Virginia High-Risk Artificial Intelligence Developer and Deployer Act

Summary

Virginia HB 2094 (2025) — formally the High-Risk Artificial Intelligence Developer and Deployer Act — was a comprehensive AI regulation bill modeled in part on the Colorado AI Act, governing developers and deployers of high-risk AI systems making consequential decisions in housing, employment, education, financial services, healthcare, and insurance. The bill passed the Virginia General Assembly in February 2025 but was vetoed by Governor Glenn Youngkin on March 24, 2025, and the Atlas now tracks it as a defeated bill rather than a live obligation. As of the last verification date below, no direct successor has been enacted; the 2026 General Assembly session ended with most comprehensive AI legislation tabled to 2027.

What HB 2094 would have required

Had it been signed, HB 2094 would have taken effect on July 1, 2026 and imposed Colorado-style duties on covered actors:

• Developers of high-risk AI systems would have owed deployers documentation describing intended uses, known harmful uses, training-data summaries, performance evaluations, and risk-mitigation measures sufficient to enable a deployer impact assessment.
• Deployers would have owed an annual algorithmic impact assessment for each high-risk system, pre-decision consumer disclosure when a high-risk AI was used in a consequential decision, a right to correct incorrect personal data, and a right of human review where technically feasible.
• The Virginia Attorney General would have held exclusive enforcement authority, with civil penalties up to $10,000 per violation and a 60-day right-to-cure for technical violations.
• The bill defined "high-risk artificial intelligence system" narrowly around consequential decisions in housing, employment, education, lending, healthcare, insurance, and legal services — closely tracking C.R.S. § 6-1-1701(9) but with Virginia-specific carve-outs.

Primary text: LIS HB 2094 (2025) bill summary (retrieved 2026-05-01).

The veto and its rationale

Governor Youngkin's veto message (March 24, 2025) framed HB 2094 as overbroad and economically harmful, arguing it "would harm the creation of new jobs, the attraction of new business investment, and the availability of innovative technology in the Commonwealth." The veto letter specifically flagged: (a) the breadth of the "consequential decision" definition relative to existing Virginia consumer-protection law, (b) compliance cost on small and mid-sized Virginia businesses, and (c) anticipated chilling effects on AI investment relative to less-regulated peer states. Industry trade associations (BSA, Chamber of Progress) supported the veto; civil-rights and labor groups opposed it. Source: [Chamber of Progress veto letter PDF, retrieved 2026-05-01.]

2026 Virginia General Assembly outcome

The 2026 Virginia General Assembly session ended February 22, 2026 with no comprehensive successor to HB 2094 enacted. Two narrow AI bills became law and two failed:

• HB 797 / SB 384 (signed 2026): directs the Joint Commission on Technology and Science (JCOTS) to evaluate frameworks for independent verification organizations assessing AI models; report due November 1, 2026. Establishes study groundwork for a future certification regime, not substantive obligations on AI developers or deployers.
• HB 1186 / SB 394 (signed 2026): requires the Virginia Department of Education to issue guidance on safe, ethical, and equitable use of AI systems in instructional settings, and creates the AIS Innovation in Education Pilot Program. Education-sector-only; passed the House 95–0.
• HB 1294 (failed 2026): would have required law-enforcement disclosure of AI use in criminal investigations including police-report documentation and audit recordkeeping.
• SB 365 (failed 2026) — "Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act": would have required AI developers to clearly and conspicuously disclose specific terms governing their systems to users.

Most remaining comprehensive AI proposals were tabled until the 2027 session. Compliance teams should expect a revised HB 2094-style bill to be reintroduced; legislators have publicly signaled intent to rework the framework in 2027 with refined scope. The Atlas tracks 2027-session reintroduction status, AG enforcement signals, and adjacent state activity on the news log. For a contrasting state model that opted for narrow topic-specific statutes rather than a comprehensive framework, see Florida's AI bills — HB 919 (political deepfakes) and HB 757 / Brooke's Law (non-consensual sexual deepfakes) regulate discrete harms without a unifying "high-risk AI system" definition. Source: [Williams Mullen 2026 session recap, retrieved 2026-05-01; VPM News 2026-02-23 reporting, retrieved 2026-05-01.]

What Virginia AI compliance actually requires today

With no comprehensive AI law in force, AI systems serving Virginia consumers in 2026 face three independent control surfaces:

• Virginia Consumer Data Protection Act (VCDPA) — Va. Code § 59.1-575 et seq. Applies to processors of Virginia residents' personal data and includes a right to opt out of profiling "in furtherance of decisions that produce legal or similarly significant effects." This is the closest existing analogue to HB 2094's deployer disclosure regime and remains enforceable by the Virginia Attorney General.
• Federal frameworks as baseline — NIST AI Risk Management Framework (voluntary; widely adopted contractually) and ISO/IEC 42001:2023 (auditable AI management system standard).
• Sector-specific federal law — EEOC guidance on algorithmic hiring discrimination, FTC § 5 unfair/deceptive practices authority over AI systems, HUD guidance on AI-driven housing decisions, and (for healthcare) FDA AI/ML medical device guidance.

Virginia organizations contracting AI vendors should write contracts as if HB 2094 were in force — the obligation set is broadly aligned with NIST AI RMF GOVERN functions and Colorado AI Act deployer duties, both already in mainstream B2B AI procurement language. This reduces 2027-session reintroduction risk to a contract-amendment exercise rather than a compliance build.