Lawmakers Propose AI Regulation Through Data Protection Law

A federal representative introduced a legislative initiative to reform the Federal Law on the Protection of Personal Data Held by Private Parties to regulate AI. The proposal establishes a mandatory framework for all individuals and corporations that develop, commercialize, or interact with these technologies in Mexico.

The initiative addresses a legal vacuum that allows automated learning models to process sensitive information without specific oversight. Rivera says that Mexico must transition toward a structured regulatory environment to align with international standards and protect the integrity of its citizens.

"With this reform, the Mexican State assumes its responsibility for technological leadership without sacrificing human rights, forcing any AI system that operates in national territory or affects Mexican citizens to adhere to parameters of legality and ethics," says MORENA Federal Representative Claudia Rivera.

In previous years, the global landscape for AI governance has shifted toward stricter oversight. To date, 144 countries have implemented privacy regulations to manage the complexities of algorithmic processing. In Mexico, however, algorithms and machine learning models operate without specific limitations, which creates significant risks for data privacy and corporate accountability.

The Transparency and Anticorruption Commission reports that the lack of a clear legal framework exposes users to potential abuses regarding the final destination of their information. Because AI systems rely on massive volumes of personal data as their primary input, they have become primary targets for cyberattacks. The absence of specific rules in the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) means that companies often operate under a patchwork of general guidelines that do not account for the unique capabilities of autonomous reasoning and automated decision-making.

Technical Framework of the Reform

Rivera’s initiative seeks to modify Article 1 and add Fraction XXI to Article 2 of the LFPDPPP. These changes aim to make data protection provisions mandatory for all entities — whether national or foreign — that engage with AI systems within Mexico. By defining these systems legally, the reform removes the ambiguity that has previously allowed technology companies to bypass strict data handling protocols.

Under the new definition, an AI System is a set of models and algorithms designed for learning, reasoning, and automated decision-making processes that involve the processing of personal data. This technical categorization is essential for B2B providers that offer Software as a Service (SaaS) or Infrastructure as a Service (IaaS) solutions, as it clarifies which automated processes fall under the jurisdiction of Mexican regulators.

The proposal emphasizes that AI systems are now central to global information processing and, consequently, global risk. Rivera cites international cases, such as the Cambridge Analytica incident, to illustrate how unregulated data usage can lead to the manipulation of social and democratic processes. For the corporate sector, this serves as a reminder that data processing is not merely a technical task but a core compliance pillar.

The reform intends to force a shift toward "Privacy by Design." Companies will need to implement internal audits and ethical guidelines to ensure their algorithms do not infringe upon the privacy of Mexican users. This design will be key in automated credit scoring and financial profiling, algorithmic recruitment and human capital management, predictive analytics in healthcare and insurance, and large-scale data processing for marketing and consumer behavior analysis.

If the Chamber of Deputies approves this reform, Mexico will join the 144 countries that have already modernized their privacy laws. The next step for the private sector involves reviewing existing AI deployments to ensure they align with the proposed legal definitions.

The Transparency and Anticorruption Commission suggests that the Mexican State must lead in technological vanguardism while maintaining a human-centric approach.