Mexico AI Regulation Overview

Overview

Mexico's federal framework for artificial intelligence (AI) operates through a multi-tiered regulatory architecture combining executive strategy, interministerial policy coordination, administrative guidelines, and public research infrastructure. Early policy foundations were established through white papers, public sector impact assessment frameworks, and research consortia. The primary binding governance mechanisms currently in force at the federal level focus on administrative digitisation, information security, and public sector coordination, notably through the Interministerial Commission on Information and Communication Technologies and Information Security (CITICSI) and the National Digital Strategy (EDN) directives.

In parallel, the federal government has launched national capability initiatives under the Plan México framework, establishing the Laboratorio Nacional de Inteligencia Artificial (LNIA) to centralize compute infrastructure, develop sovereign domestic models, and advance public-interest applications in areas such as health and disaster response. While binding federal statutory laws dedicated exclusively to AI have not yet been promulgated, Mexico is undergoing intensive legislative activity. Federal lawmakers in both the Chamber of Deputies and the Senate have introduced comprehensive legislative initiatives, constitutional amendments to grant Congress explicit legislative authority over AI, and targeted statutory reforms addressing digital violence, copyright, labor protections, and public security uses.

Regulatory Approach

Mexico's regulatory approach is transitioning from advisory soft-law guidelines and executive administrative decrees toward a comprehensive, risk-based statutory framework. At the public administration level, governance is governed by functional guidelines—such as the 2018 General Principles and Impact Assessment Guide issued by the Coordinación de Estrategia Digital Nacional (CEDN)—which instruct federal agencies to evaluate human rights impacts, data protection, transparency, explainability, and human oversight before deploying algorithmic systems.

In the federal legislature, pending initiatives favor horizontal, risk-based governance models heavily influenced by international benchmarks like the EU AI Act. Key proposals, such as Expediente 2330 ("Ley Federal para el Desarrollo Ético, Soberano e Inclusivo de la Inteligencia Artificial") and reports from the Senate Special Commission on AI, propose classifying AI systems into distinct risk categories (minimal, limited, high, and prohibited). These horizontal efforts are complemented by targeted sectoral proposals that seek to amend existing codes—such as adding specific provisions to the Federal Criminal Code for non-consensual synthetic content and generative AI fraud, reforming copyright and labor laws to protect performers and human creators, and setting guidelines for law enforcement deployments in public security.

Key AI Legislation

• Decreto por el que se crea la CITICSI (2023): Binding executive decree establishing the Interministerial Commission on ICT and Information Security under the presidency to coordinate federal technology and security policies.
• Principios generales y guía de análisis de impacto para el uso de IA en la APF (2018): Executive guideline issued by CEDN providing a risk and impact assessment framework for federal public administration deployments.
• Consorcio / Alianza en Inteligencia Artificial (2018): CONACYT-formalized research alliance grouping public research centers (including CIMAT, CICESE, CentroGeo, INFOTEC, CIO, IPICYT, INAOE, and CIDESI) to advance domestic R&D and training.
• Laboratorio Nacional de Inteligencia Artificial - LNIA (2025): Strategic executive initiative under Plan México, coordinated by ATDT and SECIHTI, focused on sovereign AI models, public compute infrastructure, and regional training centers.
• Estrategia Digital Nacional 2021-2024 (EDN) (2021): Executive policy framework issued by CEDN establishing mandatory digital transformation, security, and open-source principles across the federal administration.
• Iniciativas de Reforma Constitucional al Artículo 73 (2025): Proposed constitutional amendments (by Dep. Monreal Ávila and Dep. Herrera Ruiz) to grant the Congress of the Union explicit authority to legislate on artificial intelligence and disruptive technologies.
• Expediente 2330 - Ley Federal para el Desarrollo Ético, Soberano e Inclusivo de la IA (2025): Comprehensive legislative bill proposing risk-based classifications, a National AI Council, algorithmic audit platforms, and system registries.
• Reforma Penal y de Derechos de Autor sobre IA Generativa (2025): Proposed bill amending the Federal Criminal Code (Articles 211 Bis 8–10) and Copyright Law to penalize deceptive deepfakes, unauthorized biometric use, and fraudulent registration of autonomous AI outputs.
• Reforma para la Protección de Actores de Doblaje frente a la IA (2025): Proposed bill amending Cinematography, Copyright, and Labor laws to require written consent, public disclosure, and fair compensation when cloning performers' voices.
• Iniciativa sobre IA en Unidades de Seguridad Pública (2025): Proposed bill adding Article 8 Bis to the Federal Law Against Organized Crime to authorize and set supervisory rules for AI in criminal investigations.
• Reforma al Código Penal sobre Contenido Íntimo Sexual No Consensual (2025): Pending bill adding a third paragraph to Article 199 Octies of the Federal Criminal Code to penalize AI-generated deepfakes of intimate content.
• Reforma a Leyes de Educación en Materia de IA (2025): Proposed bill amending the General Education Laws to incorporate AI literacy, ethics, and data protection into national curricula.
• Proyecto de Ley Federal de Gobernanza Digital (2023): Proposed legislative framework to establish the National Digital Governance System and manage government digital assets.
• Proyecto de Ley para la Regulación Ética de la IA y la Robótica (2023): Discarded legislative initiative (recorded as Desechado in 2024) that originally proposed a national ethics council (CMETIAR) and official Mexican standards (NOMs).

Governance & Enforcement Bodies

Governance of AI and digital technology across the Mexican federal administration relies on a combination of executive digital strategy offices, intersecretarial commissions, science authorities, and autonomous oversight bodies. The Coordinación de Estrategia Digital Nacional (CEDN), located within the Office of the Presidency, acts as the primary executive policy driver, presiding over the Interministerial Commission on ICT and Information Security (CITICSI). CITICSI brings together information technology heads from across federal ministries to set binding operational guidelines, coordinate interoperability, and ensure federal information security.

