Mexico advances cybersecurity laws

In September 2026, Mexico saw a wave of legislative proposals tied to cybersecurity, children’s digital rights and tighter review of foreign investment in sensitive sectors. The Senate received a draft Cybersecurity Law, while the Chamber of Deputies took up a reform aimed at protecting and restoring the rights of children and adolescents harmed in digital environments. At the same time, another proposal seeks to reclassify artificial intelligence, data, semiconductors and cybersecurity as sectors subject to national security review.

What does the new Cybersecurity Law propose?

The initiative presented to the Senate on Sept. 10, 2026, calls for a national cybersecurity framework for Mexico, including protection for critical infrastructure, the creation of a National Cybersecurity Agency, CSIRTs and a National Cybersecurity System. For now, it is a legislative proposal, not an enacted law.

The filing was reported by ZTC Consulting in its Cyber Intelligence 004, dated Sept. 14, 2026. The proposal is aimed at organizing the institutional response to incidents, coordination and protection of assets considered critical, although the available material does not detail implementation timelines or specific articles.

What changes for children and adolescents?

In the Chamber of Deputies, lawmakers introduced in September 2026 an initiative to add Article 123 Bis to the General Law on the Rights of Girls, Boys and Adolescents. The measure is designed to protect and fully restore rights in cases of harm caused or enabled in digital environments. The official document was published by the Legislative Information System of the Ministry of the Interior.

The proposal comes as regional and local media have reported reforms intended to strengthen prevention of social media use by minors. Reported measures include requiring platforms to prioritize the best interests of the child, provide reporting and remediation mechanisms, apply special security measures and restrict access for children under 14.

In Chihuahua, local coverage also detailed technical requirements for platforms to implement age-verification filters, reporting tools, stronger security measures and rights-restoration mechanisms when violations occur in digital environments. Publimetro México also reported that, in the recent debate on comprehensive protection for minors against recruitment by criminal groups, digital environments were explicitly included as possible channels of recruitment.

How does foreign investment review change?

A reform to the Foreign Investment Law seeks to classify artificial intelligence, along with semiconductors, data and cybersecurity, as national security sectors subject to review when a foreign acquisition exceeds 49% of the capital of a Mexican company. Mexican business media also said that acquisitions above that threshold and above the asset threshold set in the bill would require prior authorization, with possible fines of up to 200,000 UMAs for noncompliance.

GPH Legal said the initiative introduces, for the first time in Mexico, a specific national security title in the area of investment. According to the firm, the proposal expands the composition of the National Foreign Investment Commission to include national security authorities and shifts the focus from a mainly economic review to one with explicit national security scrutiny over sensitive data, digital infrastructure, artificial intelligence and cybersecurity.

Coverage from Campus Milenio added that the reform bill, introduced in 2026, includes artificial intelligence among the national security sectors under review. Together, the proposals place one legislative theme on Mexico’s agenda, linking cybersecurity, data protection, minors’ rights and foreign investment in critical infrastructure and technologies.