Virginia AI Laws 2026: Complete Guide for Businesses

Virginia has emerged as one of the most consequential states for AI policy in 2025–2026, not because it enacted the most aggressive regulations, but because its legislative choices—a vetoed comprehensive AI bill, a landmark independent verification framework, first-in-the-nation AI guidance for schools, and existing privacy law that already governs automated decisions—collectively define a distinct regulatory posture. Our database has 61 published Virginia AI-related bills for the 2025–2026 cycle: 155 have passed both chambers, 47 remain in committee, and 214 were introduced but did not advance. This guide explains what is actually in effect, what is pending, and what compliance looks like for businesses operating in the Commonwealth today.

The Virginia Consumer Data Protection Act (VCDPA) and AI Automated Decision-Making

Virginia's most consequential existing AI-related obligation comes not from a dedicated AI statute but from the Virginia Consumer Data Protection Act (VCDPA), which took effect January 1, 2023. The VCDPA grants consumers the right to opt out of profiling performed on personal data when that profiling is used to make decisions that produce legal or similarly significant effects. Covered decision contexts include the provision or denial of financial and lending services, housing, insurance, education enrollment, employment opportunities, healthcare services, and access to basic necessities.

Who Is a "Controller" Under the VCDPA

The VCDPA applies to businesses that either (1) control or process personal data of at least 100,000 Virginia consumers per calendar year, or (2) control or process the personal data of at least 25,000 Virginia consumers and derive more than 50% of gross revenue from the sale of personal data. Businesses below both thresholds are not subject to the law, though growing enforcement interest makes early documentation prudent.

Automated Decision-Making Obligations

If your business uses an AI system to analyze consumer data and generate outputs that inform decisions in the covered categories listed above, you are likely engaging in covered profiling. Obligations include:

• Providing a clear and conspicuous opt-out mechanism for consumers
• Honoring opt-out requests within 15 days
• Conducting a data protection assessment for each processing activity involving profiling that presents a heightened risk of harm
• Disclosing profiling activities in your privacy notice

Penalties under the VCDPA reach up to $7,500 per violation, enforced by the Virginia Attorney General. The AG's office has issued warning letters regarding VCDPA compliance and has joined multi-state investigations into AI practices by major platforms. See our AI Privacy topic tracker for related laws in other states.

HB 2094: The Comprehensive AI Bill That Was Vetoed (March 2025)

To understand Virginia's current AI legal landscape, businesses need to understand what did not pass. In February 2025, the Virginia General Assembly passed HB 2094, the High-Risk Artificial Intelligence Developer and Deployer Act, which would have made Virginia the second state after Colorado to enact a comprehensive AI law. The governor vetoed it on March 24, 2025, citing concerns that its requirements would burden innovation and small businesses.

What HB 2094 Would Have Required

The vetoed bill would have applied to developers and deployers of "high-risk AI systems"—those specifically intended to autonomously make, or be a substantial factor in making, consequential decisions affecting Virginia consumers in their personal capacity. Covered consequential decisions included parole or release from incarceration, education enrollment, employment access, financial services, healthcare, housing, insurance, marital status, and legal services.

• Developers would have been required to provide deployers with information about the system's intended uses, limitations, risk mitigation measures, and performance evaluations; to apply watermarking or other identification to synthetic content the system generates; and to use reasonable care to prevent algorithmic discrimination.
• Deployers would have been required to conduct and maintain a pre-deployment AI impact assessment for three years, adopt a risk management policy aligned with NIST AI RMF or ISO/IEC 42001, disclose to consumers that an AI system is being used to make a consequential decision, and provide consumers with adverse-decision notices and appeal rights.
• Enforcement would have rested exclusively with the Virginia Attorney General, with civil penalties of up to $1,000 per violation (or up to $10,000 for willful violations), plus a discretionary 45-day cure period.

With the veto, none of these obligations became law. However, the bill is expected to be reintroduced in a narrower form—likely focused on the healthcare sector—during the 2026 session under the new governor's administration. Businesses in healthcare AI should monitor this closely. See our Comprehensive AI topic tracker for the latest developments.

AI in Criminal Justice: Virginia Code § 19.2-11.14 (Effective June 6, 2025)

One AI-specific statute is now fully in force in Virginia. Virginia Code § 19.2-11.14, enacted in 2025, establishes a human decision-maker requirement for all criminal justice determinations. The law provides that all decisions related to pre-trial detention or release, prosecution, adjudication, sentencing, probation, parole, correctional supervision, or rehabilitation of criminal offenders must be made by the judicial officer or other person charged with making that decision. No such decision may be made without human involvement, even if an AI-based tool was used to generate a recommendation or prediction.

The statute defines "artificial intelligence-based tool" broadly to include machine learning models, predictive analytics, and decision support systems that analyze data and generate recommendations or predictions. Any recommendation or prediction from such a tool remains subject to challenge or objection permitted by law. This law applies directly to courts, prosecutors, and correctional agencies, and indirectly to vendors supplying AI-assisted risk assessment or decision-support tools to those agencies. See our AI in Law Enforcement topic tracker.

AI in Education: SB394 and HB1186 (Passed Both Chambers, 2026)

Two companion bills—SB394 and HB1186—passed the Virginia General Assembly with overwhelming bipartisan support. The House voted 95–0 in favor of both bills; the Senate voted 37–2 for SB394 and 38–1 for HB1186. As of this writing, the bills were enrolled and transmitted to the governor for signature.

