Virginia created an AI task force. Start a state policy watch before the next order lands.

It is easy for a corporate AI program to watch national rules and miss the state capitals. This fortnight showed why that gap matters. On September 18, Virginia Gov. Abigail Spanberger signed Executive Order 22. It creates a state AI task force and tightens the rules for data centers, and parts of it took effect immediately.

This post is general education, not legal advice. If the order touches your business, take it to counsel.

What the order does

An AI task force. The Rapid-Response AI Task Force is co-led by the chief transformation officer, counsel to the governor and the secretary of administration, and supported by an AI Policy Planning Unit. According to Greenberg Traurig’s summary in The National Law Review, its immediate priorities are:

• AI-driven workforce displacement, and an evaluation of Virginia law on data privacy;
• cybersecurity risks that AI agents and bots pose to government systems and critical infrastructure;
• coordination with other governors and with federal and international leaders and philanthropic organizations on AI governance.

The task force will recommend executive or legislative action. The order also rescinds an AI executive order and an executive directive from the previous administration, but the policies, standards, and guidelines set under the earlier Executive Order No. 30 stay in effect until a later executive or agency action replaces them.

Data centers. Executive-branch agencies may no longer sign nondisclosure agreements that keep material information about proposed commercial data centers from the public, with narrow exceptions such as national security. New data centers with peak demand of 25 megawatts or more are excluded from the state’s site-readiness and fast-track programs. A community engagement toolkit is due in 120 days. Within 180 days, agencies owe updates on noise, backup generation, cooling water, methane, and workforce reporting. Site recommendations are due in 240 days, and criteria for a tiered designation program called VA-LEAD are due by the end of 2027.

The governor described the AI part this way: “Today’s Executive Order will create a new AI Task Force to address several of the top concerns I’ve heard across the Commonwealth.”

Why a corporate AI team should care

Few corporate AI teams build data centers. Yours may still have one of three links to an order like this:

1. People. If you employ people in Virginia, a state study of AI-driven job displacement may lead to recommendations on workforce changes. HR and legal should know it is coming.
2. Agents and systems. The task force names AI agents and bots as a cybersecurity risk to government systems and critical infrastructure. If you sell to Virginia’s government or operate critical infrastructure there, expect questions about your agents.
3. Compute. If your AI workloads run in Virginia data centers, the order starts work on power-cost allocation, water, noise and backup generation that would reach your providers’ facilities. The order does not say what that means for prices. Ask your providers rather than guess.

A state AI watch register

A small central team does not need a policy department to keep track of this. It needs one shared table and one owner. Use these columns:

Column	What goes in it
Jurisdiction	State or city
Instrument	Order, bill, rule or guidance, with a link
Signed or effective	Date
What changes now	Only the parts already in force
What is being studied	Topics that may become rules later
Next deadline	The next date something is due
Who it touches	People, customers, data, compute or vendors
Internal owner	One named person

Worked example, Virginia EO 22. Signed and effective September 18, 2026. In force now: the ban on agency NDAs for data centers, the 25-megawatt exclusion and the cooling-water scarcity designation for the Eastern Virginia Groundwater Management Area. Under study: workforce displacement, privacy law and AI-agent cybersecurity risk. Next deadlines, by our count from September 18: about mid-January 2027 for the community engagement toolkit (120 days), mid-March for the noise, backup-generation, cooling-water, methane, and workforce updates (180 days), and mid-May for site recommendations (240 days). Touches: Virginia employees, public-sector customers and any workloads in Virginia facilities. Owner: whoever runs policy for the AI office.

A rule for when to act

Record every order. Brief leadership only when an item touches at least two of the five areas listed under “Who it touches”, or when something in force changes a contract you hold. Everything else waits for the quarterly review.

What to do this week

• Name one person in the central team as owner of the state watch register.
• Add Virginia EO 22 as the first row, then list the states where you have the most employees, customers and compute.
• Ask your cloud and data center providers which of your AI workloads run in Virginia facilities.
• Send the order to HR and legal with one question: does any of this change our plans for the next two quarters?