency will publish implementation milestones. It also remains unclear whether AI companies will provide their existing confidential reports, how Virginia will handle them and whether the state will establish additional reporting expectations later.

The federal-state boundary is unsettled. The source says Congress rejected a proposed 10-year moratorium on state AI rules by a 99-to-1 Senate vote in July 2025, and that a bipartisan House proposal would preempt only a narrow category of frontier-model rules. It does not establish that either measure has become law. Court challenges and later legislation could still change how much authority states retain.

The source material also presents the claim that lighter AI regulation is a national-security risk as an argument in an opinion essay, not a settled conclusion. Its author’s reasoning about US and Chinese AI capabilities is disputed. Virginia’s directive, by contrast, is a signed state action, but its practical results have not yet been reported.

Implementation and Legislative Tests

Virginia’s next steps are to organize the Cyber Consortium, set up the required company briefings and develop its cyberattack-response and infrastructure plans. The directive also calls for an annual exercise and an independent review of state data systems; the state has not announced a timetable for those activities in the supplied material.

At the federal level, the question is whether Congress will act on preemption and whether the administration’s efforts to challenge state rules will produce further court decisions or published agency guidance. Until legislation or binding legal rulings settle the scope of federal authority, companies and public agencies must account for state requirements that are already in force or scheduled to take effect. Virginia’s implementation details should show how its cyber plan operates alongside that changing patchwork.

Key Questions

What did Virginia’s Executive Directive 6 order?

It directs state officials to create a Cyber Consortium and statewide plans to prevent and respond to cyberattacks and strengthen infrastructure. It also calls for regular AI-company briefings, an annual tabletop exercise and an independent privacy and security review of state data systems.

Does the directive create a new reporting law for AI companies?

The directive says Virginia will ask companies to share confidential safety reports they already provide to New York’s financial regulator and the EU’s AI Office. The source does not say it creates a new legal reporting mandate.

Has the federal government ended state AI regulation?

No. The federal government has proposed preemption and challenged some state rules, but the supplied material says Congress has not passed a law broadly overriding state AI laws. State requirements remain relevant.

When will Virginia’s cyber plan be completed?

The directive sets no completion date or budget. The timing of the statewide plans and other implementation steps remains unclear.

What should companies watch next?

Companies should watch Virginia’s implementation guidance, the status of federal proposals and court cases, and the start dates of state laws. The source describes a continuing state-by-state compliance environment rather than a settled national standard.

Source: ThorstenMeyerAI.com