Is there an AI law in Mexico that companies must comply with?
No. Mexico has no general AI law: the Senate draft has no committee report and first requires a constitutional amendment. What does apply: the 2025 data protection law, with an authority that already fines, and each sector’s third-party contracting rules.
85 bills have been filed since 2023, 67 still pending (Universidad Anáhuac, July 2026). The 2026 National AI Plan is a government plan, not a law, and imposes no obligations on private companies.
Reference case from the data protection authority: a MXN 42,849,095 fine against the Mexican Football Federation, announced by the Ministry of Anti-Corruption and Good Governance on July 12, 2026, for processing biometric data without express written consent.
Sources
- Mexico’s data protection law, Official Gazette, March 20, 2025.
- Regulatory map verified by DEBIR as of November 1, 2026.
Regulatory framework verified against primary sources on November 1, 2026.
- What data leaves my perimeter when I use private AI?
- Do you use our customers’ data to train the model?
- How are data subject rights and the right to object to automated decisions handled?
- What happens if there is a data breach in the system?
- How is the system isolated from the internet and the public cloud?
Discovery sessions, no commitment
With technology, compliance and two process owners. Includes an offline demonstration prepared for your sector, without using your company’s data.
Inventory and obligations
Data in four levels and a first review of what your sector requires.
Three candidate use cases
And the Assessment proposal. The Discovery is credited against the Assessment.
Founding clients program
Three seats, with an explicit discount in exchange for a publishable case and a reference.
Terms
Discovery and evidence pilot at no cost, Assessment at a discount, in exchange for a publishable case, a reference and feedback. Continuous operation is always paid at list price.