AI Regulation in Mexico: 2026 Update

AI regulation in Mexico is evolving rapidly. The country currently lacks a single, comprehensive federal AI statute, but a growing body of sector-specific rules, constitutional principles, and a draft federal AI law together create a framework that businesses operating in Mexico must understand. Companies deploying AI systems in financial services, healthcare, data processing, and consumer-facing applications already face concrete compliance obligations. This guide covers the current regulatory landscape, the key authorities involved, sector-specific requirements, recent legislative developments, practical compliance steps, and what international businesses should anticipate as Mexico';s AI governance matures.

Mexico does not yet have a standalone federal AI law in force. What exists instead is a layered set of obligations drawn from the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), the Federal Consumer Protection Law (LFPC), the National Banking and Securities Commission (CNBV) guidelines, and sector-specific regulations issued by bodies such as the Federal Telecommunications Institute (IFT) and the National Insurance and Bonding Commission (CNSF).

The LFPDPPP, enforced by the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), is the most directly relevant statute for AI systems that process personal data. Any AI model trained on or making decisions about Mexican residents'; personal data must comply with LFPDPPP';s principles of consent, purpose limitation, data minimisation, and accountability. Automated decision-making that produces legal or similarly significant effects on individuals triggers heightened obligations, including the right of the data subject to request human review.

The Federal Consumer Protection Law, enforced by PROFECO, applies when AI systems interact with consumers - for example, in chatbots, recommendation engines, or automated pricing tools. Businesses must ensure that AI-driven commercial communications are not deceptive, that pricing is transparent, and that consumers are not subjected to discriminatory treatment through algorithmic profiling.

In practice, many foreign companies underestimate the reach of INAI';s enforcement authority. INAI can investigate, sanction, and order the suspension of data processing activities, including those driven by AI. Fines under the LFPDPPP can reach several million Mexican pesos, and reputational consequences in a market of this size are significant.

Several federal bodies share oversight of AI-related activities in Mexico, each with a distinct mandate.

INAI is the primary authority for AI systems that process personal data. It issues binding guidelines, conducts audits, and adjudicates complaints from data subjects. INAI has published non-binding recommendations on algorithmic transparency and automated decision-making, which, while not legally enforceable on their own, signal the direction of future binding rules.

The CNBV supervises AI use in the financial sector, including credit scoring models, fraud detection systems, and robo-advisory platforms. Financial institutions must disclose the use of automated models in credit decisions and maintain model risk management frameworks that satisfy CNBV';s circulars. A common mistake among fintech companies entering Mexico is treating CNBV guidance as aspirational rather than as a compliance baseline with real enforcement consequences.

The IFT regulates AI applications in telecommunications and broadcasting. As AI-generated content and algorithmic content curation become more prevalent, the IFT';s mandate over media plurality and consumer protection intersects directly with AI deployment by platforms and broadcasters.

The Federal Competition Economic Commission (COFECE) has signalled interest in algorithmic collusion and AI-driven pricing practices. While no AI-specific competition rule is yet in force, COFECE';s existing powers under the Federal Economic Competition Law allow it to investigate and sanction anticompetitive conduct facilitated by AI systems.

The Ministry of Health (Secretaría de Salud) and COFEPRIS regulate AI-driven medical devices and diagnostic tools. Software that qualifies as a medical device under Mexican law requires registration and conformity assessment, regardless of whether the intelligence embedded in it is artificial or conventional.

The most significant recent development in ai regulation mexico is the introduction of a draft federal AI law in the Mexican Congress. The proposal, which has been under active discussion, draws inspiration from the European Union';s risk-based approach while adapting it to Mexico';s constitutional framework and economic priorities.

The draft introduces a risk classification system. AI systems would be categorised as unacceptable risk, high risk, limited risk, or minimal risk, with obligations scaled accordingly. High-risk categories under the proposal include AI used in critical infrastructure, education, employment decisions, essential private services, law enforcement, and administration of justice. Providers and deployers of high-risk AI systems would face conformity assessments, mandatory human oversight mechanisms, transparency obligations, and registration with a designated federal authority.

A constitutional dimension also shapes the debate. Mexico';s Constitution recognises the right to non-discrimination, privacy, and access to justice. Legislators and academics have argued that AI systems capable of producing discriminatory outcomes or opaque decisions that affect fundamental rights must be governed by constitutional principles, not merely by ordinary legislation. This framing elevates AI governance from a technical compliance matter to a constitutional one, with implications for judicial review of AI-driven government decisions.

