Mexico Moves Ahead on Cybersecurity Law

Mexico is moving forward on two parallel regulatory tracks that still have no final legislative close, a future Cybersecurity Law and a national framework for artificial intelligence. In Mexico City, lawmakers have already approved a specific reform that added Article 231 Bis to the Federal District Criminal Code. The measure was promoted by lawmaker Olivia Garza de los Santos, approved unanimously on May 21, 2026, published in the Official Gazette on July 22, and took effect the following day.

What is being discussed on cybersecurity and anti-fraud?

In the national cybersecurity debate, Mexico’s industry brought together different stakeholders to better protect users from digital fraud. According to that working group, fraud and scams should be expressly included in the future Cybersecurity Law, and the participants agreed to draft a set of principles for digital legislation through the UNAM Institute for Legal Research. The goal, based on that reporting, is to align the cybersecurity and anti-fraud agendas.

An economic analysis linked to the USMCA suggests the coming regulation will likely include obligations for critical infrastructure operators, mandatory incident reporting mechanisms, minimum protection standards and coordination schemes between authorities and the private sector. The same approach argues those requirements would be consistent with the trade pact’s commitments.

OneSec MX added that publication of the future law in the Official Gazette of the Federation is expected in the second half of 2026, although there is still no official record of promulgation. At the same time, the Mexican Senate is reviewing sector-specific proposals, including stronger cybersecurity for passport issuance, while the comprehensive law remains unapproved.

What does the artificial intelligence discussion include?

The artificial intelligence track is also still open. Coverage in national media says the federal administration, led by Claudia Sheinbaum, is working on a proposal centered on the protection of minors’ personal data, institutional transparency in the use of AI, the fight against deepfakes, the prevention of bias and algorithmic discrimination, and the protection of copyright.

Sheinbaum also clarified that there is still no drafted legislative proposal on possible restrictions on social media use by minors, and that the government’s strategy is to open a national discussion based on scientific evidence before submitting a bill. That position matches another assessment published in regional media, which warns that Mexico still lacks specific legislation for the safe use of artificial intelligence, with risks flagged in education and public administration.

On the same track, Ecosistema Startup reported that the AI bills under discussion could create a National AI Authority or National Artificial Intelligence Supervision Agency, define minor, serious and very serious offenses, and impose penalties ranging from fines to prison in cases such as deepfakes and electoral manipulation. The proposals also include a National Registry of High-Risk AI Systems for critical sectors such as health, education, employment, public safety and justice.