Virginia AI Regulations
Virginia came within one governor's signature of being the second state with a comprehensive AI law. HB 2094, the High-Risk Artificial Intelligence Developer and Deployer Act, passed both chambers in February 2025, was vetoed by Governor Youngkin on March 24, 2025, and the House sustained the veto on April 2, 2025. Virginia's current governor is Abigail Spanberger, who signed the 2026 AI bills — a distinction worth keeping straight, because the veto that defines Virginia's posture was a previous administration's. No successor has been enacted. The 2026 session produced two narrow AI laws — a study of independent verification organizations and guidance for AI use in public schools — and killed the comprehensive bills. Comprehensive AI legislation is now a 2027 conversation. If you deploy AI in Virginia today, no Virginia AI statute governs you.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in Virginia
TrustEdge serves organizations across Virginia, including these markets.
In-Depth Analysis
Virginia is the most useful counterexample in the country to the assumption that every state is converging on comprehensive AI regulation.
HB 2094 was not a fringe bill. It passed both chambers. It was modeled on the Colorado approach and would have made Virginia the second state with a high-risk AI framework. It failed by one signature, and the override failed nine days later. Then, in the 2026 session — a new governor, a full legislature, a year of national momentum — Virginia did it again: the comprehensive bills failed and the legislature funded a study instead.
That is a pattern, not an accident. Two consecutive sessions have declined to impose an AI-specific duty on private deployers. The state that hosts the largest concentration of data centers in the world has chosen procurement standards and a verification study over a statute.
The practical consequence is that a Virginia organization's AI obligations come from somewhere other than Virginia. They come from HIPAA and the FTC Act. From ECOA, Regulation B, and the FCRA. From Title VII and the Virginia Human Rights Act, which do not care whether a discriminatory decision came from a person or a model. From the EU AI Act if you serve EU markets. From customer contracts and vendor questionnaires, which in regulated industries now routinely demand controls no Virginia statute requires. And from the VCDPA, which quietly asks for a documented assessment of risky profiling and which many organizations have never run.
The interesting thing on the horizon is not a comprehensive bill. It is the independent verification organization framework. If JCOTS recommends it and the 2027 session enacts it, Virginia would be building a conformity-assessment market — third parties certifying AI systems against safety standards — rather than a duty-of-care regime. That is structurally closer to how HITRUST and ISO/IEC 42001 already work than to how Colorado or the EU work. For organizations already operating under third-party assurance, that would be a familiar shape.
Practical Implications for SMBs & Healthcare
If you operate in Virginia and someone is selling you Virginia AI Act compliance, there is no Virginia AI Act. Ask them to name the statute.
Start with the exemption question, because for regulated buyers it usually ends the analysis. If you are a HIPAA-covered entity, a business associate, a GLBA financial institution, a nonprofit, or a higher education institution, the VCDPA does not apply to you at the entity level. That is a stronger exemption than most states grant, and it means Virginia contributes almost nothing to your compliance burden.
If the VCDPA does apply to you, the two things to get right are the profiling opt-out and the data protection assessment. The assessment obligation is the one that gets missed. It is not new, it is not AI-specific, and the Attorney General can ask for it.
If you sell into Virginia state government, VITA EA-225 is the document that matters, and it will show up in procurement long before any statute does.
The planning judgment: do not build a Virginia-specific AI compliance program. Build against the frameworks that travel — the NIST AI RMF, ISO/IEC 42001, your existing HIPAA and GLBA controls — and you will be positioned for whatever the 2027 session produces without having spent a dollar on a law that does not exist.
Key Provisions
There is no Virginia AI statute reaching private-sector deployment
Virginia imposes no algorithmic-discrimination duty, no impact-assessment mandate, no AI risk-management-program requirement, no AI disclosure requirement, and no chatbot-specific rules on private businesses. This is not a gap in our research. It is the state of the law. Virginia is a light-touch jurisdiction and has been deliberate about staying one.
