Virginia AI Executive Order: New Data Center Obligations

On 18 September 2026, Virginia signs Executive Order 22

On 18 September 2026 Virginia Governor Abigail D. Spanberger signed Executive Order 22 (2026). The instrument establishes a state AI Task Force. It also directs a group of agencies to open immediate consultation with the public, with other administrations, with industry and with federal agencies, in order to gather proposals and implementation plans.

The full text is published by the governor's office in PDF format^[1]. Three provisions operate immediately: they limit confidentiality protections, provide for the exclusion of larger sites from efficiency programs, and add oversight of industrial water consumption.

The legal analysis published on LexBlog on 23 September 2026^[2] flags an immediate effect on state regulation. The legal and commercial impact touches businesses, communities, utilities, technology companies, local government and residents. The jurisdiction remains one: the Commonwealth of Virginia.

The order carries the governor's signature, so it lives within the perimeter of executive power: it changes agency practice before it changes law written by the legislature.

The regulatory delta: from model to infrastructure

US state AI laws have so far targeted the system: risk classification, transparency obligations, control over automated decisions. Virginia's order picks a different lever. It regulates the building, the electrical grid and the cooling water before the model running inside.

The delta is measurable. Before 18 September 2026, AI compliance in Virginia turned on how the system was used; now part of the file turns on the site that hosts it.

The change of object has a practical consequence for anyone maintaining the risk register. A compliance profile calibrated on the model proves too narrow for a context where the permit, the utility bill and the cubic metre of water become inspectable items.

Virginia is one of the world's compute hubs, so the choice of lever carries weight beyond the state line.

The three provisions already in force

The limitation on confidentiality protections strikes at the method by which data centers come into being. Negotiations with local government often run under NDA, and the limitation moves material from the private file to the open one.

Excluding larger sites from efficiency programs shifts a cost. Anyone above the threshold loses access to a tariff advantage. The exact threshold remains to be set in the implementation plans the agencies must submit.

Oversight of industrial water consumption adds a metric to the compliance file. Cooling becomes a declared figure, and therefore one a third party can verify. A number reported to the state becomes comparable with the one written into sustainability reporting.

Three different levers, one single effect: AI infrastructure enters the perimeter of state controls, under the same logic applied to utilities.

Who answers, and for what

The order assigns tasks to state agencies, and the chain of responsibility extends outward. Utilities, data center operators, local government and cloud providers end up inside the same file. Each brings a piece of the data the oversight requires.

Here the bedrock rule of this desk applies: accountability without a name produces documentation instead of governance. Which internal role, by name and in writing, answers for the water and energy profile of a site before deployment?

The question applies to anyone signing a colocation contract and to anyone buying compute capacity on a consumption basis. A contract silent on the disclosure of consumption data leaves the exposure with the customer.

The issue concerns the supplier too. Anyone selling capacity in Virginia must state, by contract, which data it passes to the state and which it remains free to keep confidential.

Confidentiality becomes the principal risk item

The limitation on confidentiality protections is the provision with the most direct legal effect, because it touches documents already signed.

The General Counsel faces an inventory job. Which agreements cover consumption data, which clauses hold up against a state disclosure obligation, which counterparty needs to be notified. The audit is still owed; the perimeter changes.

A confidentiality agreement written when protection was full is worth little once protection becomes partial. The review starts with Virginia sites, then looks at the twin clauses signed in other states.

The Chief Risk Officer updates a different item: reputational risk tied to publication of water and energy consumption. The figure leaves the technical file and enters local debate, where it weighs on permit issuance.

The governance signal

The governance signal: AI regulation also arrives from the offices that issue permits, tariffs and water concessions.

US regulatory fragmentation is the underlying model, not an accident. Colorado rewrote its own law before it took effect, Hawaii legislated on its own account, New Jersey and California took distinct paths. Coherent federal legislation, on this desk's reading, is unlikely to arrive before the 2028-2030 period.

Executive Order 22 adds a new axis to the map. Anyone operating across multiple states manages obligations on the system in one jurisdiction and obligations on the facility in another. The control map becomes two-dimensional: what the system does, where the machine lives.

The competitive advantage stays where it was: in risk classification done ahead of enforcement. Anyone building the audit trail on energy, water and confidentiality now gains months of margin on competitors.

Three decisions for the board

The audit and risk committee faces three choices, each with an internal deadline to set.

1. Map the sites: which facilities in use, owned or in colocation, exceed a plausible size threshold and lose access to efficiency programs in Virginia.
2. Review the confidentiality agreements: which agreements on consumption data hold up against the limitation the order introduces.
3. Define the disclosure: which information on water and energy consumption enters the annual report, under which metric and which external verification.

The sequence matters. The site map precedes the contractual review, and the contractual review precedes the decision on disclosure.

The CEO finds a concrete strategic constraint here. Choosing a compute site now carries a regulatory cost on top of the cost per kilowatt-hour. An expansion decision taken by looking at the tariff overlooks a variable the state has made public.

The Chief Compliance Officer adds a line to the audit plan: consistency between consumption data declared to the state and the figures reported in sustainability reporting. Two different numbers for the same site open up a market communication problem.

The task force works in parallel, so the picture will shift again over the coming months.

Regulatory horizon

Current status: Executive Order 22 (2026) has been in force since 18 September 2026 in the Commonwealth of Virginia. The three operative provisions act immediately. The accountability-based initiatives remain in the implementation phase, with proposals and plans the agencies must submit once consultation closes.

The text is silent on penalty amounts, so the immediate risk stays administrative and contractual before it becomes financial. The composition of the task force and the calendar of its work will define the measure's real reach.

On the European front the framework runs on a different clock. Regulation (EU) 2024/1689 holds the transparency obligation under Article 50, and the high-risk calendar, after the Digital Omnibus, sits at December 2027. Anyone running data centers in Virginia and high-risk systems in Europe works to two distinct deadlines.

The question of who regulates the models has received an answer. A second question has opened: who regulates the machines the models run on.