What SB394 and HB1186 Require

The legislation directs the Virginia Department of Education (VDOE) to develop and publish guidance for the safe, ethical, and equitable use of AI systems in K–12 public schools. VDOE's guidance must address:

• Student data privacy protections when AI systems are used for instruction
• Training and professional development for teachers
• Protections against AI bias in educational tools
• Identification and documentation of AI systems currently used for student instruction across local school divisions

The bills also establish the AI Innovation in Education Pilot Program, which provides funding to evaluate and scale innovative AI applications in Virginia public schools. EdTech vendors selling AI-driven instructional tools into Virginia schools should expect VDOE's forthcoming guidance to inform procurement requirements and data-processing terms. See our AI in Education topic tracker.

Independent Verification Organizations: SB384 and HB797 (Signed April 2026)

The governor signed SB384 and HB797 on April 13, 2026, making Virginia the first state in the nation to advance an Independent Verification Organization (IVO) framework through legislation. The bills passed with strong bipartisan margins—84–14 in the House and 40–0 in the Senate.

What the IVO Framework Studies

SB384 and HB797 direct Virginia's Joint Commission on Technology and Science (JCOTS) to evaluate the feasibility of a framework for independent verification organizations: independent, expert-led bodies that verify whether AI systems meet defined safety standards. The legislation does not create mandatory compliance obligations today; it commissions a JCOTS study that will lay the groundwork for what could become operational IVO requirements in a future session.

Under the IVO model being studied, a state government would set outcome-based safety goals, authorize a marketplace of independent verification organizations to develop technical criteria, and permit AI companies to voluntarily submit their products for verification. Verified products would earn a trusted seal of approval and receive evidentiary support in litigation. This approach is modeled on existing third-party verification regimes in financial auditing, product safety, and clinical trials. For AI developers and deployers, the JCOTS study is worth monitoring—its recommendations could form the basis for Virginia's next generation of AI governance requirements. See our Comprehensive AI topic tracker for updates.

Autonomous Vehicles: HB1124, SB320, HB582, and SB670

Virginia has a cluster of autonomous vehicle legislation at various stages:

• HB1124 (passed both chambers) directs an existing state work group to conduct an assessment of the workforce impacts of autonomous vehicles—including job changes and displacement—and report findings by November 1, 2026. This is a study measure with no immediate compliance obligations for private employers, but its findings could inform future workforce legislation.
• SB320 and HB582 (both signed, effective April 6, 2026) authorize a pilot program for autonomous truck-mounted attenuators in Virginia mobile work zones, expiring December 31, 2031. This directly affects transportation and construction contractors deploying autonomous safety equipment on Virginia roads.
• SB670 (in committee) would regulate the commercial use of fully autonomous vehicles in Virginia, requiring operators to obtain licenses and meet safety standards. This bill did not advance in 2026 and is expected to be reconsidered in 2027.

Pending Bills: What Stalled and Why

The 2026 Virginia General Assembly session was notable for how many AI bills were tabled or continued to 2027. The chair of the House Communications, Technology and Innovation Committee applied three tests before advancing AI bills: (1) no conflict with the VCDPA; (2) no significant fiscal impact on the state budget; and (3) no conflict with the federal executive order threatening to withhold broadband funding from states enacting "onerous" AI restrictions.

Bills that did not advance in 2026 include:

• SB586 (in committee): Would have required health carriers to disclose AI use in claims management and notify affected parties of adverse AI-driven determinations. Continued to 2027 over broadband funding concerns.
• SB796 (in committee): The Artificial Intelligence Companion Chatbots and Minors Act, which would have required chatbot operators to implement safety measures for minors and report serious incidents. Continued to 2027; sponsor indicated it likely fell within the federal executive order's carveout for child safety topics.
• SB269 (in committee): Would have regulated AI use by mental health service providers and imposed civil penalties for violations. Did not advance.
• SB141 / HB982 (synthetic media in political advertising): Would have required disclosure statements on electioneering communications containing synthetic media and imposed penalties for violations. Not enacted in 2026.
• SB85 (in committee): Would have amended the VCDPA to require interoperability interfaces for social media platforms and AI model operators, effective July 1, 2027.

Businesses in healthcare AI, consumer chatbots, and political technology should treat the 2027 session as the next meaningful legislative window for Virginia.

Higher Education AI Policies: HJR32

HJR32 (passed both chambers) directs the Joint Legislative Audit and Review Commission (JLARC) to study AI use policies at Virginia's higher education institutions. The study will examine how public colleges and universities are developing, adopting, and governing AI tools, and is expected to produce recommendations that influence future higher education procurement standards and policy. Vendors supplying AI tools to Virginia's public colleges and universities should monitor the JLARC study's findings.

Virginia's Executive Order on AI in State Government

Even though HB 2094 was vetoed, businesses contracting with Virginia state agencies face meaningful AI-specific requirements under Executive Order No. 30 (2024). That order established baseline standards for AI use in Virginia executive branch agencies and directed the Virginia Information Technologies Agency (VITA) to publish AI policy standards and IT standards applicable to all executive branch agencies. Any AI software or services supplied to Virginia state agencies must comply with VITA's standards, which address transparency, risk mitigation, and data protection. Companies selling AI products into Virginia government channels should verify compliance with current VITA standards as part of procurement due diligence.

Key Bills Summary

Compliance Priorities by Company Type

For a complete index of Virginia AI legislation, visit our Virginia AI laws page. For broader context on how Virginia compares to other states, see our trackers for Comprehensive AI, AI in Education, AI Transparency, AI Privacy, and AI in Law Enforcement.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.