Federal Law on the Development and Use of Artificial Intelligence

· About Federal Law on the Development and Use of Artificial Intelligence

Key Takeaways

  • Mexico does not currently have a federal AI-specific law in force; as of 5 October 2026, the main nationwide framework is still a set of pending legislative initiatives, not an enacted statute.[1][2][10]
  • The most developed proposal is the Draft Federal Law for the Ethical, Sovereign, and Inclusive Development of Artificial Intelligence, introduced in April 2025, which would create a risk-based framework, a National AI Council, and a National Algorithmic Audit Platform.[10][11][15]
  • A separate 2026 initiative would regulate AI under telecommunications and broadcasting rules and would apply to providers placing AI systems on the Mexican market, including certain foreign providers, with labeling duties for AI-generated content.[14]
  • Because no dedicated federal AI law has been promulgated, there are currently no AI-specific national compliance deadlines or AI-specific fines under a Mexican AI statute, although sector laws and existing privacy, consumer, telecom, and IP rules already apply.[1][10][12][14]
  • Proposed Mexican bills consistently require transparency, human oversight, privacy by design, and risk-based controls for high-risk systems, but those duties are not yet binding nationwide law.[10][11][12][15]
  • 2025–2026 developments show accelerating legislative activity, but current reporting still says the process has not produced a federal law in force; any dates in drafts remain proposed rather than operative.[1][4][9][12]

What It Is

Mexico’s AI framework is best described, as of 5 October 2026, as unfinished federal legislation plus sector-specific proposals, not a enacted “Federal Law on the Development and Use of Artificial Intelligence.”[1][10][12] Chambers and other comparative guides report that Mexico still lacks an AI-specific law in force, while Congress has considered multiple initiatives, including a comprehensive bill introduced in April 2025 and further proposals in 2026.[1][2][10][12]

The most cited draft, the Federal Law Initiative for the Ethical, Sovereign, and Inclusive Development of Artificial Intelligence, was published for discussion on 22 April 2025 and is still under review.[10][15] Comparative guides describe later AI proposals in 17 June 2026 and April 2026, but none had been promulgated as binding federal law by early October 2026.[12][15]

The draft structure would be enforced through a new National AI Council and a National Algorithmic Audit Platform, with coordinated authorities and publication duties for certain state-collected information.[11][15] However, because the proposal has not been enacted, no statutory “in force” date, phase-in deadline, or compliance commencement date currently exists for a federal AI law in Mexico.[1][10][15]

Who Must Comply

If enacted in its current form, the proposed law would likely apply broadly to developers, deployers, providers, operators, and users of AI systems in Mexico, with a risk-based approach similar to the EU model.[11][12][15] One 2026 proposal would explicitly cover providers placing AI systems on the Mexican market, including certain foreign providers, which signals intended extraterritorial reach for market-facing activity.[14]

The draft materials indicate a focus on high-risk AI systems, with extra requirements for systems used in sensitive areas, as well as transparency obligations for generative systems and content labeling.[10][11][14] Proposed rules also reference cybersecurity, data provenance, and information about training sources, which would affect organizations handling personal data or large training datasets.[11][14][15]

No final enacted federal AI law means there are presently no AI-specific statutory exemptions to interpret at federal level; instead, organizations rely on existing general-law carveouts under privacy, telecom, consumer, IP, and sector regulation.[1][10][12] In practice, public-sector uses, media, telecom, consumer-facing platforms, and regulated industries appear most likely to be targeted by the pending initiatives.[12][14][15]

Core Requirements

  1. Risk classification and proportional controls — Draft proposals use a risk-based framework, meaning obligations would scale with the likelihood and severity of harm posed by the AI system.[10][11][15]
  2. Transparency and notice — Proposals require clearer disclosure where AI is used, including rules aimed at avoiding deception and handling deepfakes or AI-generated content.[11][14][15]
  3. Human oversight and accountability — Drafts emphasize human supervision, responsibility allocation, and reviewability of automated outputs, especially for high-risk uses.[10][12][15]
  4. Privacy and data governance — Proposed rules call for privacy by design, proportionality, confidentiality, and attention to the provenance and sources of data used to train models.[10][11][14]
  5. Algorithmic auditing and oversight — The 2025 draft contemplates a National Algorithmic Audit Platform and oversight mechanisms for higher-risk systems.[11][15]
  6. Content labeling and consumer-facing disclosures — The 2026 telecommunications proposal would require certain generative AI content to be identified and labeled, and consumers to be informed when interacting with AI.[14]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Draft initiative published | 22 April 2025 | A comprehensive federal AI bill was introduced for discussion, but it did not become law.[10][15] | | Additional AI proposals advanced | 17 June 2026 | Congress introduced another AI bill, still under legislative review.[12] | | Status as of current date | 5 October 2026 | No dedicated AI-specific federal law is in force in Mexico.[1][10][12] |

