Virginia HB 2094: What Businesses Need to Know Before July 2026

Virginia has joined Colorado as the second US state to pass comprehensive AI legislation. The Virginia High-Risk Artificial Intelligence Developer and Deployer Act (HB 2094) takes effect July 1, 2026 — one day after the Colorado AI Act. If you operate in both states, you're facing a simultaneous compliance deadline.

What Is Virginia HB 2094?

HB 2094 establishes requirements for businesses that develop or deploy "high-risk AI systems" — defined as AI that makes consequential decisions about Virginia consumers in domains including:

• Employment: Hiring, promotion, termination, compensation decisions
• Housing: Rental, purchase, and housing assistance decisions
• Credit and Finance: Lending, insurance underwriting, and financial product access
• Education: Admissions, financial aid, and academic evaluation
• Healthcare: Diagnosis, treatment, and medication recommendations
• Criminal Justice: Bail, parole, or sentencing decisions (for applicable deployers)

The law applies to businesses that deploy these systems to make or substantially assist in making consequential decisions affecting Virginia residents.

How Does Virginia Compare to Colorado?

Virginia HB 2094 was drafted with Colorado's SB 24-205 as a model — the core requirements are very similar. Here's where they align and diverge:

Where They're the Same

• Impact assessments required before deployment
• Consumer notice when AI is used in a consequential decision
• Human review must be available for adverse decisions
• Vendor documentation obligations — deployers must get key info from developers
• AG enforcement (no private right of action)
• Small business exemptions (with different thresholds)

Key Differences

• Effective date: Virginia is July 1, 2026 vs. Colorado's June 30 — essentially simultaneous
• Criminal justice coverage: Virginia explicitly addresses AI in bail and sentencing contexts; Colorado does not
• Penalty structure: Virginia penalties are per-violation, with a 30-day cure period (Colorado is 60 days)
• Annual reporting: Colorado requires reporting to the AG; Virginia's reporting obligations are lighter
• Documentation retention: Virginia requires a 3-year retention minimum on impact assessments

Who Is Affected?

You're affected if:

1. You deploy AI that makes or assists in consequential decisions
2. Affected individuals include Virginia residents
3. The AI falls in one of the covered decision domains

Common affected use cases:

• HR software with AI screening for Virginia-based positions
• Insurance underwriting tools used for Virginia policyholders
• Mortgage/loan AI for Virginia properties or borrowers
• Healthcare AI used in Virginia hospitals or telehealth for Virginia patients

What You Need to Do

If you're already building Colorado AI Act compliance:

Good news — you're about 80% of the way there for Virginia. The core documents and processes are the same. You need to:

1. Extend your impact assessments to explicitly cover Virginia consumers
2. Adjust notification templates for Virginia's specific requirements
3. Review Virginia's criminal justice provisions if applicable
4. Align retention schedules to Virginia's 3-year minimum

If you haven't started yet:

Start with Colorado's framework (it's better documented and has more regulatory guidance available), then layer in Virginia-specific differences.

The Bigger Picture

Virginia joining Colorado signals that US state-level AI legislation is now a durable trend — not a one-state experiment. Texas, Connecticut, and Illinois have similar bills in active consideration. If you build a robust compliance program now for Colorado + Virginia, you'll be well-positioned as more states enact similar laws.

Resources

• Free compliance checker — does Virginia HB 2094 apply to you?
• Compare US state AI laws side-by-side
• Find AI governance consultants
• Colorado AI Act compliance guide