2025 · Regular session · House bill
HB5331
HB5331 makes contract language void and unenforceable if it prohibits, restricts or otherwise circumvents a state agency's or local government's compliance with Government Code 2054.603, the security-incident reporting section.
Official caption: Relating to the enforceability of certain state agency and local government contract language regarding required security incident notifications.
Official report lists House author(s): Dean. This does not identify sponsors or amendment drafters.
Bill explanation published · Version and amendment review scope is stated below · Individual amendment records may not be separately annotated.
Bill highlights
Selected points from the published explanation. Follow each point to its source-linked context; conditions and limits may matter.
- HB5331 makes contract language void and unenforceable if it prohibits, restricts or otherwise circumvents a state agency's or local government's compliance with Government Code 2054.603, the security-incident reporting section.
- The governor signed the bill June 20, 2025, and it took effect immediately.
What does it do?
HB5331 makes contract language void and unenforceable if it prohibits, restricts or otherwise circumvents a state agency’s or local government’s compliance with Government Code 2054.603, the security-incident reporting section. This applies to cybersecurity insurance contracts and other contracts for goods or services. It invalidates the conflicting language, not automatically the entire contract. The act expressly says this addition clarifies rather than changes existing law. It does not itself create a new reporting timetable or insurance-payment entitlement. Final law, Sections 1–2.
The governor signed the bill June 20, 2025, and it took effect immediately. The final certificates record House passage 145–0, House concurrence in the Senate changes 115–19, and Senate passage 31–0, meeting the immediate-effect threshold. Official history; final law, Section 3 and certificates.
What changed along the way?
The introduced bill and House committee report already contained the cybersecurity-contract rule and the clarification statement. The final law returns to that narrow substantive text. Introduced; House report; all text versions.
The amendment index lists one floor amendment, offered by Dean and adopted May 7. It added an exception for higher-education institutions from the lease requirement for at least 90 days’ notice before construction, alteration or repair of improvements to leased public property, applying to leases entered into on or after September 1, 2025. It did not remove the reproduced payment/performance-bond provisions. This appeared in the House-passed bill, but the Senate committee substitute removed the lease provisions and restored the cybersecurity-only bill. The House concurred in the Senate changes. The higher-education lease exception was not enacted by HB5331. Amendment index and disposition; complete amendment; House-passed text; Senate substitute; final text.
For the full amendment record, open the official amendment index.
Official bill versions
Compare the published text versions in the official text index. A change is not attributed to a specific amendment here without a verified record.
Who could benefit—and who could bear the costs?
State agencies and local governments gain an explicit statutory answer to contract terms that obstruct required incident reporting. Insurers and vendors cannot enforce those conflicting terms. More reliable compliance may help the government’s response to cyber incidents, but this law does not guarantee fewer attacks, insurance coverage or compensation for affected individuals. These are the direct contract effects and potential practical benefits of Section 1, not measured outcomes.
The final-posted Legislative Budget Board note, dated May 26 and labeled “As Passed 2nd House,” anticipates no significant fiscal implication for the state or local governments and assumes any costs can be absorbed using existing resources. It supplies no dollar estimate, multi-year cost table or individual premium estimate; this is not an appropriation. The introduced note anticipated no fiscal implication; later engrossed and Senate-report notes used the no-significant-impact formulation. Final-posted fiscal note; introduced note; engrossed note; Senate-report note.
Review boundary: all three final sections, history, all indexed text versions, the single indexed floor amendment and its disposition, and all indexed fiscal notes were read and compared. This briefing explains HB5331’s addition; it is not a complete guide to the preexisting incident-reporting section or a prediction of how a court would resolve a particular contract dispute.
Official sources
- Bill history and latest recorded action
- Bill versions, analyses and fiscal notes
- Action history and votes
- Amendment index
Catalog report retrieved 2026-10-25. Check the official record for corrections or later changes.