HB 2094 — vetoed, sustained, and dead
HB 2094 would have imposed a duty of reasonable care against algorithmic discrimination on developers and deployers of high-risk AI making consequential decisions in employment, lending, health care, housing, insurance, education, and parole, together with impact assessments and risk-management policies. It passed the Senate by two votes and the House by four. Governor Youngkin vetoed it on March 24, 2025, writing that its rigid framework failed to account for a fast-moving industry and placed an onerous burden on smaller firms and startups. Overriding required two-thirds of both chambers. The House sustained the veto on April 2, 2025. Any vendor or tracker still describing Virginia as having a high-risk AI act, or as likely to enact one imminently, is more than a year out of date.
What the Consumer Data Protection Act actually requires — profiling opt-out
The VCDPA gives Virginia consumers the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Profiling is defined broadly: any automated processing of personal data to evaluate, analyze, or predict a person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. This is the closest thing Virginia has to an automated-decision rule, and it is a privacy right rather than an AI-governance regime. You must be able to identify which of your systems perform profiling and honor an opt-out against them.
VCDPA data protection assessments
Section 59.1-580 requires a documented data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical, or reputational injury, offensive privacy intrusion, or other substantial injury to consumers. Assessments are also required for targeted advertising, sale of personal data, processing of sensitive data, any processing presenting a heightened risk of harm, and online services offered to children. The Attorney General may compel production of these assessments. This is the one Virginia obligation that most closely resembles an AI impact assessment — and organizations frequently miss that it already applies to them.
The exemptions do most of the work for regulated industries
The VCDPA applies only to entities that control or process personal data of at least 100,000 Virginia consumers in a calendar year, or at least 25,000 consumers while deriving more than half of gross revenue from selling personal data. On top of that, the exemptions are entity-level, not data-level: financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA-covered entities and business associates, nonprofits, institutions of higher education, and government bodies are excluded from the statute entirely. Employee and contractor data collected in the employment context is also outside scope. For a great many healthcare and financial services organizations, the honest answer is that Virginia privacy law does not reach them at all.
Executive Order 30 and the VITA standards — binding on state agencies and their suppliers
Governor Youngkin's Executive Order 30, issued January 18, 2024, directed the Virginia Information Technologies Agency to publish AI policy and IT standards for executive branch agencies, AI education guidelines, law enforcement standards, and an AI task force. VITA maintains Enterprise Architecture Standard EA-225 and an AI Utilization Policy, which reach existing and new AI use, embedded and generative AI inside other systems, and AI developed by agencies or by third parties. If you sell AI-enabled software to a Virginia executive branch agency, this is the framework your product and your documentation will be assessed against. It is procurement policy, not a statute — but it is the most operationally consequential AI rule in the Commonwealth for government-facing vendors.
AI in public schools — HB 1186 and SB 394
Signed in 2026 and effective July 1, 2026, these companion bills direct the Department of Education to study current AI use in schools and issue guidance on safe, ethical, and equitable use of AI systems in public elementary and secondary schools. Local school boards must then establish and enforce policies consistent with that guidance. The same legislation creates an AI Systems Innovation in Education Pilot Program, funded at $2 million in the FY2027-FY2028 biennial budget. Obligations fall on the Department of Education and school divisions, not on private deployers generally — but edtech vendors should expect division-level policy to become a procurement gate.
What is coming — the JCOTS verification study and the 2027 session
HB 797 and SB 384, approved by Governor Spanberger on April 8, 2026 as Chapter 425 and effective July 1, 2026 after passing 84-14 and 40-0, direct the Joint Commission on Technology and Science to evaluate a framework for independent verification organizations: third parties that would assess whether AI models and applications meet standards for preventing personal injury and property damage. It is an uncodified act — a study directive, not a licensing regime. Nothing in it licenses or regulates anyone today. JCOTS must report findings and recommendations by November 1, 2026 to the chairs of the Senate Committees on Finance and Appropriations and on General Laws and Technology and the House Committees on Appropriations and on Communications, Technology and Innovation. Two comprehensive-style bills failed in the same session — SB 365, the Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act, and HB 1294, which would have required law enforcement to disclose AI use in criminal investigations. Comprehensive AI legislation was effectively deferred to 2027. The November JCOTS report is the document to read if you want to know what Virginia will debate next.
Bills & Statutes
High-Risk Artificial Intelligence Developer and Deployer Act
VETOED by Governor Youngkin on March 24, 2025; veto sustained by the House on April 2, 2025. Never became law. No successor enacted.
