Mexico speeds up data and AI laws

What changed in the State of Mexico?

The State of Mexico Congress is reviewing an initiative sent by Governor Delfina Gómez Álvarez to enact new state laws on Transparency and Access to Public Information, and on the Protection of Personal Data Held by Obligated Entities in the State of Mexico and its municipalities. The proposal aims to align the local framework with current general laws, reorganize authorities, and create a decentralized body called Transparencia Mexiquense.

According to Diario Amanecer, the legislative package arrives after the disappearance of the State of Mexico transparency institute, Infoem, following constitutional reforms approved in June 2025. The new structure would fall under the Office of the Comptroller, with responsibilities tied to access to information and personal data guarantees.

Marcaje Legislativo said the initiative was introduced in the State of Mexico legislature by lawmaker Gerardo Pliego Santana and also includes amendments to rules such as the state Anti-Corruption System Law. Eje19 added that the local redesign responds to the publication, in March 2025, of the General Law on Transparency and Access to Public Information and the General Law on the Protection of Personal Data Held by Obligated Entities.

What is the Mexico City reform on digital violence trying to do?

The initiative in the Mexico City Congress seeks to update the definition of digital violence and strengthen protection against attacks that compromise privacy and personal data. It was introduced by Representative Brenda Fabiola Ruiz Aguilar and has already been referred to the Commission on Gender Equality for review.

The proposal, reported by La Crónica de Hoy and Realidad7, would give the Public Prosecutor's Office authority to immediately order the suspension, removal, blocking, destruction, or deletion of images, audio, video, data, and other digital content related to the reported facts. It also adds conduct such as identity theft, unauthorized access to accounts or devices, technological surveillance, and the obtaining or dissemination of personal data and private information.

Realidad7 also noted that the reform aims to strengthen institutional tools to protect women and focuses on the impact on victims' dignity, emotional health, and even their lives.

What is happening at the federal level with cybersecurity and AI?

At the federal Congress, pending bills continue to pile up on cybercrime, artificial intelligence, and forced recruitment, while Mexico has spent six years debating without approving a federal cybersecurity law. AlMomento.mx warns that this delay leaves the country without an approved specific framework and without mandatory minimum legal standards to protect national critical infrastructure.

Excélsior reported that among the pending bills is one proposal that would impose 4 to 5 years in prison for identity theft carried out through physical, electronic, digital, or technological means involving unauthorized use of personal or biometric data. Remio.ai added that in April 2025 a draft General Cybersecurity Law was published that proposed creating a National Cybersecurity System and a national center under the Security Ministry, although the proposal still has no committee report.

On artificial intelligence, Investigación y Desarrollo reported around 200 state-level initiatives related to AI in Mexico, of which 39 have already been approved and only Chiapas lacks local proposals. The same outlet mentioned an initiative introduced on February 11, 2026, by Senator Karina Ruiz to create a specialized national AI agency, which remains pending. El Financiero, meanwhile, said that beyond that proposal there are at least four other competing federal initiatives, all still without committee approval.

What other proposals are showing up in digital regulation?

Some initiatives still have no legislative outcome, while others arrive with broad scopes covering privacy, algorithmic audits, and child protection. One of them, reported by EstadoRed, would open the door to AI system audits carried out by civil society organizations and international bodies, although without specific independence rules, raising questions about how those processes would be governed.

There is also a proposal to regulate social media aimed at minors in Mexico that, according to Maya Comunicación, would have 82% support in a survey and would include administrative fines of up to 4% of global annual revenue for platforms that do not implement biometric or official ID filters, with a 180-day technology compliance period. The source itself said that information was not officially confirmed.

In parallel, captain.legal and IA Governance say Mexico has been operating under a new federal personal data protection framework since March 2025, with the transfer of INAI powers to the Anti-Corruption and Good Government Ministry, although those data points are presented by those sites as part of their own regulatory update analysis.