Mexico - Criminal Code Reform on AI (2025)

Overview

The initiative "Que reforma y adiciona diversas disposiciones del Código Penal Federal y de la Ley Federal del Derecho de Autor, en materia de inteligencia artificial generativa" was filed in the Cámara de Diputados on April 30, 2025 by Deputy Víctor Manuel Pérez Díaz (PAN). It introduces a dedicated chapter in the Código Penal Federal to criminalize the "improper use" of generative AI tools (including deepfakes, unauthorized biometric extraction/use, dissemination of illicitly obtained private/confidential material, and fraudulent registration/presentation of AI autonomous outputs as human creations). Parallel amendments to the Ley Federal del Derecho de Autor would create a new classification of works "according to the technology used for their creation," explicitly recognizing "AI-assisted" creations while excluding from protection autonomous AI outputs that (i) infringe pre-existing rights, (ii) were generated without authorization for incorporated materials, or (iii) fail to transparently identify sources, the technology used, and human authors. The text of the initiative is publicly available in the Gaceta Parlamentaria: Gaceta Parlamentaria, 30 April 2025.

Definitions

The bill provides operational definitions that are central to enforcement. It defines "tools based on generative artificial intelligence" as systems that, with broad autonomy and without substantial and decisive human intervention, create content (text, images, audio, video, software code) using deep-learning models in response to commands. "Improper use" is defined via a closed list including: (a) deliberate, deceptive manipulation of audiovisual content intended to cause harm or mislead decision-making; (b) exploitation of facial recognition data or remote biometric identification sourced non-selectively from the internet or CCTV; (c) dissemination of confidential/reserved information or media illegally obtained; and (d) presenting AI-generated works as human-authored to obtain registration or commercialization while concealing sources or violation of third-party rights. These definitions aim for legal precision to distinguish permissible AI-assisted creativity from harms and frauds.

Governance and Institutional Framework

Implementation and enforcement would engage multiple institutions. Criminal provisions will be prosecuted through Mexico's ordinary justice system and require capacity-building among Ministerio Público and forensic units to investigate AI-enabled fabrications and biometric misuse. The copyright amendments implicate the Instituto Nacional del Derecho de Autor (INDAUTOR), the administrative body that maintains the public registry of copyright and issues certificates; INDAUTOR would need to update registration rules and administrative forms to require disclosure of AI assistance and sources. The initiative references international instruments and proposes an alignment-oriented approach similar to risk-based models (for example the EU's AI regulatory approach); further institutional coordination with the Secretaría de Cultura, Secretaría de Gobernación, and data protection authority (INAI) would be expected. The initiative text is published in the legislature's Gaceta: Gaceta Parlamentaria, and would require administrative guidance from INDAUTOR (Instituto Nacional del Derecho de Autor) for registration practice adjustments.

Key Focus Areas

The initiative targets a constellation of policy priorities: (1) Protecting identity, privacy and dignity by criminalizing non-consensual generation and dissemination of deepfakes and biometric misuse; (2) Safeguarding copyright and market integrity by preventing fraudulent registration or commercialization of autonomous AI outputs that use protected material without authorization; (3) Promoting transparency and authorship attribution by requiring creators to disclose AI assistance and sources; (4) Establishing enforceable sanctions (prison and fines) to deter harmful uses; and (5) Promoting alignment with international standards and best practices—its risk-awareness echoes the EU risk-based model and international guidance from institutions like WIPO/UNESCO and the OECD. The bill is deliberately narrow in scope for criminalization (targeting manipulative and harmful conduct rather than broad bans on technology), while the copyright provisions create a technology-based taxonomy ("AI-assisted" vs "autonomous generative AI") to calibrate protection and incentives for human creativity.

Implementation Framework

Operationalizing the reforms would require: (a) legislative adoption and publication in the Diario Oficial; (b) rulemaking and administrative guidance from INDAUTOR on registration forms, disclosure requirements and evidentiary standards for AI assistance; (c) capacity-building for prosecutors, courts and forensic labs in AI provenance, media forensics and biometric data tracing; (d) coordination protocols between INAI (National Institute for Transparency, Access to Information and Protection of Personal Data), INDAUTOR and law enforcement for cases implicating data protection or privacy breaches; and (e) engagement with platforms and intermediaries to establish notice-and-takedown, content labelling, and provenance metadata practices. For international comparators see the EU AI Act overview: AI Act documents and the Council press release Council (21 May 2024).

Monitoring and Evaluation

Monitoring will require qualitative and quantitative indicators: number and outcome of prosecutions under the new Penal provisions; INDAUTOR statistics on registrations flagged as AI-assisted or refused under the exclusion; platform takedown metrics; incidence of reported non-consensual deepfakes and biometric abuses; and case law developments. Periodic evaluation could be mandated (e.g., annual public reports by INDAUTOR and the Attorney General's Office on enforcement and trends). Independent oversight and stakeholder consultations (creators, rights organizations, civil-society privacy groups, tech providers) would be essential to refine definitions and minimize chilling effects on legitimate AI-assisted creativity. International guidance from UNESCO and OECD is relevant for evaluation frameworks: UNESCO guidance on generative AI in education and research is available via UNESCO, and OECD AI Principles via OECD.

Penalties, Liability, and Appeals

The initiative sets criminal penalties for prohibited conduct: imprisonment from six months to four years and fines of 100 to 600 days (as drafted in Article 211 Bis 10). The copyright changes include substantive exclusions from protection but do not create new civil remedies in the draft; standard civil claims (infringement, unfair competition, moral damage) would remain available. Defendants would retain criminal procedural rights and appeals through the ordinary judicial system; administrative review mechanisms would apply to registration denials by INDAUTOR. Penalties are framed to deter manipulative, deceptive commercial or reputational harms rather than to penalize ordinary creative assistance. Prosecutorial discretion and proportionality will determine how broadly the criminal provisions are applied in practice.

Relationship to Other Instruments

The initiative complements and intersects with existing national laws and international standards. It amends the Código Penal Federal and the Ley Federal del Derecho de Autor, and will interact with Mexico's data-protection framework (Federal Law on Protection of Personal Data Held by Private Parties and INAI oversight), telecommunications and intermediary liability regimes, and sectoral rules (e.g., electoral law, Penal provisions covering defamation or sexual offences). It references international regulatory developments (EU AI Act) and guidance from WIPO and UNESCO. Where conflicts or overlaps occur (for example between evidence rules for registration and data-protection constraints), inter-agency guidance and judicial interpretation will be necessary to reconcile obligations. The initiative also invites updates to administrative practice by INDAUTOR and potential secondary regulations to operationalize disclosure and registration rules.

International Alignment

The bill explicitly cites and aligns with international trends favoring risk-based regulation for AI and strengthened protections against identity-based harms. It references the EU model of risk-tiered obligations for AI, as well as WIPO and UNESCO analyses on AI and copyright. Its approach—criminalizing harmful manipulative uses while clarifying copyright treatment for AI-assisted versus autonomous outputs—mirrors debates in other jurisdictions (United States Copyright Office guidance, EU AI Act obligations for transparency and high-risk categories, and Beijing/China court rulings on AI-generated images). For context: see EU AI Act documentation (AI Act documents), WIPO analyses on AI and copyright, and INDAUTOR materials on copyright registration (INDAUTOR).

Implementation Timeline

Sources and References