Virginia AI Legislation in 2026

The Virginia Picture

Virginia owns one of the most instructive stories in American AI policy. It came within a single signature of becoming the second state, after Colorado, to enact a comprehensive high-risk AI governance law, and then it walked away. HB 2094, the High-Risk Artificial Intelligence Developer and Deployer Act, cleared both chambers of the General Assembly in February 2025 with a July 1, 2026 effective date built in. On March 24, 2025, Governor Glenn Youngkin vetoed it. His objection was explicitly pro-growth: he argued the framework would burden developers, deployers, and especially startups with heavy compliance obligations and would chill the innovation Virginia wants to attract. The practical bottom line for any executive is unambiguous. As of June 2026, Virginia has no enacted comprehensive AI law. HB 2094 is dead, and its obligations never took effect.

What Virginia does have is a layered patchwork rather than a single statute. Executive Order 30, signed in January 2024, remains in force, but it governs the Commonwealth's own house. It binds executive-branch agencies, sets AI standards for state IT and law enforcement, and shapes AI use in public education. It does not regulate private companies. The binding private-sector obligations that touch AI today flow through the Virginia Consumer Data Protection Act, in effect since January 2023, which gives consumers a right to opt out of profiling that produces legal or similarly significant effects and requires data protection assessments for higher-risk processing. On the harms side, Virginia's existing criminal code already reaches AI-generated and deepfake sexual imagery of minors, including wholly synthetic depictions.

I want to be precise about the 2026 session, because that is where the live signal sits. Lawmakers filed a wide slate of AI bills this year, ranging from guardrails for minors interacting with chatbots to AI in therapy, law-enforcement AI policy mandates, and K-12 chatbot rules. The vast majority were tabled, scrapped, or carried over to 2027. Two forces explain this. First, the veto of HB 2094 reset the appetite for sweeping mandates. Second, reporting indicates legislators grew cautious about a federal posture hostile to state AI regulation, which made a comprehensive Virginia statute politically risky to advance right now. The clear inference is that comprehensive AI legislation in Virginia has slipped to 2027 at the earliest.

For builders and businesses, my guidance is to govern to the obligations that actually exist while staying ready for the ones that nearly happened. Comply now with VCDPA profiling and assessment duties, honor consumer opt-out rights, and treat synthetic-media and CSAM criminal exposure as a hard line. Then operationalize against HB 2094 as your planning baseline rather than your compliance baseline, because its risk-management, impact-assessment, and consumer-notice architecture mirrors Colorado and the broader multistate trend and is the most likely shape of a future Virginia law. The companies that come through 2027 cleanest will be those that documented AI risk, tested for algorithmic discrimination, and built disclosure workflows before a statute forced them to.