Mexico - Digital Governance Framework (2023)

Overview

The Proyecto de Ley Federal de Gobernanza Digital proposes the creation of a Sistema Nacional de Gobernanza Digital to coordinate the policies, actors, infrastructure and assets that form the federal government’s digital environment. The initiative, published in the Gaceta Parlamentaria (26 Sep 2023) and a subsequent version in the Gaceta Parlamentaria (6 Nov 2023), articulates objectives to regulate the management and maintenance of digital assets, promote their use for social and economic development, and require the creation and publication of a national catalog of digital assets. It situates the Coordinación de Estrategia Digital Nacional (CEDN) and the Secretaría de la Func ión Pública (SFP) as central actors and connects the System to existing digital strategy instruments such as the Estrategia Digital Nacional 2021-2024 (DOF). The bill is designed to consolidate governance, improve security and promote reuse of government digital resources while ensuring accountability under the Ley General de Responsabilidades Administrativas.

Definitions

The bill sets clear definitions for its scope. Key definitions include: "digital asset" (activo digital) as any resource that exists or is generated in digital form and held by a responsible authority (websites, mobile apps, databases, images, video, software, cloud services); "administration public" covering the federal administration including centralised, decentralised entities and state productive enterprises; "governance digital" as the linkage of policies, authorities and technological infrastructure to optimize resources and generate public value; and "infrastructure digital" as the set of digital assets under federal control. The definitions align with terms used in current federal agreements and manuals governing ICT and information security, and explicitly reference the CEDN's role and the System's components (CITICSI, Council and Technical Committees).

Governance and Institutional Framework

The System is structured to include three primary components: the Intersecretarial Commission for ICT and Information Security (CITICSI), a Council Consultivo de Gobernanza Digital, and specialized Technical Committees. The Coordinación de Estrategia Digital Nacional (CEDN), attached to the Office of the Presidency, is given coordinating authority to issue general provisions and approve the System’s strategic instruments. The draft gives the Secretaría de la Func ión Pública (SFP) oversight and sanctioning interface responsibilities and reserves procurement and acquisition policy roles to the Secretaría de Hacienda y Crédito Público (SHCP) in coordination with the SFP. The bill also requires stakeholder participation mechanisms and aligns the functioning of the System with applicable programmatic instruments and budget availability. See the official publication in the Gaceta Parlamentaria (6 Nov 2023) for the full organizational text.

Key Focus Areas

The draft concentrates on several interrelated focus areas: (1) Asset management – creation of a National Catalogue of Digital Assets and annual programs for use and exploitation; (2) Security and sovereignty – embedding information security and technological sovereignty as core principles in line with the Estrategia Digital Nacional; (3) Efficiency and anti-corruption – optimizing digital resources under principles of austerity and transparency; (4) Interoperability and reuse – promoting reuse of government code and services where appropriate; (5) Procurement and acquisition policy alignment – directing SHCP and SFP to issue or align acquisition criteria with the System’s goals; (6) Participation and inclusion – implementing mechanisms to include users and civil society; (7) Oversight and accountability – linking noncompliance by public servants to the Ley General de Responsabilidades Administrativas. These focus areas map to existing instruments such as the Estrategia Digital Nacional 2021-2024 and existing administrative accords regulating ICT and security.

Implementation Framework

Implementation relies on three primary instruments: a Program Estratégico del Sistema Nacional de Gobernanza Digital (strategic program), an Estrategia Nacional de Gobernanza Digital (national strategy), and an Annual Program for Use and Exploitation of Digital Assets. The Commission (CITICSI) will approve the programs after soliciting opinions from relevant instances; once approved, the strategic program and national strategy must be published in the Diario Oficial de la Federación and are mandatory for federal dependencies and entities, subject to budget availability. The bill delegates to the CEDN the issuance of general provisions and technical guidelines to standardize classifications, cataloguing, security baselines and reporting templates. The bill also contemplates technical committees to develop specialized standards and a consultative council to incorporate multi-stakeholder perspectives.

Monitoring and Evaluation

The bill requires evaluation of outcomes and progress through the System’s planning instruments and subjects the organization, planning and coordination activities to the law and the general provisions that the CEDN will issue. Monitoring mechanisms include mandatory publication of the Catalog of Digital Assets and approval and publication of strategic and annual programs. The System's evaluation approach is designed to measure efficiency gains, security posture, reuse and compliance, and to surface potential misconduct for referral to competent authorities. The CEDN and SFP are given explicit roles in oversight, and the design anticipates periodic reporting and publication obligations to improve transparency.

Penalties, Liability, and Appeals

The draft establishes that violations by public servants will be sanctioned under the Ley General de Responsabilidades Administrativas; authorities in charge of the System must inform competent investigative bodies of potential administrative responsibilities or corrupt acts. Liability for agencies follows existing administrative law frameworks; the bill emphasizes administrative sanctions rather than creating new criminal offenses. It anticipates appeal routes in administrative procedural law and respects existing protections afforded by federal statutes. Sanctioning is tied to duties created by the law, and the transitory provisions stipulate immediate entry into force upon publication in the Diario Oficial de la Federación.

Relationship to Other Instruments

The bill is explicitly designed to work alongside and reinforce existing instruments: it references the Estrategia Digital Nacional 2021-2024 (DOF), the Acuerdo on ICT policies and security for the federal administration, and established procurement and administrative responsibility laws such as the Ley General de Responsabilidades Administrativas and the Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados. It consolidates policy directions already present in administrative accords and manuals and intends to convert several inter-administrative arrangements into a statutory framework to reduce fragmentation and strengthen legal certainty for digital governance.

International Alignment

The draft situates Mexico to align with international good practices on digital governance, cybersecurity and digital rights by embedding principles such as security, transparency and sovereignty. While it does not create explicit cross-border data transfer rules, it references data protection duties and the need to coordinate with international standards. The structure is compatible with international efforts on government cloud, data governance and cybersecurity frameworks and would facilitate Mexico's participation in international dialogues on digital governance by consolidating a clear national interlocutor (CEDN and CITICSI).

Implementation Timeline

Sources and References