Virginia Gov. Abigail Spanberger directed state officials to develop statewide cyberattack prevention, response, and infrastructure protection plans under an Oct. 23 directive addressing risks from artificial intelligence (AI).
Executive Directive 6 requires the secretary of public safety and homeland security to establish a Cyber Consortium and incorporate AI-related cybersecurity into Virginia’s Unified Readiness Framework, the state’s governance model for emergency preparedness and resilience. The consortium must adopt plans that address AI-related threats and other identified cyber risks.
The directive requires Virginia’s AI Task Force to deploy an independent privacy and security review team to identify and address potential vulnerabilities across the state’s interoperable data systems, including their architecture and data governance processes.
“We cannot wait for a crisis to determine whether our systems, our workforce, and our partners are ready,” Stanley Meador, secretary of public safety and homeland security, said in a press release. “We must account for the full range of threats we face – including those that originate in cyberspace but have real-world consequences.”
Spanberger cited incidents involving Anthropic AI agents that submitted fake Freedom of Information Act requests through a Virginia Department of Education website. “While it is our understanding that no sensitive information was accessed, that makes me no less concerned about the future risks that lie ahead,” she said.
Under the directive, Meador must coordinate with agencies in his secretariat, including the Virginia State Police and Virginia Department of Emergency Management, and engage with the AI Task Force and the chief information officer at the Virginia Information Technology Agency. Other executive branch agencies must cooperate upon request.
As the Cyber Consortium develops statewide plans, Meador must review existing preparedness plans, projects, and assessments and incorporate relevant work. In coordination with the AI Task Force, he may also direct the consortium to conduct an independent review of Virginia’s cyber readiness.
Spanberger created the AI Task Force through Executive Order 22 on Sept. 18, alongside a broader data center accountability initiative. Its responsibilities include addressing workforce displacement, data privacy, and cybersecurity risks. The governor’s chief transformation officer, counsel, and secretary of administration co-lead the task force.
Executive Directive 6 assigns the task force a central role in seeking ongoing participation from AI companies, researchers, regulators, international experts, and private-sector leaders in Virginia’s preparedness efforts. Where applicable, companies will be specifically asked to provide confidential briefings and reports they submit to other government authorities.
The directive calls for the public safety secretary, working with participating AI companies and the task force, to endeavor to hold AI-risk briefings at least quarterly. Those briefings must include a tabletop exercise at least annually.
Virginia’s planning will address risks from existing models and recursive self-improvement, which the directive describes as AI systems helping develop subsequent, more capable models. That development can range from human-guided work to systems autonomously building and training a future model.
