🔍 Read the full analysis: Washington’s AI Strategy Favors Less Regulation; Virginia Orders A Cyber Plan on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The White House is seeking a lighter national approach to AI and action against some state rules, while Virginia’s Oct. 23 directive calls for a statewide plan to address cyberattacks and regular briefings with AI companies. Congress has not enacted federal preemption, so companies still face differing state requirements. Virginia’s directive names no budget or deadline, and the reach of any eventual federal policy remains unsettled.
Virginia Governor Abigail Spanberger signed Executive Directive 6 on October 23, ordering state officials to develop a statewide plan to prevent and respond to cyberattacks, while the White House continues to press for a lighter, national approach to AI regulation. The two developments underscore an unresolved dispute over who sets AI rules: Washington, state governments, or both.
The directive instructs Virginia’s Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and create plans for cyber incident response and infrastructure protection. It also assigns work to the state’s AI Task Force: hold briefings with AI companies at least quarterly, conduct an annual tabletop exercise and arrange an independent review of privacy and security practices in state data systems. Virginia will invite other states to participate on a bipartisan basis.
The directive says the state should ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the EU AI Office. The instruction is to seek those materials; the directive does not establish that companies have agreed to share them. It specifies no budget or completion deadline.
At the federal level, the administration has argued that a patchwork of state laws burdens companies and that the country should adopt a single national standard. Executive orders and a White House framework have called for challenging or preempting some state rules. But Congress has not passed a preemption law. A proposed 10-year moratorium on state AI laws was removed from a bill in July 2025, with the Senate voting 99 to 1 against retaining it, according to the source material.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
The AI Rules Remain State by State
For businesses developing or deploying AI, the immediate consequence is that federal preemption has not replaced state requirements. Companies may need to track where their systems operate, where customers are located and which state rules apply to a particular product or contract. The source material says California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027.
Virginia’s directive adds a separate operational focus: cyber preparedness and information-sharing. Its requests for company safety reports could give state officials material about risks and safeguards, but the directive does not itself establish a new general AI disclosure mandate. The broader stakes include consumer protection, cybersecurity and compliance costs, as well as the balance of authority between state and federal governments.
The administration’s position is that a single framework could reduce friction and support US competitiveness. Critics of that approach argue that limiting state authority could leave gaps in oversight. Those are competing policy arguments, not settled findings about the effects of either approach.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Laws
President Donald Trump’s January 2025 Executive Order 14179 revoked the previous administration’s AI order. The July 2025 AI Action Plan said AI was “far too important to smother in bureaucracy” and opposed federal funding for states with what it called burdensome AI regulations, while distinguishing those from “prudent laws.” A later executive order, dated December 11, 2025, directed the Justice Department to establish an AI Litigation Task Force and told the Commerce Department to identify state laws considered onerous. The source material says no such list had been published as of its reporting.
On March 20, 2026, the White House sent Congress a framework proposing that federal law preempt state rules it considered undue burdens, while leaving areas such as child protection and states’ own use of AI to state governments. In April, xAI sued over Colorado’s AI law, and the Justice Department intervened. Assistant Attorney General Brett Shumate said, “America’s success in the AI race will depend on removing barriers to innovation.” Colorado later replaced its law with a narrower disclosure-based measure scheduled to take effect in 2027.
The federal approach is not limited to deregulation. The source material reports that a June 2026 executive order established an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models. It also says the Commerce Department briefly cut off foreign access to two Anthropic models that month. These measures sit alongside the administration’s effort to limit or challenge some state requirements.
“We have seen no leadership from this President and his allies in Congress.”
— Virginia Governor Abigail Spanberger
Scope, Funding and Enforcement
Virginia’s directive does not say how much the plan will cost, when it must be completed or what happens if companies decline to provide confidential reports. It also remains unclear how many companies will be approached and whether other states will join the proposed consortium.
The federal-state dispute is unresolved. The administration has pursued litigation and proposed congressional action, but Congress has not enacted a law preempting state AI rules. The source material also describes a voluntary federal model-checking process; its precise scope and practical effect are not specified here. The legal status of individual state requirements may continue to change through legislation, court cases and implementation.
A separate opinion by Stephen Collins, a professor at Kennesaw State University, argued that an insufficiently regulated US AI sector could pose a greater security risk than China’s advances. That is an argument in an opinion article, not an established conclusion. The source material also says 26 attorneys general called for federal safety rules and an explicit bar on preemption, reflecting disagreement among policymakers over the right balance.
State Planning and Federal Action
Virginia officials are expected to carry out the directive by organizing the Cyber Consortium, setting up recurring company briefings and developing the cyber and infrastructure plans. The directive calls for at least quarterly briefings and one tabletop exercise each year, but gives no public milestone for the plans’ completion.
At the federal level, the next major question is whether Congress acts on the White House framework or another proposal, and whether courts further define the limits of state AI laws. Until federal legislation changes the landscape, companies will need to monitor state-by-state rules and enforcement alongside federal policy developments. The source material identifies November 3 as an upcoming election date, but does not specify which contests or how their results might affect the policy debate.
Key Questions
What did Virginia order on October 23?
Governor Abigail Spanberger signed a directive requiring state officials to develop statewide cyber response and infrastructure plans, establish a Cyber Consortium and hold regular briefings with AI companies.
Does the directive require AI companies to hand over safety reports?
It says Virginia should ask companies to share confidential reports they already provide to New York’s financial regulator and the EU AI Office. The directive does not establish that companies have agreed to provide them.
Has Washington replaced state AI laws with one national rule?
No. The administration has proposed a national framework and sought to challenge some state laws, but Congress has not passed a law preempting them.
Which state AI laws are in effect or scheduled to begin?
The source material says California and Texas laws took effect on January 1, 2026. Revised New York and Colorado laws are scheduled to take effect on January 1, 2027.
What is still unknown about Virginia’s plan?
The directive does not give a budget, completion date or consequences for companies that decline to share reports. It is also not yet clear whether other states will join the consortium.
Source: ThorstenMeyerAI.com