The draft law also addresses AI in the public sector. Federal agencies that deploy AI for administrative decisions - tax assessments, social benefit eligibility, immigration processing - would be required to publish algorithmic impact assessments and maintain audit trails. This is a non-obvious requirement that many technology vendors supplying government clients have not yet factored into their contracts.

Many underestimate how quickly the legislative process can accelerate once political consensus forms. Businesses should treat the draft law as a near-term compliance horizon, not a distant aspiration.

If you are assessing how the proposed framework affects your operations in Mexico, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Beyond the general framework, several sectors already impose concrete AI-related obligations that businesses must address today.

Financial services and fintech. The CNBV';s model risk management circulars require financial institutions to document, validate, and monitor quantitative models, including machine learning models used in credit, market risk, and fraud detection. The Fintech Law (Ley para Regular las Instituciones de Tecnología Financiera) requires electronic payment institutions and crowdfunding platforms to disclose algorithmic decision-making to users and to CNBV. A non-obvious requirement is that model documentation must be maintained in Spanish and be available for regulatory inspection within defined timeframes.

Healthcare and medical devices. AI-powered diagnostic software, clinical decision support tools, and wearable health monitors that meet COFEPRIS';s definition of a medical device require sanitary registration. The registration process involves technical dossiers, clinical evidence, and post-market surveillance plans. Foreign manufacturers must appoint a Mexican legal representative and ensure labelling complies with Mexican Official Standards (NOMs).

Telecommunications and digital platforms. The IFT';s guidelines on must-carry, must-offer, and content diversity obligations apply to platforms that use algorithmic curation to determine what content users see. While these rules were not designed with AI in mind, their application to recommendation systems is increasingly recognised by the IFT. Platforms with significant market presence in Mexico should assess whether their content algorithms trigger IFT oversight.

Employment and HR technology. Mexico';s Federal Labour Law (Ley Federal del Trabajo) prohibits discrimination in hiring, promotion, and termination. AI-driven HR tools that produce discriminatory outcomes - even unintentionally - expose employers to labour claims and INAI investigations. Employers using automated screening or performance management tools should conduct bias audits and document the results.

Consumer-facing AI. PROFECO';s enforcement of the LFPC against deceptive AI-generated advertising and manipulative chatbot practices is increasing. Businesses must ensure that AI systems interacting with consumers identify themselves as automated when asked, do not make false claims, and do not exploit consumer vulnerabilities through personalised manipulation.

Businesses deploying AI in Mexico should approach compliance as a structured programme rather than a one-time exercise. The following steps reflect current obligations and anticipated requirements under the draft federal law.

Conduct an AI inventory. Map all AI systems in use across the organisation, including third-party tools embedded in software-as-a-service products. Identify which systems process personal data of Mexican residents, make automated decisions affecting consumers or employees, or operate in regulated sectors. This inventory is the foundation of every subsequent compliance step.

Assess data protection obligations under LFPDPPP. For each AI system that processes personal data, verify that a valid legal basis exists, that privacy notices are accurate and accessible, and that data subject rights - including the right to human review of automated decisions - can be exercised in practice. INAI';s published criteria on automated decision-making should guide this assessment.

Implement model documentation and governance. Financial institutions must already do this under CNBV circulars. Other businesses should adopt equivalent practices voluntarily, both because the draft federal law will likely require it and because documented governance reduces liability exposure in the event of an adverse outcome.

Review contracts with AI vendors and cloud providers. Data processing agreements must comply with LFPDPPP';s requirements for data processors. Contracts should address model transparency, audit rights, incident notification, and data localisation where applicable. Many standard vendor contracts do not meet Mexican requirements without amendment.

Prepare for algorithmic transparency obligations. Both the draft federal law and INAI';s recommendations point toward mandatory disclosure of how AI systems make decisions that affect individuals. Businesses should begin documenting model logic, training data sources, and validation results in a form that can be disclosed to regulators and, where required, to affected individuals.

Monitor legislative developments. The draft federal AI law is subject to amendment and the timeline for enactment remains uncertain. Businesses should assign responsibility for tracking legislative progress and assessing the impact of new provisions on existing AI deployments.

In practice, founders and compliance officers should consider engaging local legal counsel early in the AI deployment lifecycle, not after a regulatory inquiry has been opened.

Mexico';s emerging AI framework sits at an interesting intersection of international influences. The EU AI Act, which entered into force in the EU and is being phased in progressively, has directly influenced the risk-based architecture of Mexico';s draft federal law. However, Mexico';s approach reflects its own constitutional traditions, economic development priorities, and the practical capacity of its regulatory institutions.