For technical implementation and scientific development, the newly established Agencia de Transformación Digital y Telecomunicaciones (ATDT) and the Secretaría de Ciencia, Humanidades, Tecnología e Innovación (SECIHTI) play central roles, coordinating the Laboratorio Nacional de Inteligencia Artificial (LNIA) and leading technical standard-setting. Autonomous bodies, particularly the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), enforce data privacy obligations for AI processing. Under pending legislative initiatives, supervisory mandates would expand to sector-specific authorities including the Secretaría de Seguridad y Protección Ciudadana (SSPC), the Fiscalía General de la República (FGR), the Instituto Nacional del Derecho de Autor (INDAUTOR), and the Secretaría del Trabajo y Previsión Social (STPS).

Penalties & Enforcement

Existing non-binding executive guidelines and digital governance frameworks do not establish independent monetary fine structures; instead, noncompliance by public servants is sanctioned under the Ley General de Responsabilidades Administrativas. Enforcement of executive administrative decrees (such as CITICSI lineamientos or EDN directives) relies on internal audit mechanisms, supervisory reporting to the Presidency, and administrative responsibility procedures administered through the Secretaría de la Función Pública (SFP).

Pending federal legislative proposals establish explicit criminal, administrative, and labor penalties. The proposed legislative reform to protect dubbing performers introduces administrative fines ranging from 1,000 to 5,000 Unidades de Medida y Actualización (UMAs) under Article 994 of the Federal Labor Law for employers or producers using AI to replicate voices without consent. In criminal law, proposed amendments to the Federal Criminal Code establish prison sentences of six months to four years imprisonment and fines of 100 to 600 days for the improper use of generative AI (including deceptive deepfakes, unauthorized biometric exploitation, and presenting autonomous AI output as human creations to obtain fraudulent registration), alongside criminal penalties under Article 199 Octies for non-consensual synthetic sexual media executed via federal prosecutorial channels (FGR).

Data Protection Framework

Artificial intelligence systems in Mexico operate under dual federal data protection statutes: the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) for private sector entities, and the Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados (LGPDPPSO) for public sector authorities. Both statutes are overseen and enforced by the Instituto Nacional del Derecho de Autor y Protección de Datos (INAI) as the autonomous national authority.

Recent legislative initiatives explicitly align AI regulatory proposals with these statutory privacy frameworks. Executive guidelines (such as the 2018 CEDN Principles and Impact Guide) and pending federal bills (including Expediente 2330, the public security AI bill, and generative AI copyright proposals) mandate strict data minimization, explicit consent for biometric processing, lawful processing bases, and mandatory privacy impact assessments. The legal corpus holds no record of standalone data localization requirements specific to AI training or operational datasets.

Sector-Specific Rules

Sector-specific regulatory proposals targeting AI applications have emerged across security, creative industries, copyright, education, and public administration. In public security, a proposed amendment to Article 8 Bis of the Federal Law Against Organized Crime seeks to explicitly authorize public security units under SSPC supervision to deploy AI for predictive crime analysis, real-time communications and financial network monitoring, automated workflow optimization, and facial recognition in high-incidence zones, subject to constitutional human rights limits.

In the creative and labor sectors, a draft decree amending the Ley Federal de Cinematografía, Ley Federal del Derecho de Autor, and Ley Federal del Trabajo establishes rules to protect dubbing artists, prohibiting the exclusive substitution of human performers with AI absent explicit written contractual authorization and establishing a dedicated compensation fund managed by the Secretaría de Cultura. Parallel copyright proposals amend copyright law to recognize "AI-assisted" works while explicitly excluding fully autonomous generative AI outputs from protection if they lack human authorship, fail transparency criteria, or infringe existing rights. In education, proposed reforms to the General Education Laws mandate integrating AI ethics, bioethics, data privacy, and practical skills into basic and higher education study plans under the Secretaría de Educación Pública (SEP).

International Alignment

Mexico's AI regulatory policy displays strong alignment with major international benchmarks and multilateral principles. Comparative regulatory analyses embedded in congressional initiatives explicitly draw from the risk-based framework of the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689), adopting similar risk tiers (minimal, limited, high, and prohibited) and pre-market compliance requirements in draft general laws.

Furthermore, policy instruments and legislative expositions consistently incorporate the OECD AI Principles, the UNESCO Recommendation on the Ethics of Artificial Intelligence, and recent UN General Assembly resolutions on safe, trustworthy AI systems. These international standards directly inform national guidelines regarding explainability, human oversight, algorithmic non-discrimination, and fundamental rights impact assessments across both public administration guidance and parliamentary bills.

Future Developments

The near-future regulatory landscape in Mexico will be shaped by the progression of constitutional and statutory initiatives in the federal legislature. Priority attention centers on constitutional reform proposals to Article 73, which, if enacted, will establish mandatory transitional deadlines requiring Congress to harmonize secondary legislation within 90 days and enact a comprehensive General Law on Artificial Intelligence and Disruptive Technologies within 180 days of publication in the Diario Oficial de la Federación.

Concurrently, congressional committees are analyzing substantive draft laws—including Expediente 2330, penal code amendments targeting generative AI deepfakes and non-consensual content, and dubbing voice protection bills. On the executive side, the continued operational roll-out of the Laboratorio Nacional de Inteligencia Artificial (LNIA) under Plan México will expand public computing platforms, specialized research nodes in public health and disaster response, and regional training centers in coordination with national higher education institutions.

Enforcement Bodies