CS/HB 925 2025
CODING: Words stricken are deletions; words underlined are additions.
hb925-01-c1
Page 1 of 5
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
A bill to be entitled 1
An act relating to threats from foreign nations; 2
creating part IV of ch. 692, F.S. , entitled 3
"Protection of State Critical Infrastructure from 4
Foreign Entities"; creating s. 692.21, F.S.; providing 5
a short title; defining terms; prohibiting specified 6
entities and governmental entities from entering into 7
specified contracts or agreements with a foreign 8
principal; prohibiting a foreign principal from 9
entering into specified contracts or agreements with 10
specified entities and governmental entities; 11
providing a criminal penalty; requiring specified 12
entities that have entered into a specified contract 13
or agreement with a foreign principal to register with 14
the Department of Commerce by a specified date; 15
requiring the department to adopt a specified 16
registration form; providing a civil penalty; 17
requiring an entity selling or transferring control of 18
specified critical infrastructure to provide an 19
affidavit to the department attesting to specified 20
information; prohibiting computer software produced or 21
manufactured by specified companies from being used in 22
critical infrastructure located within or serving this 23
state; requiring the department to adopt rules; 24
providing an effective date. 25
CS/HB 925 2025
CODING: Words stricken are deletions; words underlined are additions.
hb925-01-c1
Page 2 of 5
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
26
Be It Enacted by the Legislature of the State of Florida: 27
28
Section 1. Part IV of chapter 692, Florida Statutes, 29
consisting of s. 692.21, Florida Statutes, is created and 30
entitled "Protection of State Critical Infrastructure from 31
Foreign Entities." 32
Section 2. Section 692.21 Florida Statutes, is created to 33
read: 34
692.21 Protection of state critical infrastructure from 35
foreign entities.— 36
(1) SHORT TITLE.—This section may be cited as the "Florida 37
Critical Infrastructure Protection Act ." 38
(2) PURPOSE.—The purpose of this section is to protect 39
this state's critical infrastructure by prohibiting foreign 40
adversaries from accessing or controlling such critical 41
infrastructure. 42
(3) DEFINITIONS.—As used in this section, the term: 43
(a) "Computer software" means any information, program, or 44
routine, or any collection of information or set of one or more 45
programs or routines , used or intended to be used to convey 46
information or to cause one or more computers or pieces of 47
computer-related peripheral equipment, or any combination 48
thereof, to perform a task or set of tasks. 49
(b) "Critical infrastructure" has the same meaning as in 50
CS/HB 925 2025
CODING: Words stricken are deletions; words underlined are additions.
hb925-01-c1
Page 3 of 5
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
s. 692.201(2). 51
(c) "Department" means the Department of Commerce. 52
(d) "Foreign country of concern" has the same meaning as 53
in s. 692.201(3). 54
(e) "Foreign principal" has the same meaning as in s. 55
692.201(4). 56
(4) PROHIBITED ACCESS TO INFRASTRUCTURE. — 57
(a) An entity constructing, repairing, operating, or 58
otherwise having significant access to critical infrastructu re 59
may not enter into a contract or other agreement relating to 60
critical infrastructure within this state with a foreign 61
principal if the contract or agreement authorizes the foreign 62
principal to directly or remotely access or otherwise control 63
such critical infrastructure. 64
(b) A governmental entity may not enter into a contract or 65
other agreement relating to critical infrastructure within this 66
state with a foreign principal if the contract or agreement 67
authorizes the foreign principal to directly or remotely access 68
or otherwise control such critical infrastructure. 69
(c) A foreign principal may not enter into a contract or 70
other agreement relating to critical infrastructure within this 71
state with an entity constructing, repairing, operating, or 72
otherwise having significant access to critical infrastructure, 73
or a governmental entity , if the contract or agreement 74
authorizes the foreign principal to directly or remotely access 75
CS/HB 925 2025
CODING: Words stricken are deletions; words underlined are additions.
hb925-01-c1
Page 4 of 5
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
or otherwise control such critical infrastructure. 76
(5) PENALTY.—A person or entity that violates subsection 77
(4) commits a misdemeanor of the second degree, punishable as 78
provided in s. 775.082 or s. 775.083. 79
(6) REGISTRATION.— 80
(a) Beginning January 1, 2026, an entity constructing, 81
repairing, operating, or otherwise having signi ficant access to 82
critical infrastructure within this state which entered into a 83
contract or other agreement with a foreign principal relating to 84
such critical infrastructure before July 1, 2025, must register 85
by January 1 of each year for the remainder of the term of the 86
contract or agreement with the foreign principal relating to 87
such critical infrastructure. The department must adopt a 88
registration form, which, at minimum, must include all of the 89
following: 90
1. The name of the entity constructing, repair ing, 91
operating, or otherwise having significant access to critical 92
infrastructure within this state. 93
2. The address of the critical infrastructure the entity 94
is constructing, repairing, or operating or to which the entity 95
otherwise has significant access . 96
3. A description of the specific terms of the contract or 97
agreement which authorize a foreign principal to engage in 98
constructing, repairing, or operating or to otherwise have 99
significant access to such critical infrastructure. 100
CS/HB 925 2025
CODING: Words stricken are deletions; words underlined are additions.
hb925-01-c1
Page 5 of 5
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
(b) An entity that vi olates paragraph (a) is subject to a 101
civil penalty of $1,000 for each day the violation continues. 102
(7) REQUIRED AFFIDAVIT.—Before commencing any sale or 103
other transfer of control of critical infrastructure within this 104
state, the entity selling or otherw ise transferring control of 105
such critical infrastructure must provide an affidavit , signed 106
under penalty of perjury , to the department attesting that the 107
buyer or transferee is not a foreign principal. 108
(8) PROHIBITIONS ON CERTAIN COMPUTER SOFTWARE IN CRITICAL 109
INFRASTRUCTURE.—Computer software produced or manufactured by a 110
company headquartered in and subject to the laws of a foreign 111
country of concern, or a company under the direction or control 112
of a foreign country of concern , may not be used in criti cal 113
infrastructure located within or serving this state. 114
(9) RULEMAKING.—The department shall adopt rules to 115
implement this section. 116
Section 3. This act shall take effect July 1, 2025. 117