Unlike the EU AI Act, Mexico';s draft does not currently propose a dedicated AI supervisory authority with independent enforcement powers. Instead, oversight would be distributed among existing bodies - INAI, CNBV, IFT, COFEPRIS, and others - coordinated through an inter-agency mechanism. This distributed model has the advantage of leveraging existing expertise but risks creating gaps and inconsistencies in enforcement.

Mexico is also a signatory to the United States-Mexico-Canada Agreement (USMCA), which contains provisions on digital trade, data flows, and algorithmic transparency. The USMCA';s digital trade chapter prohibits forced disclosure of source code and proprietary algorithms as a condition of market access, which creates a tension with transparency obligations under domestic AI regulation. Businesses operating across the USMCA region should assess how these treaty commitments interact with Mexican compliance requirements.

The OECD AI Principles, which Mexico has endorsed as an OECD member, provide a soft-law reference point for responsible AI development. While not legally binding, OECD principles inform the positions of Mexican regulators and legislators and are increasingly cited in regulatory guidance.

A practical scenario: a US-based company deploying an AI-driven credit scoring model for Mexican consumers must simultaneously satisfy CNBV model risk requirements, LFPDPPP data protection obligations, USMCA source code protection provisions, and the transparency expectations set by OECD principles. Navigating this multi-layered environment requires coordinated legal and technical advice.

A second practical scenario: a European healthtech company seeking to market an AI diagnostic tool in Mexico must obtain COFEPRIS sanitary registration, appoint a Mexican legal representative, comply with relevant NOMs, and assess whether the tool falls within the high-risk category of the draft federal AI law. The registration process alone can take several months, and companies that begin the process late risk missing commercial launch windows.

For a detailed assessment of how current and upcoming AI rules apply to your specific business model in Mexico, contact info@vlolawfirm.com. We can assist with documents, filings, and regulatory strategy.

What are the main legal risks for a company deploying AI in Mexico today?

The most immediate risks arise under the LFPDPPP if AI systems process personal data without a valid legal basis or fail to honour data subject rights, including the right to human review of automated decisions. INAI has enforcement authority and can impose significant fines and order suspension of processing activities. In the financial sector, CNBV can sanction institutions that deploy undocumented or inadequately governed models. Consumer-facing AI that misleads or manipulates users exposes companies to PROFECO enforcement under the LFPC. Employment-related AI that produces discriminatory outcomes creates labour law liability. The combined exposure across these frameworks is substantial, and the absence of a single AI law does not mean the absence of real risk.

How long does it take to achieve AI compliance in Mexico, and what does it cost?

The timeline and cost depend heavily on the complexity of the AI systems involved and the sectors in which they operate. A basic data protection compliance review for a single AI application typically takes several weeks and involves legal analysis, privacy notice updates, and data processing agreement amendments. Full model governance documentation for a financial institution can take several months. COFEPRIS sanitary registration for an AI medical device is a multi-month process with technical and administrative requirements. Professional fees for legal and compliance work vary by scope, but businesses should budget at least low to mid-range professional service costs for a meaningful compliance programme. Investing in compliance early is consistently less expensive than responding to a regulatory investigation.

Should a business wait for the federal AI law to be enacted before taking compliance steps?

No. Current obligations under the LFPDPPP, CNBV circulars, the Fintech Law, the Federal Labour Law, and the LFPC already apply to AI systems in operation today. Waiting for the federal AI law creates compounding risk: companies that have not built compliance infrastructure will face a compressed implementation timeline once the law is enacted, while simultaneously remaining exposed to enforcement under existing rules. The draft law';s risk-based architecture also rewards companies that have already documented their AI systems and governance processes, since that documentation will form the basis of conformity assessments under the new framework. Starting now is both a risk management measure and a competitive advantage.

Mexico';s AI regulatory environment is active and consequential. Existing laws already impose real obligations on companies using AI to process personal data, serve consumers, operate in financial services, or deploy medical technology. The draft federal AI law signals a more structured, risk-based framework ahead. Businesses that build compliance programmes now will be better positioned to adapt as the framework matures.

VLO Law Firms advises international clients on AI regulation in Mexico. We can assist with data protection compliance, model governance frameworks, COFEPRIS registration strategy, regulatory monitoring, and preparation for obligations under the draft federal AI law. To request a consultation, contact: info@vlolawfirm.com