Mexico Moves Ahead on Cybersecurity Law

Mexico is moving on two parallel regulatory tracks that still do not have a final legislative outcome, a future Cybersecurity Law and a national framework for artificial intelligence. While the federal cyber law remains pending, Mexico City has already approved a targeted reform that added Article 231 Bis to the Federal District Criminal Code, driven by lawmaker Olivia Garza de los Santos, approved unanimously on May 21, 2026, published in the Official Gazette on July 22, and in force since the following day.

Cybersecurity, fraud, and pending obligations

In the national cybersecurity debate, Mexico's industry brought together different stakeholders to better protect users from digital fraud. According to that working group, the fraud and scam component should be explicitly included in the future Cybersecurity Law, and it was agreed that the Institute of Legal Research at UNAM would draft a set of principles for digital legislation. The goal, according to that coverage, is to align the cybersecurity and anti-fraud agendas.

An economic analysis tied to USMCA suggests the coming regulation will likely include obligations for critical infrastructure operators, mandatory incident reporting mechanisms, minimum protection standards, and coordination frameworks between authorities and the private sector. The same approach argues those requirements would be aligned with the trade agreement's commitments.

OneSec MX added that publication of that future law in the Official Gazette of the Federation is expected in the second half of 2026, although there is still no official evidence of promulgation. At the same time, the Mexican Senate is debating sector-specific initiatives, including stronger cybersecurity measures for passport issuance, while the comprehensive law remains unapproved.

The artificial intelligence debate

The artificial intelligence track is also still open. Coverage from national media says the federal administration, led by Claudia Sheinbaum, is working on a proposal centered on protection of minors' personal data, institutional transparency in AI use, countering deepfakes, preventing bias and algorithmic discrimination, and safeguarding copyright.

At the same time, Sheinbaum said there is still no drafted legislative proposal on possible restrictions on social media use by minors, and that the government's plan is to open a national discussion based on scientific evidence before presenting a bill. That position matches another assessment published in regional media, which warns that Mexico still lacks specific legislation for safe AI use, with risks identified in education and public administration.

On the same track, Ecosistema Startup reported that the AI bills under discussion could include the creation of a National AI Authority or National Artificial Intelligence Supervision Agency, classification of minor, serious, and very serious offenses, sanctions ranging from fines to prison in cases such as deepfakes and electoral manipulation, and a National Registry of High-Risk AI Systems for critical sectors such as health, education, employment, public safety, and justice.