Because no federal AI statute has been enacted, there are no AI-law-specific maximum fines or sanctions yet under a Mexican AI act.[1][10][12] Any enforcement today would come from existing laws, such as privacy, consumer protection, telecom, copyright, competition, or sectoral regulations, each with its own separate remedies and penalties.[12][14] Proposed bills mention sanctions, but reported sources do not show a promulgated federal penalty schedule that is currently operative.[11][14][15]

How to Comply

  1. Inventory current AI use cases — Map all systems that generate, recommend, classify, score, or automate decisions, and tag them by business unit and jurisdiction.
  2. Classify risk early — Use an AI risk method aligned to ISO 27001 for security controls, NIST CSF 2.0 for governance and response, and ISO/IEC 42001 for AI management-system discipline.
  3. Document data provenance — Record training data sources, licensing status, personal-data handling, retention periods, and exclusions for sensitive or unlawful data.
  4. Build human review into high-impact uses — Require escalation, override, and appeal paths for employment, credit, insurance, content moderation, and other consequential decisions.
  5. Implement transparency notices — Prepare consumer, employee, and partner notices explaining when AI is used, what it does, and how a person can obtain human review.
  6. Test for bias, security, and misuse — Run pre-deployment and periodic testing for discriminatory outcomes, prompt injection, model inversion, and data leakage.
  7. Set vendor controls — Insert AI-specific clauses on audit rights, incident reporting, training-data warranties, model change notices, and content-labeling support.
  8. Track legislative change continuously — Monitor the pending federal bills and sector-specific rules, because Mexico’s AI regime is still evolving and compliance obligations may arrive quickly.

Related Regulations

Mexico’s Federal Law on Protection of Personal Data Held by Private Parties already constrains training data, profiling, and automated processing when personal data is involved.[10][12] The Federal Consumer Protection Law can also apply to misleading AI-driven ads, deceptive chatbots, and inadequate disclosures to consumers.[14]

The Telecommunications and Broadcasting Law is relevant because one 2026 proposal would embed AI duties there, including content labeling and market-entry rules for certain providers.[14] The Federal Copyright Law and Industrial Property Law matter where AI systems ingest protected works or generate outputs that raise authorship, infringement, or trade-secret issues.[12][13]

The pending AI bills also interact with broader constitutional and administrative powers because one proposal would amend Article 73 to empower Congress to legislate on AI and then harmonize secondary legislation within 90 days if adopted.[1][8] That means any future AI statute may trigger follow-on changes across multiple legal regimes rather than stand alone.[1][8]

FAQ

Does Mexico have a federal AI law in force?

No. Multiple guides published in 2026 state that Mexico still lacks a dedicated AI-specific law, and the prominent AI initiatives remain under legislative review.[1][10][12] Until Congress enacts and publishes a final statute, organizations should treat the subject as proposed law rather than binding federal AI regulation.[1][10]

Does the proposed law apply to companies outside Mexico?

The draft materials suggest yes, at least for foreign providers that place AI systems on the Mexican market.[14] That means extra-territorial impact is likely for offshore vendors serving Mexican users, even if the company has no local subsidiary.[14]

Are there penalties already for noncompliance with the AI bills?

Not under a dedicated Mexican AI statute, because none is in force yet.[1][10][12] If a future law is enacted, penalties will depend on the final text; today, only existing laws in privacy, consumer, telecom, or IP can be enforced.[12][14]

What changed in 2025 and 2026?

The major 2025 development was the introduction of the comprehensive ethical, sovereign, and inclusive AI bill on 22 April 2025.[10][15] In 2026, new AI initiatives continued, including a June 2026 proposal and a separate telecom-oriented bill focused on labeling and market rules.[12][14]

Should companies wait for the final law before preparing?

No. The current legislative direction points toward risk-based governance, transparency, human oversight, and stronger content controls, so baseline readiness is prudent now.[10][11][14][15] Organizations with AI in consumer, employment, health, finance, telecom, or public-facing workflows should align internal controls with likely future requirements while also complying with existing Mexican laws.[12][14]

Sources

Put it into practice

More compliance guides