Mexico’s AI Law: 223 Articles, Zero Budget

Originally published as an Expert Contributor column in Mexico Business News — AI, Cloud & Data, Oct 15, 2026. The Spanish version is here.

The most advanced artificial intelligence bill in Mexico's Congress has 223 articles, 14 titles and a new national AI authority that must be up and running 90 days after the law is published. What it does not have, like every other AI bill I have reviewed, is money.

That gap explains three years of Mexican AI lawmaking better than any count of initiatives. And there are plenty to count. At the Observatorio IA México, the citizen tracker I lead, we have registered 130 federal AI initiatives since April 2023, after removing duplicates. Seventy-nine are still live, 39 expired when a legislature ended, and fewer than 10 have been approved in either chamber, most of them on digital violence and deepfakes. State congresses have received about 200 more. The first half of 2026 alone brought 41 federal proposals, the busiest semester on record.

Three Years of Bills, a Handful of Narrow Reforms

The first comprehensive AI bill reached Congress in May 2023, and two more followed that fall. Most of what came after did not fail in a vote. It ran out of time. Committees in the Chamber of Deputies have 45 working days to report on a bill (90 for constitutional amendments), and anything left unreported when a legislature ends is discarded. When the LXV Legislature closed on Aug. 31, 2024, the first wave of AI bills went to the archive, including a federal AI law modeled on European risk categories that was refiled, almost unchanged, in February 2026.

What has actually become law is narrow: the 2025 overhaul of the industrial property law, which touches AI, and the May 2026 labor and copyright reform that protects voice and image from generative AI. I wrote in this space about why that one protects a few and leaves everyone else exposed. What moves fastest is the punitive agenda. In February 2026, the Chamber of Deputies approved sanctions for sexual deepfakes with 442 votes in favor, and the Senate is now reviewing that bill. Punishing bad actors produces consensus and headlines. Building capacity produces neither.

223 articles built on a power Congress does not have

Congress still lacks express constitutional authority to issue a general AI law. Sixteen initiatives to amend Article 73 have been filed since 2023, six of them in August and September 2026 alone, and none has been approved. Legislators keep drafting full laws that could not be enacted today.

Of the 10 comprehensive AI bills still alive, seven reproduce the architecture of the EU AI Act, a model the EU has just postponed: risk tiers, a new national authority, a registry of high-risk systems, audits and sanctions. The Senate's multiparty draft is the most ambitious. Besides the 223 articles and the 90-day deadline for the new authority, it gives companies two years to register and classify the systems they already use.

One detail says a lot. Article 9 of that draft lists 43 existing laws, codes and treaties, the USMCA among them, with which the new law must be read and applied. If you need 43 laws to interpret your AI law, the problem is not a lack of law.

Zero Budget

None of the bills I could review assigns a peso to what it creates. An authority without a budget is an office with a logo. A registry of high-risk systems without staff is a spreadsheet. And 223 articles of obligations that no one can supervise are an invitation to selective enforcement.

Europe itself has hit the brakes. The EU AI Act's high-risk rules were due to apply on Aug. 2, 2026. In July, the EU adopted the Digital Omnibus on AI, which pushed them to December 2027, and to August 2028 for AI built into regulated products, because the standards, guidance and national authorities needed to enforce them were not ready. Europe has institutions, funding and a single market behind it, and it still could not implement its own model on time. Mexico is copying that model without paying for the infrastructure. The OECD's 2026 Digital Government Outlook noted that Mexico lacked a national AI strategy and specialized supervisory bodies. A law does not create either one on its own.

The timing matters. The 2027 federal budget is being debated in Congress right now. If AI is the priority that 130 initiatives suggest, it should show up there: computing capacity, talent, training for public servants and judges, and adoption in public services, each with an amount and a target.

We Already Have the Laws

Extortion with a deepfake is extortion. A hiring algorithm that discriminates is labor discrimination. A model that misuses personal data violates data protection law. A chatbot that misleads a customer falls under consumer protection. Copying protected works is a copyright issue. Mexico has rules for all of this. What it lacks is prosecutors, judges and regulators trained and funded to apply them when AI is involved.

Adding registries and compliance duties for private companies will not fix that. It will weigh most on Mexican startups and small firms, which have no compliance departments, and least on the global platforms that do.

Fewer Articles, More Rules for the State

The actor with the most power to harm citizens with AI is not a startup. It is the state, when it uses algorithms to collect taxes, grant benefits, police streets or decide cases. That is where rules are missing, and the right model is already on the table. In July 2026, a package of bills proposed rules for AI use in amparo, labor, agrarian and electoral proceedings and in federal administrative procedure, built on legality, transparency, traceability and human supervision. It sits in committee while the 223-article law gets the forums.

1. Rules for the state as an AI user. When an authority uses AI in a decision that affects a person, it should tell them, explain it in plain terms, offer human review and keep a record. Public procurement of AI should follow clear criteria, and every use of AI in the federal government should appear in a public registry.
2. A budget line for AI. Money for compute, talent and adoption in the 2027 budget, tied to measurable targets, before any new authority is created.
3. Training before sanctions. As I wrote in April, judges already using AI to clear backlogs and encourage settlements show the technology can make justice more human. That scales only with training.
4. Measure, then regulate. Publish indicators on public-sector adoption and on incidents, review them every year and legislate specific harms with evidence in hand, the way the deepfake reform did.

Who Pays?

The Senate wants its AI law before the end of 2026, and a group of deputies is drafting the Article 73 amendment to make it possible. Before voting on 223 articles, Congress should answer one question: who pays for them? A law nobody can fund will not be enforced, and it will end up protecting no one.

Mexico does not have a regulation gap. It has an implementation gap.