AI governance in Arlington

If you deploy AI in Virginia today, no Virginia AI statute governs you. That sentence closes the overview on our Virginia regulation page, and an Arlington reader should hear it before anyone scopes a program. Both chambers passed a developer-and-deployer bill aimed at high-risk systems in February 2025. The duty of reasonable care against algorithmic discrimination would have sat on developers and deployers of high-risk AI making consequential decisions. The fields named were employment, lending, health care, housing, insurance, education, and parole, with impact assessments and risk-management policies written in beside the duty. The bill was vetoed, the veto held, and nothing has replaced it.

The 2026 session left that bill where it was. From that session, our Virginia regulation page keeps a verification-organization study and public-school guidance, and it records the broader bills as dead. For a private business, that page treats today’s AI-specific duties as things the Commonwealth did not enact, and it says so as the law rather than as a missing citation.

For a contractor, an association, or a professional-services firm, the Consumer Data Protection Act is a privacy statute sitting beside the customer file, not a stand-in for an AI act. The operative detail is on our Virginia regulation page, linked below.

What changes the scoping conversation is narrower than the whole Act. An association organized as a nonprofit should check the exclusion on that page before it stands up a privacy program the Act does not impose. A contractor or a professional-services firm that the Act does reach does not get that pass. A covered organization has to be able to identify which systems perform the automated evaluations the Act regulates, and the regulation page is where that line is drawn.

An AI system that produces discriminatory outcomes in employment, lending, housing, or insurance still creates liability under existing anti-discrimination law, and deceptive claims about an AI system remain actionable as consumer fraud. That exposure is the one our Virginia regulation page keeps on the table when it declines to invent an AI penalty schedule.

The useful first engagement is an inventory of what is running, including features that arrived inside software the organization already licenses, and a reading of the contracts that mention AI. TrustEdge’s governance readiness assessment is that review: what AI is actually in use, what already sits inside a certification boundary, what the contracts commit the organization to, and a gap list against ISO/IEC 42001 and the NIST AI Risk Management Framework. The AI Academy readiness assessment is a different product, a free diagnostic and a scorecard. It is not an inventory, and it does not read contracts. Each offer is written up on its own service page, linked from this page.

The planning judgment on our Virginia regulation page is not to build a Virginia-specific AI compliance program, and to build instead against frameworks that travel, such as the NIST AI Risk Management Framework and ISO/IEC 42001.

The people who scope a system sit on-site with the team that runs it. Titles under the regulatory heading are copied from our Virginia regulation page, and the blurbs under those titles are that page’s wording. Selling AI-enabled software to a Virginia executive-branch agency is a different brief. That vendor is assessed in procurement against VITA’s Enterprise Architecture Standard EA-225 and the AI Utilization Policy, which are policy rather than a statute, and that file is the one the Richmond page walks. An Arlington organization whose customer is not a Virginia executive-branch agency does not pick up those standards by being in Arlington.