Virginia has officially moved to the front of the pack in the race to regulate artificial intelligence. By signing this landmark legislation, Governor Spanberger has transitioned the Commonwealth from a "wait-and-see" approach to a "prove-it-first" mandate. This isn't just a localized rule; it is a signal to the rest of the country that state-level oversight will fill the vacuum left by federal inaction. The law specifically targets "high-risk" AI systems—those that make consequential decisions about housing, employment, healthcare, and lending; and demands that companies show their work before these models go live.
The move reflects a growing consensus that the era of self-regulation is coming to a close. As AI systems become more integrated into the daily lives of Virginians, the risk of unmonitored bias and systemic failure has reached a tipping point. Andrew Freedman, Co-Founder and CEO of Fathom, highlighted the necessity of this balanced approach during the signing:
"This legislation reflects a practical reality: government alone cannot keep up with the pace of AI development, and industry cannot be expected to police itself. Virginia is charting a path that empowers independent experts to ensure AI is safe and accountable, while preserving the innovation and economic growth that make the Commonwealth a leader in technology."
— Andrew Freedman, Co-Founder and CEO of Fathom
Key Terms
High-Risk AI System: Any AI tool used to make or be a substantial factor in making a decision that has a legal or similarly significant effect on a consumer.
Algorithmic Discrimination: Any condition where an AI system results in an unlawful differential treatment of a person or group based on protected characteristics.
Impact Assessment: A formal, documented evaluation of a high-risk AI system that analyzes its purpose, its potential for bias, and the data used to train it.
Consequential Decision: Decisions specifically related to education, employment, financial services, healthcare, housing, or legal services.
Conditions Driving This Change
The "Wild West" era of AI deployment was sustainable only as long as AI remained a novelty. Now that it is an operational engine for major industries, the lack of a legal safety net has become a systemic risk. Several conditions forced Richmond to act:
First, the complete lack of a federal AI framework created a dangerous level of uncertainty for both businesses and citizens. Without a national standard, states have had to step in to prevent a "race to the bottom" where consumer rights are sacrificed for speed.
Second, the rise of "black box" algorithms in essential services like mortgage lending and hiring has led to documented cases of systemic bias that traditional laws were ill-equipped to handle.
Third, the rapid adoption of generative AI and autonomous agents has outpaced the existing regulatory oversight. There was a growing realization that "ethics committees" inside tech companies were not a substitute for enforceable law.
Finally, the pressure from consumer advocacy groups and the success of the Virginia Consumer Data Protection Act (VCDPA) provided a logical foundation for this new layer of AI-specific governance. Virginia already had the privacy muscle; it just needed to apply it to the models.
The rapid adoption of autonomous agents has outpaced existing regulatory oversight. There was a growing realization that "ethics committees" inside tech companies were not a substitute for enforceable law. Delegate Cliff Hayes, Jr., Chairman of the Joint Commission on Technology and Science (JCOTS), noted that the pace of innovation required a fundamental shift in how we think about oversight:
":Our legislation recognizes that a new technology requires a new approach to governance. The IVO framework offers exactly that: a way to put independent technical experts at the center of AI oversight, working within a voluntary structure that our government can oversee and the public can trust."
— Cliff Hayes, Jr., Chairman of the Joint Commission on Technology and Science (JCOTS)
By establishing a framework for experts to work alongside the government, the state is attempting to build a regulatory model that is as dynamic as the technology it aims to control.
What AI Governance Looked Like Before
Before Governor Spanberger signed this bill, AI governance in Virginia—and most of the U.S.—was a voluntary exercise in "best efforts." Companies followed industry whitepapers and NIST frameworks, but there were no real consequences for failing to document a model's risk profile. Governance was often a checkbox at the end of a development cycle rather than a requirement at the beginning.
Security and legal teams were essentially flying blind. They could flag concerns about a model's bias or lack of transparency, but without a legal mandate, these concerns were often overruled by the need for faster deployment. Audits were internal, results were private, and "transparency" was whatever a marketing department decided to put in a blog post.
There was also no standardized definition of what "high-risk" actually meant in a legal sense. A company could deploy a predictive hiring tool without ever considering if it violated civil rights laws, only realizing the error after a lawsuit or a public PR disaster. It was a reactive model based on damage control rather than proactive risk mitigation. This lack of structure made it impossible for auditors or regulators to measure the actual "safety" of the AI landscape.
What’s Changing Now
The new law flips the script. Governance is no longer optional; it is a condition of doing business. The most significant change is the requirement for mandatory AI Impact Assessments. Any organization deploying a high-risk system must now document exactly how that system works, what data it uses, and what steps were taken to mitigate potential discrimination. This documentation must be available to the state’s Attorney General upon request.
Disclosure is also becoming a hard requirement. Consumers now have a right to know when a consequential decision is being made about them by an AI, and in many cases, they must be given a clear explanation of why the AI made that specific decision. This effectively kills the "black box" defense. If you can't explain how the model reached its conclusion, you shouldn't be using it for high-stakes decisions.
"Independent Verification Organizations help provide that accountability. This framework ensures that when an AI system is used to make decisions that affect Virginians' health, safety, or livelihoods, it has been verified by experts who answer to the public, not to the companies building the technology."
— Senator Angelia Williams Graves
Beyond verification, disclosure is also becoming a hard requirement. Consumers now have a right to know when a consequential decision is being made about them by an AI, and in many cases, they must be given a clear explanation of why the AI made that specific decision. This forces companies to build "explainability" into their models from day one. If an organization cannot prove its model is fair and transparent through an impact assessment, it faces significant legal exposure and potential intervention from the state’s Attorney General.
Finally, the law introduces a formal duty of care for developers and deployers. Developers must provide deployers with the information and documentation necessary to conduct impact assessments. This creates a chain of accountability that stretches from the person writing the code to the executive signing off on the deployment. It forces a new level of collaboration between the builders and the users of AI, ensuring that risk isn't just handed off down the line.
Our Take
AI Governance Take
Virginia's legislation is the "canary in the coal mine" for American AI companies. For governance teams, the takeaway is clear: the era of "trust us, it works" is over. This law proves that the future of AI isn't just about who has the best weights or the most data, but who has the most defensible process. If you are building or buying AI today without a documented impact assessment framework, you are building a liability.
This law also levels the playing field. For companies that have invested in responsible AI from the start, this is a competitive advantage. They already have the documentation and the guardrails that Virginia now requires. For those who have been cutting corners, the cost of compliance is about to spike.
At GAIG, we view this as a major milestone for the AI Compliance Programs and AI Risk & Controls categories. This isn't just about one state; it's about the standard that will eventually be adopted by dozens of others. Organizations should start mapping their current AI inventory against Virginia's "high-risk" definitions now. Waiting for a lawsuit or an Attorney General inquiry is a strategy that will no longer work in a post-Spanberger Virginia.
