AI governance in Richmond

Richmond is the seat of state government and a center for the organizations that sell to it, alongside insurance and other financial services, healthcare, law, higher education, and distribution. Virginia’s regulation page records the Commonwealth’s posture, including the state’s data-center concentration. That concentration is not what a Richmond buyer is managing. The buyer in this metro is more often an agency, a vendor to an agency, an insurer, a health system, a law firm, or a campus.

The question those buyers are sold is often whether they need Virginia AI Act compliance. There is no Virginia AI Act. The state’s overview states the operating fact in one sentence: if you deploy AI in Virginia today, no Virginia AI statute governs you. This page exists so that sentence is the one a Richmond reader hears first.

The Consumer Data Protection Act has been in force since January 1, 2023. It is the privacy duty that remains. Consumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Profiling, in the statute, is any automated processing of personal data to evaluate, analyze, or predict a person’s economic situation, health, preferences, interests, reliability, behavior, location, or movements. A separate provision requires a documented data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or specified injuries, and for other heightened-risk processing. The Attorney General may compel production of those assessments.

Enforcement is exclusive to the Attorney General. The statute requires 30 days’ written notice and an opportunity to cure, and that cure period has no sunset. There is no private right of action. Penalties run up to $7,500 per violation after the cure period, plus reasonable expenses and attorney fees. There are no AI-specific penalties in Virginia law, because there is no AI-specific prohibition to violate.

The exemptions are why the analysis stops early for a large share of this metro. Thresholds come first: the Act applies to entities that control or process personal data of at least 100,000 Virginia consumers in a calendar year, or at least 25,000 consumers while deriving more than half of gross revenue from selling personal data. On top of the thresholds, the exemptions are entity-level, not data-level. Financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA-covered entities and business associates, nonprofits, institutions of higher education, and government bodies are excluded entirely. Employee and contractor data collected in the employment context is outside scope as well.

A Richmond health system, a GLBA insurer or bank, a university, a nonprofit, or a state agency should confirm that exemption and then stop treating the VCDPA as its AI program. A professional-services firm or another controller that clears the thresholds and is not exempt cannot. Confirming an exemption is not a finding that no rule applies. HIPAA, the FTC Act, fair-lending and consumer-reporting rules, and employment-discrimination law are not repealed by a privacy exemption. Our Virginia regulation page’s practical implication is the planning judgment to follow: do not build a Virginia-specific AI compliance program. Build against the obligations that already travel with the activity. Where a customer or a procurement office asks for a process, the NIST AI Risk Management Framework is one our Virginia regulation page names. ISO/IEC 42001 is a standard an organization may choose to pursue. TrustEdge does not certify anyone to it.

TrustEdge serves organizations in Richmond and across Virginia. Scoping what a model touches means sitting on-site with the people who bought it and the people who run it. The engagement is an inventory, plus a reading of which Virginia rules reach that organization and which do not.

For many regulated buyers in this metro the honest reading is short. Virginia contributes the VCDPA exemption analysis and, for a vendor to an executive-branch agency, the VITA standard. It does not contribute an AI act. Organizations that are not exempt, and that clear the consumer thresholds, still owe the profiling opt-out and, for profiling that presents a heightened risk, the data protection assessment. Those two items are the privacy work. They are not a substitute for a high-risk AI statute, and they should not be scoped as if HB 2094 had taken effect.

The provision text on this page is looked up from our Virginia regulation page by title. The Virginia regulation page holds the rest of the record, including the bill list and the enforcement detail. This page does not add a legal fact that page does not already state.