From the State Government edition of September 20, 2026
Virginia EO 22 creates rapid-response AI Task Force and bans data-center NDAs
Office of the Governor of Virginia · State government — AI risk governance, workforce/privacy/cyber, data-center accountability · Virginia (transferable as a state executive AI + infrastructure governance model; not a multi-state evaluation)
- Publisher
- Virginia Executive Order 22 (2026)
- Original publication
- Executive Order 22 signed September 18, 2026 (official PDF)
- Source retrieved
- 2026-09-21
- Event date
- 2026-09-18
What happened
On September 18, 2026, Governor Spanberger signed EO 22 directing a rapid-response AI Task Force co-led by the Chief Transformation Officer, Counsel to the Governor, and Secretary of Administration, supported by a new AI Policy Planning Unit. Immediate Task Force duties include workforce-displacement and privacy risk responses, mapping existing enforcement options, assessing AI-agent cybersecurity threats to state systems and critical infrastructure, coordinating with peer governors and frontier developers, and continuous reporting to the Governor. Separately, the order implements a Data Center Accountability Framework: bans new executive-branch NDAs that hide material data-center impacts, directs a community engagement toolkit within 120 days, creates VA-LEAD responsible-development criteria, and tasks DEQ/Virginia Energy with noise, backup-generation, and cooling-water scarcity work. It rescinds Youngkin EO 30 and ED 5 while leaving prior standards in force until replaced. No measured AI service outcomes are reported.
Why it matters
Shows a large AI-hosting state pairing frontier/regulatory AI risk staffing with infrastructure transparency controls that affect procurement, energy cost allocation, and community disclosure—core state-government operating-model and governance questions for peers.
Evidence and measured results
Signed EO PDF dated September 18, 2026: creates AI Task Force + AI Policy Planning Unit; NDA ban for proposed commercial data-center developments; toolkit due in 120 days; VA-LEAD criteria due end of 2027; continuous Task Force reporting.
Limitations and uncertainty
Directive/governance instrument only—no published Task Force membership roster, metrics, budget, or completed enforcement actions yet. Data-center pillars dominate page count; AI section is shorter and outcome-light. Rescinds prior Youngkin AI EO/ED without detailing replacement standards.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-20; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States hosting large AI infrastructure need an executive AI risk response capacity and transparent data-center rules without waiting for federal standards.
- Stakeholders
- Governor's office / Chief Transformation Officer
- Counsel to the Governor
- Secretary of Administration
- Chief Energy Officer / DEQ / Virginia Energy
- VEDP and local governments
- Discovery questions
- Who owns AI workforce-displacement and privacy risk responses today?
- Which data-center NDAs or site-readiness deals would break under an EO-22-style ban?
- How are AI-agent cyber risks reviewed for state systems?
- What 120-day community toolkit artifacts already exist?
- Value hypothesis
- A 6–8 week operating-model and disclosure sprint can align AI Task Force RACI with data-center transparency artifacts peers can reuse.
- Potential engagement
- Bounded engagement: draft Task Force charter, secretariat RACI, and NDA/disclosure playbook patterned on EO 22 milestones—no product procurement.
- Unsupported claims
- That EO 22 has already reduced AI harms or energy bills
- Guaranteed transfer of Virginia's political model to other states
- That banning NDAs alone yields community consent
Pre-sales engineering
Role takeaway
- Fit
- Cross-secretariat AI risk unit plus data-center transparency/scoring systems integrated with energy and environmental permitting data.
- Architecture and integration
- Connect Task Force intake to cyber fusion / critical-infrastructure partners; publish disclosure templates and VA-LEAD criteria; keep national-security NDA exceptions narrowly logged.
- Prerequisites
- Named co-leads and AI Policy Planning Unit staffing
- Inventory of data-center NDAs and ≥25 MW pipeline projects
- DEQ/energy data feeds for noise, backup generation, and cooling water
- Constraints
- Executive-order authority limited to executive branch
- Existing contractual NDAs honored absent extraordinary circumstances
- No federal AI statute to lean on
- Security
- Agent/bot threat assessments for state systems need coordinated monitoring; community disclosure must avoid leaking protected security details.
- Proof of value
- Published toolkit within 120 days
- Documented NDA ban compliance guidance
- First Task Force risk memo covering workforce, privacy, and cyber
Delivery
Role takeaway
- Work
- Stand up Task Force + Planning Unit; deliver community toolkit; start VA-LEAD criteria; advance DEQ noise/water/backup workstreams.
- Dependencies
- Secretariats named in EO
- DEQ statutory rulemaking authority
- Utilities/SCC/PJM engagement for cost allocation
- Legislative partners for 2027 bills
- Ownership
- CTO/Counsel/Administration co-lead AI Task Force; Chief Energy Officer leads data-center framework.
- Skills and adoption
- Need AI policy, privacy, cyber, energy planning, and community-engagement skills—not only model engineering.
- Governance checkpoints
- Continuous Governor reporting
- 120-day toolkit
- 180-day DEQ plans
- End-2027 VA-LEAD criteria
- Acceptance criteria
- Signed Task Force charter with urgent-request protocol
- Public toolkit URL
- Written NDA prohibition implementing guidance
- Risks
- AI section stays symbolic without staffing
- Data-center industry pushback slows rules
- Rescinding prior EO creates policy ambiguity until replacements land
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Treats AI risk as a cross-secretariat standing capability (CTO/Counsel/Administration) rather than a single CIO pilot office, and ties AI infrastructure (data centers) to energy, DEQ, and economic-development systems with explicit transparency constraints.
Governance
Who approves, reviews and stays accountable for outcomes?
Establishes urgent Task Force priority across secretariats and JLARC/JCCTS coordination, while data-center incentives/site-readiness assistance face new exclusions (≥25 MW) and disclosure bans on NDAs—raising the bar for opaque vendor/community deals.
Security and privacy
What data, permissions and controls need testing?
Task Force must assess cybersecurity risks from AI agents/bots to state systems and critical infrastructure and address data-privacy harms to personal information; no technical control baselines are specified in the order itself.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Task Force explicitly includes workforce-displacement risk and coordinates with Labor/Education secretariats; data-center pillar requires quality-jobs and workforce reporting into VA-LEAD—accessibility for residents appears mainly via community engagement toolkit, not digital service design.
Procurement
What should contracts, pricing and exit terms secure?
NDA ban and site-readiness exclusions change how economic-development and vendor negotiations can be structured; AI Task Force coordination with frontier developers may shape future state AI procurement expectations.
Operating model
Which teams own the service once it runs?
Moves from prior Youngkin-era AI EO/ED to a Spanberger rapid-response Task Force model while binding data-center growth to transparency and environmental performance—an enterprise operating-model shift, not a pilot.
Publication history
- 2026-09-20State Government · Issue 153 resources
Stable resource ID: virginia-eo-22-ai-task-force-data-center-20260918