HB 5330 Michigan House · 2025-2026 Regular Session

Aeronautics: unmanned aircraft systems; cybersecurity and data protection requirements for drones; provide for. Amends 2016 PA 436 (MCL 259.301 - 259.331) by adding sec. 16.

HB 5330 requires Michigan public entities (like government agencies) and their contractors to meet strict cybersecurity and data protection standards for small drones (under 55 pounds). It mandates that all collected data (including videos, photos, and personal information) must be stored within the U.S., encrypted with AES-256, and automatically deleted after 45 days unless law enforcement needs it. The bill also requires annual security audits using NIST, ISO 27001, and SOC 2 standards, plus real-time monitoring for cyber threats. The State Police will create regulations to enforce these rules, including network security controls and operator training.

Issues: ✓ Technology

Bill status passed 3 of 5 stages cleared

Introduction

Dec 2025

Committee Review

Mar 2026

House Passage

May 2026

Senate Passage

Governor

Introduced Dec 2, 2025 Last action May 12, 2026

Maddy AI version diff · 1 comparison

What changed between versions

House Introduced Bill → Substitute (H-1) · 3 edits

MINOR

The bill was amended to add specific cybersecurity standards that public entities must meet when using small drones. The changes replace a general requirement for compliance with federal guidelines with mandatory adherence to the NIST Cybersecurity Framework 2.0, ISO 27001, and SOC 2. Additionally, the requirement for security audits was slightly modified to require demonstrating compliance rather than just conducting the audits.

Scope change

The scope of the bill remains the same regarding which entities (public entities and their contractors) and which devices (small unmanned aircraft systems) are covered, but the technical requirements for those entities have become more specific.

REQUIREMENT

Added mandatory compliance with three specific cybersecurity standards: NIST Cybersecurity Framework 2.0, ISO 27001, and SOC 2.

Changed the security audit requirement from simply conducting annual audits to demonstrating proof of compliance with the listed standards.

Removed a requirement for the Department of State Police to establish regulations or guidance for implementing the section.

Floor votes

How they voted

This bill passed the House by voice vote (no roll call recorded).

Full legislative history

Actions timeline

Total actions

Key actions

Committee

May 12, 2026

Lower · Passed

substitute (H-1) adopted

lower

Mar 10, 2026

Committee

referred to second reading

lower

Mar 10, 2026

Lower · Passed

reported with recommendation with substitute (H-1)

lower

Dec 2, 2025

Committee

referred to Committee on Transportation and Infrastructure

lower

Dec 2, 2025

Introduced

introduced by Representative Rep. Ron Robinson

lower

1 primary · 24 co-sponsors