Security2 publishers3 min readPublished
Executive Order 22 bans state-agency NDAs on Virginia data center deals
The order Spanberger signed Friday binds executive branch agencies and creates Virginia's first AI task force covering privacy, cybersecurity and job losses, while the limits that would reach private operators wait on the 2027 General Assembly.
The Watch · Security desk

What happened
- Governor Abigail Spanberger signed Executive Order 22 on Friday alongside a Virginia Data Center Accountability Framework she called the most comprehensive and aggressive of its kind in the country.
- The framework stops short of a moratorium on data center development and leaves the industry's tax exemptions in place.
- Limits on by-right approval and a requirement for local approval of any data center using more than 25 megawatts go to the 2027 General Assembly as legislative priorities.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint The duties the order can impose land on state agencies, so an operator's filing obligations depend on bills the 2027 session has not yet taken up.
- exposure Anyone negotiating a project with a Virginia executive branch agency now has to assume the terms are disclosable, because the state side can no longer sign secrecy into the deal.
- contradiction The two published accounts point compliance teams in different directions on who is covered today, and the difference decides whether an existing Virginia facility owes anything before 2027.
- precedent If the 25 megawatt threshold survives the legislature it becomes the figure other states borrow, and Bloomberg Law reports other Democratic leaders already moved on similar restrictions.
An executive order reaches the people who work for the governor. Seven items sit in Executive Order 22. The first is the nondisclosure ban across executive branch agencies, departments, commissions, authorities and other public employees. The rest: a community engagement toolkit for localities weighing projects; faster development of noise regulations; a review of diesel and other backup generation; work on energy affordability and grid strength; best practices for jobs and local workforce opportunities; and the AI task force [4]. One of the seven touches cybersecurity [19].
That one is the task force. Friday's accounts do not say who serves on it or when it reports. Spanberger's office said its goal is to address the risks posed by the rapid development of artificial intelligence, including data privacy, cybersecurity and potential workforce displacement [5].
The measures that would bind a private operator sit on the legislative list [20]. Spanberger asked the 2027 General Assembly to limit by-right approval and to require local approval of any data center that uses more than 25 megawatts of power [8][10]. By-right approval is the route a project takes when it meets existing land-use requirements and skips a local government's public hearing [9]. A statewide ban on the agreements for commercial data center projects would also take a statute. The order's ban applies to state entities and employees, not to local officials [6], who have signed such agreements as part of some data center deals [7].
Spanberger said at a Richmond press conference that "so many of our fellow Virginians are rightfully concerned about the impact data centers are having on our energy bills" [11]. Reaction on Friday was mixed, including from lawmakers in her own party who said the framework does not go far enough [16]. "The governor is finally feeling the heat but still ignoring the fire. Her proposal does not end the $2 billion in sales tax exemptions provided to data centers," said state Senate President Pro Tempore Louise Lucas, D-Portsmouth [12]. Lucas pushed this year to end those exemptions eight years before their current expiration and made it a sticking point in budget negotiations [18]. The Piedmont Environmental Council wanted more. In a statement, the council said a moratorium, meaning a pause on all development and new applications, should be the first step, so that the many impacts on the state and its residents can be fully addressed [13].
The two published accounts of the framework diverge on who is covered. Bloomberg Law reported that hundreds of data centers in Virginia will now be subject to wide-ranging restrictions, and that Spanberger said the framework's standards on transparency, clean energy and community benefits will govern data center development in the state [14][21]. The itemized account in Cardinal News describes instructions to state government plus a list of asks for the 2027 session [4][10]. Spanberger called the framework the most comprehensive and aggressive of its kind in the country [2]; Bloomberg Law noted that other Democratic leaders have adopted similar restrictions in recent weeks [15].
What to watch
- Whether bills limiting by-right approval and setting the 25 megawatt local approval trigger are introduced in the 2027 session, and in what form.
- Whether a statute extends the nondisclosure ban to local officials and commercial projects. The answer decides whether county negotiation records stay sealed.
- Whether Lucas revives her push to end the $2 billion in data center sales tax exemptions early in the next budget negotiation.