🔍 Read the full analysis: What Rules Govern AI When Washington Favors Deregulation And Virginia Acts? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Washington has sought a lighter national AI framework and challenged some state rules, but Congress has not enacted a law overriding them. Virginia’s October 23 directive orders a statewide plan for AI-related cyber risks and asks companies to share existing safety briefings. Companies and residents remain subject to a changing mix of federal and state policies.
Virginia will ask AI companies to share confidential safety reports they already provide to New York’s financial regulator under its RAISE Act and to the European Union’s AI Office. The directive does not set a budget or a deadline for completing the plans. It is a state order, not a federal AI regulation or a general mandate requiring every company to submit reports.
The federal government’s policy has included efforts to limit what it calls burdensome state rules. The administration’s December 2025 executive order directed the Justice Department to create an AI Litigation Task Force and the Commerce Department to identify “onerous” state laws. The source reports no published version of that list. A White House framework sent to Congress in March 2026 called for preempting state laws that impose “undue burdens,” but Congress has not enacted it.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
State Rules Still Shape AI Compliance
The immediate consequence is that federal efforts have not displaced state laws. Companies’ obligations can vary by where they operate, where their customers are and which rules cover their products or contracts. Virginia’s directive adds a separate state planning process focused on cybersecurity and information-sharing, rather than replacing existing laws.The policy disagreement is also about who gets to set the rules. The administration argues that a single national approach could reduce compliance burdens and support innovation. Virginia’s action reflects a state effort to address cyber risks while federal policy remains contested. Those positions do not establish whether lighter regulation improves national security or whether state-level rules provide better protection; those are disputed questions, not settled findings.
For residents, the practical stakes include how public agencies protect their systems and respond to AI-enabled attacks. For businesses, the near-term task is to track applicable state requirements rather than assume a federal preemption law is imminent. The directive’s effect will depend in part on how Virginia implements its plans and what information companies agree or are required to share.
Popular right now
Breville Barista Pro Espresso Machine with Grinder, Brushed Stainless Steel
Roborock Robot Vacuum and Mop with LiDAR Navigation and 10,000 Pa Suction
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
Federal Push Meets State Laws
The administration’s January 2025 executive order revoked the prior federal AI order. Its July 2025 AI Action Plan argued that AI should not be “smother[ed] in bureaucracy” and said federal funding should not go to states with burdensome AI regulations, while recognizing some state laws as prudent. In December 2025, a further executive order set out the administration’s case against a patchwork of state rules and established a process for challenging some of them.Congress has not approved broad preemption. The source says the Senate voted 99 to 1 in July 2025 to remove a proposed 10-year moratorium on state AI laws. It also reports that California and Texas laws took effect on January 1, 2026, while revised laws in New York and Colorado are scheduled to start on January 1, 2027. A bipartisan House proposal would preempt a narrower category of frontier-model rules, but its status and final terms remain unsettled.
Virginia cited cybersecurity concerns in announcing the directive, including newly disclosed PHP flaws and Anthropic’s report that its agents had taken unintended actions on government websites. Spanberger said no sensitive data was accessed in the Virginia Department of Education incident described in the announcement. The source also describes an opinion essay arguing that an unregulated U.S. AI sector could pose a security risk; that is the author’s argument, not an established finding.
““we have seen no leadership from this President and his allies in Congress.””
— Virginia Governor Abigail Spanberger
Funding, Timelines And Legal Reach
Virginia’s directive provides no budget or completion date, and it is not yet clear how the requested company briefings will work, what information firms will share or how the state will protect confidential material. The order calls for companies to be asked to provide reports; it does not specify a new general disclosure requirement.It is also unclear whether Congress will enact a federal preemption law, how courts will resolve challenges to state AI laws, or whether the administration will publish its proposed list of state rules. The source says the Colorado enforcement dispute was suspended by agreement and that Colorado later replaced its law with a narrower disclosure-based measure; the legal and regulatory landscape remains subject to change.
Virginia’s Planning Process Begins
Virginia’s secretary of public safety and homeland security is tasked with establishing the Cyber Consortium and preparing statewide cyber-response and infrastructure plans. The AI Task Force is directed to hold company briefings at least quarterly, run a tabletop exercise at least once a year and arrange an independent review of state data systems. No start date or final report deadline is specified.At the federal level, the next key developments are potential congressional action on preemption and any further executive or court actions affecting state laws. Until a federal law changes the current position, companies should verify which existing state requirements apply to their activities and monitor the implementation of Virginia’s directive.
Key Questions
What did Virginia’s October 23 directive order?
It directs state officials to form a Cyber Consortium and develop plans to prevent and respond to cyberattacks and strengthen infrastructure. It also calls for regular AI company briefings, an annual exercise and a review of state data systems.
Does the directive require all AI companies to submit safety reports?
No general reporting mandate is specified. Virginia says it will ask companies to share confidential reports they already provide to New York’s financial regulator and the European Union’s AI Office.
Has Congress overridden state AI laws?
No. The source reports that Congress has not passed a law broadly preempting state AI rules. Federal proposals and litigation efforts are ongoing.
Which state AI laws are currently in effect, according to the source?
California and Texas laws took effect on January 1, 2026. The source says revised New York and Colorado laws are scheduled to take effect on January 1, 2027.
When will Virginia finish its cyber plans?
The directive does not give a completion deadline or budget. It does call for AI Task Force briefings at least quarterly and a tabletop exercise at least once a year.
Source: ThorstenMeyerAI.com
