What applies today to a company in Mexico that uses AI
There is no AI law. There is a data protection law with an authority that already fines, third-party rules in every sector and frameworks that subsidiaries inherit from their parent company.
Three sources of obligation, none of them called an “AI law”
A new authority: the Ministry of Anti-Corruption and Good Governance. Fines of up to 320,000 UMA, double with sensitive data. A right to object to automated decisions without human involvement.
Reference case
A MXN 42.8 million fine against the Mexican Football Federation in July 2026 for processing biometric data without express written consent. The failure was documentation and consent, not a hack.
Banking: prior authorization if data is processed outside Mexico; notice if it stays in the country. Insurance: confidentiality extends to the vendor and the CNSF can audit it. Telecom: 24 months of records under custody.
The EU AI Act for high-risk uses from December 2, 2027. ISO 42001 as the language of auditors and consultancies. SR 26-2 from the Federal Reserve for banks with a US parent.
What applies today
Each row says who imposes it, what it requires and its status.
Every company
Personal data protection In force
Privacy notice; express written consent for sensitive data; proportionate security measures (article 18); immediate breach notice to the data subject (article 19); right to object to automated decisions without human involvement (article 27); confidentiality that survives the contract (article 20).
Penalties In force
Fines of up to 320,000 UMA (about MXN 37.5 million in 2026), double with sensitive data; three months to five years in prison for criminal cases. Reference case: MXN 42.8 million fine against the Mexican Football Federation, July 2026, for biometric data without express consent.
Authorship of generated work Current criterion
Work generated solely by a machine has no copyright; with substantial human participation it may be evaluated. The brand is protected by trademark registration.
Banks and non-bank lenders
Third-party contracting In force
Prior authorization if processing happens outside Mexico; notice if it happens in the country; a contract granting the National Banking and Securities Commission (CNBV) access, audit rights and confidentiality; records kept in Mexico; audits at least every two years.
Banks
Biometric data In force
Biometrics may only be used to authenticate; selling or transferring those databases is prohibited.
Insurance
Third-party contracting In force
Prior authorization for the services the National Insurance and Surety Commission (CNSF) determines; confidentiality extends to the vendor; the Commission can inspect it and suspend the service; documented evidence available.
Fintech
Financial technology institutions In force
Information security, third-party contracting, incident reporting; a mandatory compliance officer.
Telecommunications
Records and line registry In force
Keep 24 months of communication and location records for every line, protected and with no other use; secrecy of communications; a registry tied to the national population ID, CURP (storing biometrics or ID copies is prohibited); incident notice to the Commission and to data subjects; express reference to the data protection law.
Health and pharma
Digital health In force
Digital clinical records with traceability; sanitary registration when software has a clinical function; health data is sensitive.
Public sector as a client
Processors and cloud In force
A processor contract with seven minimum clauses; explicit rules for cloud services; subcontracting only with authorization.
Media and brands
Performers’ voice and image In force
Prior, written and paid consent to use a performer’s voice or image through AI.
Subsidiaries of European groups
EU AI Act In force in the EU
For high-risk uses (credit scoring, life and health insurance pricing, employment): risk management, data governance, technical documentation, event logging and human oversight. Applicable from December 2, 2027.
And what we say instead
A general AI law Does not exist
There is a draft bill in the Senate with no committee report, which also requires a prior constitutional amendment; 85 bills since 2023, 67 pending (Universidad Anáhuac, July 2026).
There is no AI law. There are bills, a government plan and a data protection authority that already fines. What you build today with an evidence file will comply tomorrow.
A national AI agency Does not exist
Proposed in a February 2026 bill, still in committee.
Not mentioned.
National AI Plan (2026) A plan, not a law
Public policy for the federal government; it proposes an “AI Factory” and principles of human oversight and explainability. It is not published in the Official Gazette and imposes no obligations on private companies.
The government’s vocabulary already matches ours.
An AI circular from the CNBV, CNSF or Bank of Mexico Does not exist
The Bank of Mexico published a diagnosis in June 2026: it recommends explainability, independent audits, vendor oversight and human appeal. It is a diagnosis, not a rule.
Your regulator has already said what it will ask for. We deliver it from phase 1.
Mandatory impact assessment Not for private companies
It is mandatory for public sector bodies.
It is not mandatory. We do it and Legal signs it because it turns an AI project into a company project.
AI regulation in human resources In progress
A June 2026 bill in committee: impact assessment, notice to workers, a ban on high-impact decisions made only by machines.
An agent that organizes and summarizes candidates without rejecting them already meets what the bill proposes.
New regulations for the data protection law Not found in the Official Gazette
The 2025 law required updated regulations within 90 days; the 2011 regulations remain listed and apply where they do not contradict the law.
We cite the law. Processor obligations are taken from the 2011 regulations.
What Legal and compliance ask
Is there an AI law in Mexico that companies must comply with?
No. Mexico has no general AI law: the Senate draft has no committee report and first requires a constitutional amendment. What does apply: the 2025 data protection law, with an authority that already fines, and each sector’s third-party contracting rules.
How are data subject rights and the right to object to automated decisions handled?
No agent decides alone: it gathers, organizes and hands off, and a person reviews before any effect on a customer or an employee. That meets article 27 of Mexico’s data protection law by design. The audit log shows which data each answer consulted, to handle access, rectification, cancellation or objection requests (ARCO rights).
What happens if there is a data breach in the system?
The incident response protocol in the evidence file kicks in: what counts as an incident, severity levels, response times, who shuts the system down, communication to compliance and to the authority, and a post-incident review. The law requires notifying the data subject immediately. We don’t promise it won’t happen; we promise what happens if it does.
What data leaves my perimeter when I use private AI?
None, when the model runs on your hardware inside a segmented network with no internet egress. Sensitive and confidential data is processed inside the perimeter, without exception. Internal, non-sensitive data may use an enterprise cloud with zero retention only if compliance approves. Public data stays free.
Primary sources
- Federal Law on the Protection of Personal Data Held by Private Parties (current text, Spanish)
- Telecommunications and Broadcasting Law (current text, Spanish)
- Federal Reserve, OCC and FDIC: SR 26-2, guidance on model risk management (April 17, 2026)
- Secihti and ATDT: Chapultepec Principles (January 29, 2026, Spanish)
What we could not confirm as of November 1, 2026: new regulations for the data protection law; the consolidated text of articles 318, 326 and 328 of the Single Banking Circular; the compliance period of the biometrics reform; COFEPRIS’s criterion on clinical assistants. We only say “verified” about what we read in the primary source.
Discovery sessions, no commitment
With technology, compliance and two process owners. Includes an offline demonstration prepared for your sector, without using your company’s data.
Inventory and obligations
Data in four levels and a first review of what your sector requires.
Three candidate use cases
And the Assessment proposal. The Discovery is credited against the Assessment.
Founding clients program
Three seats, with an explicit discount in exchange for a publishable case and a reference.
Terms
Discovery and evidence pilot at no cost, Assessment at a discount, in exchange for a publishable case, a reference and feedback. Continuous operation is always paid at list price.