Read the primary source(opens in a new tab)Joint Commission on Technology and Science; artificial intelligence; independent verification organizations
Approved by Governor Spanberger April 8, 2026 as Chapter 425 (2026 Uncodified Acts); effective July 1, 2026; JCOTS report due November 1, 2026
Read the primary source(opens in a new tab)Independent verification organizations for AI — Senate companion to HB 797
Signed into law in 2026; passed the Senate 40-0
Read the primary source(opens in a new tab)Department of Education; artificial intelligence system use in instructional settings
Signed into law in 2026; effective July 1, 2026
Read the primary source(opens in a new tab)AI guidance for public schools — Senate companion to HB 1186
Signed into law in 2026; effective July 1, 2026
Read the primary source(opens in a new tab)Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act
FAILED in the 2026 session. Not law.
Read the primary source(opens in a new tab)Use of artificial intelligence-based tools by law enforcement; disclosure of use
FAILED in the 2026 session. Not law.
Read the primary source(opens in a new tab)Virginia Consumer Data Protection Act — profiling opt-out and data protection assessments
In force since January 1, 2023. The operative Virginia obligation for automated decisions.
Read the primary source(opens in a new tab)Virginia AI policy standards for executive branch agencies — VITA EA-225 and AI Utilization Policy
Issued January 18, 2024; VITA standards published and currently maintained
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
No Virginia AI statute applies to private-sector AI developers or deployers. The VCDPA applies to entities doing business in Virginia or targeting Virginia residents that control or process personal data of at least 100,000 consumers annually, or at least 25,000 consumers with more than 50 percent of gross revenue from selling personal data — with entity-level exemptions for GLBA financial institutions, HIPAA-covered entities and business associates, nonprofits, higher education institutions, and government bodies. VITA's EA-225 AI standards apply to Virginia executive branch agencies and their suppliers.
Enforcement
The Virginia Attorney General has exclusive authority to enforce the Consumer Data Protection Act. The Attorney General must give 30 days' written notice and an opportunity to cure before bringing an action; the cure period has no sunset date. The Attorney General may also compel production of data protection assessments. There is no private right of action — the statute expressly forecloses one. No Virginia body enforces AI-specific rules against private deployers, because none exist. VITA standards are enforced through executive branch governance and procurement, not litigation.
Penalties
Up to $7,500 per violation of the Consumer Data Protection Act, plus reasonable expenses and attorney fees, after the 30-day cure period. No AI-specific penalties exist in Virginia law. Note that generally applicable exposure is unchanged: an AI system that produces discriminatory outcomes in employment, lending, housing, or insurance still creates liability under Virginia and federal anti-discrimination law, and deceptive claims about an AI system remain actionable as consumer fraud.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with Virginia's AI regulations.
- 1
Confirm your VCDPA exemption status first. GLBA financial institutions, HIPAA-covered entities and business associates, nonprofits, higher education institutions, and government bodies are exempt at the entity level. If you are exempt, Virginia privacy law imposes nothing on your AI systems and you can redirect the effort.
- 2
If the VCDPA applies, inventory which systems perform profiling in furtherance of decisions with legal or similarly significant effects, and confirm you can actually honor an opt-out against each one.
- 3
Produce or refresh data protection assessments for risky profiling, sensitive data processing, targeted advertising, sale of personal data, and any online service directed to children. The Attorney General can compel these. Most organizations that need them do not have them.
- 4
Do not build a Virginia AI compliance program. Build against the NIST AI RMF or ISO/IEC 42001, which satisfy customer diligence today and will map onto whatever Virginia enacts later.
- 5
If you sell to Virginia executive branch agencies, read VITA EA-225 and the AI Utilization Policy now, and prepare the AI disclosure and documentation artifacts they call for. This is a procurement gate, not a legal risk.
- 6
Treat generally applicable law as the live exposure. An AI system that produces disparate outcomes in hiring, lending, housing, or insurance is actionable under existing anti-discrimination law in Virginia regardless of the absence of an AI statute. Bias testing is a defensive measure, not a compliance checkbox.
- 7
Calendar the JCOTS independent verification organization report for November 1, 2026, and watch the 2027 session. That report is the best available signal of what Virginia will require next.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.