The 2026 World Cup: A Test For Mexico’s AI Governance Readiness

(Written in collaboration with Juan Carlos Quinzanos, Senior Associate)

The 2026 FIFA World Cup will be hosted by Canada, Mexico and the United States. For Mexico, the event will not only test stadiums, airports, hotels, transportation systems, and public services. It will also test how companies deploy artificial intelligence in a context of volume, pressure, and public exposure. 

AI will not always be visible to fans. It may operate behind payment systems, fraud monitoring tools, customer service bots, demand forecasting models, cybersecurity platforms, booking engines, marketing campaigns, mobility applications, ticketing processes, and vendor management systems. In many cases, AI will be used not because the World Cup requires it as a matter of law, but because companies will look for scale, speed, and operational control. 

That creates a legal issue. Mexico does not yet have a dedicated, comprehensive AI statute in force. There are legislative initiatives and regulatory discussions, but companies still operate without an AI specific rulebook. That gap should not be read as freedom from legal responsibility. It means that AI risk will be managed through existing legal frameworks: civil law, privacy, data protection, cybersecurity, consumer-facing transparency, contracts, vendor oversight, and corporate governance. 

The World Cup will make that gap more visible. Companies in hospitality, retail, financial services, telecommunications, mobility, media, advertising, e-commerce, and digital platforms will process more data than usual. Some tools may analyze patterns, flag risks, segment users, detect anomalies, or automate responses. Others may support crowd management, service personalization, customer support, or incident monitoring. From a legal standpoint, the relevant question is not whether a company uses AI. The question is whether the company knows where AI is being used, what data it processes, who controls the system, which vendors support it, how outputs are reviewed, and who is accountable when something goes wrong.

In Mexico, privacy and data protection will be the first line of analysis. The country’s data protection framework has also been under transition following the 2025 reform and institutional changes to the enforcement model and further adjustments remain part of the legal discussion. This context matters because many AI use cases depend on personal data. If companies use AI to analyze customer behavior, prevent fraud, personalize offers, respond to users, or monitor transactions, they need to assess whether their privacy notices, processing purposes, transfers, security measures, and processor arrangements support those activities. 

This is not a formality. If a company tells users that it processes data for customer service, but then uses that data to train AI models or run profiling tools, the legal analysis changes. If a vendor receives personal data to provide a service, but also reuses it to improve its own systems, the contract and privacy notice may not be enough. If a tool sends data outside Mexico, or relies on sub-processors in other jurisdictions, cross-border transfer rules and contractual controls become part of the risk. 

The absence of a specific AI law makes documentation more important, not less. Companies should be able to explain the purpose of each AI use case, the data involved, the role of each party, the applicable safeguards, and the escalation path if an incident occurs. That is basic governance, but it is also evidence. 

The second issue is fraud. The World Cup will create a market for services, but also for deception. AI will lower the cost of producing fake content, fake websites, fake customer service channels, and fake promotions. Fraud will not be limited to generic phishing emails. It may involve cloned ticketing sites, deepfake messages, false travel packages, fake payment links, fraudulent promotions, automated social media campaigns, illegal streaming channels, and impersonation of trusted brands or service providers. 

For companies, this should not be treated only as an information security issue. It is also a privacy, consumer trust, contractual, and governance issue. If users provide personal or financial data through channels that appear connected to a company, the response cannot be limited to saying that the company did not create the fraudulent site. Companies will need monitoring mechanisms, takedown procedures, communication protocols, incident response playbooks, and internal escalation rules. 

They will also need contracts that require vendors, agencies, and platform partners to cooperate when fraud, impersonation, or data exposure is detected. This is where contracts become one of the main AI governance tools. 

Companies will need to allocate risk through contractual discipline. Agreements with technology vendors, cloud providers, marketing agencies, ticketing platforms, payment processors, cybersecurity vendors, and analytics providers should answer operational questions before the event creates pressure. Who may use the data? Can the vendor use company or customer data to train models? Are sub-processors allowed? Where is the data stored? What security controls apply? What logs must be retained? How fast must incidents be notified? Who supports user claims? What happens if an AI output is wrong? What audit rights exist? What cooperation is required if there is a regulator inquiry, consumer complaint, fraud event or data breach? How is data returned, deleted or segregated when the relationship ends? 

These questions are not legal drafting points only, they define control. A company that does not know whether its provider uses customer data for model training does not control that risk. A company that cannot obtain logs from a vendor may not be able to investigate an incident. A company that has no notification timeline may lose time when escalation matters. A company that does not regulate sub-processing may not know where its data goes. 

The same logic applies internally. AI governance cannot sit only with the technology team. Legal, compliance, privacy, cybersecurity, procurement, marketing, operations and finance all have roles. The World Cup will involve campaigns, vendors, payment flows, customer interactions, public communications, and third-party platforms. A governance framework that exists only as a policy will not be enough if no one knows how to apply it. 

Companies should act before the pressure of the event narrows decision-making. It should start with an inventory of AI use cases. That inventory should identify the business owner, purpose, data categories, vendor, contractual status, privacy impact, security controls, and escalation route. From there, companies should classify use cases by risk, review privacy notices, update vendor contracts, prepare incident response protocols, and train teams that interact with users or launch public campaigns. 

Marketing and customer-facing teams deserve attention. The use of AI to generate content, personalize offers, respond to users, or detect demand can create legal exposure if the underlying data use is not disclosed, if claims are inaccurate, or if campaigns are not reviewed before launch. The speed of AI-generated campaigns should not eliminate legal review. 

The same applies to fraud response. Companies should define who monitors impersonation risks, who approves public warnings, who contacts platforms, who coordinates with payment providers, who preserves evidence, and who communicates with affected users. During the World Cup, improvisation will be difficult to defend. 

Mexico does not need to wait for a comprehensive AI law to act. The legal framework already provides enough reasons to build controls. The regulatory gap should push companies toward discipline. The companies best prepared for the 2026 World Cup will not be those that deploy the most AI tools. They will be those that can show they understand where AI is used, what data it processes, which vendors support it, what controls apply, and who is accountable when things go wrong. 

The World Cup may leave Mexico with stadium memories, tourism revenue, and infrastructure lessons. It should also leave a better standard for AI governance, and data protection.