Mexico moves to punish digital threats

Digital threats face criminal penalties

Morena lawmaker Giselle Arellano introduced a bill in Mexico’s Chamber of Deputies to criminalize threats made through digital channels and amend the Federal Criminal Code to add that offense.

According to the legislative statement cited by Infobae, the proposal would impose sentences of three days to one year in prison, or fines of 180 to 360 days, for anyone who issues threats through digital media. The draft also says the harm can affect a person’s physical, psychological, or sexual integrity, as well as property, honor, or rights, including those of people with whom the victim has or had a family, emotional, work, cohabitation, or similar relationship.

Digital impersonation and artificial intelligence

Separately, another initiative was introduced in Mexico in 2026 to amend the Federal Criminal Code and impose prison terms of three to seven years on anyone who, by any technological means, uses, publishes, distributes, or spreads digital content generated, altered, or manipulated with automated systems or artificial intelligence that simulates, impersonates, or manipulates a third party’s identity without consent.

According to El Economista, the purpose of that conduct would be to cause harm, obtain an undue benefit, or mislead others about the authenticity of the identity. The proposal also seeks to increase the penalty to more than 10 years in prison if the content is distributed through media outlets or used to improperly influence electoral processes.

The reform also proposes changing Article 11 Bis of the Federal Criminal Code so companies can be held liable for this offense when it is committed through automated systems or AI.

IMSS changes its authentication model

On the compliance side, the IMSS has eliminated its own NPIE certificate and установлено the SAT’s e.firma as the only valid certificate for electronic employer procedures. The change came after mass fraud exposed weaknesses in the previous model, and it is intended to align employer authentication with the standard used by the Federal Public Administration.

The agreement ACDO.AS2.HCT.290626/176.P.DIR, published in the Official Gazette of the Federation on July 16, 2026, repealed agreements 43/2004 and 533/2006, which regulated the NPIE and the digital certificate issued by the IMSS. It also established a 90-day transition period during which the NPIE and e.firma may coexist for electronic procedures.

Starting Oct. 14, 2026, e.firma will be the only accepted certificate for employee registrations, terminations, and salary changes submitted electronically to the IMSS. Actions signed with that instrument will have the same legal effect as a handwritten signature, under Article 17-D of the Federal Fiscal Code and the Advanced Electronic Signature Law.

The IMSS warned that employers who do not complete the migration by Oct. 13, 2026, will not be able to carry out electronic affiliation changes, creating operational and compliance risks for companies that rely on digital channels for registrations, terminations, and salary updates. During the transition, the agency has enabled guidance through the Virtual Desk, the Contact Center, and the affiliation units of the OOAD.