Skip to main content
← All articles
Operating practice · Mexico1 Sept 2026 · 9 min read

Mexico has no AI law. Running AI costs the same anyway.

No AI law does not mean no exposure. The regulatory cost block does not disappear — it moves. Into a data-protection regime whose statute was replaced outright in 2025 and whose supervisory authority was abolished. Into a tax materiality file that has carried criminal liability since January 2026. And into working-time law with dated steps to 2030.

The pilot works. The assistant answers invoicing questions, the agent classifies documents, the model pulls deadlines out of contracts. The arithmetic looks good: a person-day in Mexico costs a little over a third of what it costs in Germany.

Then six months pass.

Someone notices that every privacy notice cites a law that no longer exists and an authority that was abolished. Accounting asks what actually backs the consultancy invoice for the AI project. A data subject objects to a decision taken automatically, and the clock runs in business days. The colleague who built the whole thing is now a team lead.

This is not an edge case. This is the normal case — just under different provisions.

What the pilot costs — and what comes back every year after it

In person-days, Mexican company running two to three production use cases

Pilot projectone-off20 PDOngoing operationevery year again151–290 PD0100200300 person-days
The effort is the same as in Europe — the work does not change when the law does. At 225 productive days a year that is 0.7 to 1.3 full-time roles.

AI is not a software rollout

AI systems decay even when nobody touches them — because everything around them moves. In Mexico one of those things moves faster than in Europe: the law itself.

  1. The models moveProviders retire versions, change response behaviour, shift safety boundaries. A prompt that reliably returned structured JSON in January produces prose in June. Nobody notices automatically — unless someone built regression tests and keeps them current.
  2. The data movesNew contract templates, renamed ERP fields, a different scanning process in the mailroom. Any of these can quietly degrade a retrieval pipeline. Not break it — degrade it. That is the more dangerous version, because the system keeps answering, just worse.
  3. The law moves — the foundation, not the façadeIn eighteen months Mexico abolished its data-protection authority, replaced its data-protection statute outright, criminalised giving fiscal effect to an unsupported invoice and legislated a five-step working-time reduction to 2030. Europe argues about how to read a text. Mexico rewrites the text.
  4. The attackers moveInjected instructions inside uploaded documents, data leaking through over-broad tool permissions, model endpoints without limits. These costs are the same in Mexico as anywhere — except that here no cybersecurity statute forces them, only reality does.

An unmaintained AI system does not break. It quietly gets worse.

Schematic view of the typical quality curve after go-live

100 %70 %40 %with ongoing maintenancewithout ongoing maintenanceGo-liveMonth 3Month 6Month 9Month 12
Schematic, not a measurement series. No Mexican law requires an accuracy measurement. That is precisely why this item is the first one cut — and precisely why the evidence is missing later.

There is no AI law. The cost block stays anyway.

Say it plainly, because it is the most important sentence here: as of September 2026 Mexico has no general AI law. No federal statute, no constitutional amendment, no AI regulator. The comprehensive bills are stuck in committee, and the reason is structural — until Article 73 of the Constitution grants Congress express competence over AI, the framework law has no footing.

Two truths follow, one comfortable and one not. The comfortable one: no Mexican authority can today demand an AI risk file, a conformity assessment, an AI incident report or a literacy record from you. Neither the duty nor the authority exists. The uncomfortable one: the absence of an AI law is not an absence of exposure. The obligations simply sit elsewhere — and there they come with deadlines and criminal provisions.

The hardest AI-specific duty that actually binds a Mexican deployer today sits in data-protection law: Article 26, fracción II of the LFPDPPP. A data subject may object where their data undergo automated processing that produces legal effects or significantly affects them, and where the processing is intended to evaluate — or to predict — work performance, economic situation, health, reliability or behaviour without human intervention. This is not GDPR Article 22: there is no right to human intervention, no right to contest and no right to an explanation. It is a right to object, and it runs on the ARCO clock.

What applies now and what is still coming

Mexican deadlines in date order, not to scale

today10/2018NOM-035psychosocial risk03/2025New LFPDPPPno INAI06/2025Algorithmic managementplatforms only01/2026False invoicemateriality required05/2026Voice and imagewith AI01/2027Time registrySTPS rules01/202942-hour weekhours
To the left of the dashed line already applies; to the right is already legislated. None of these seven dates comes from an AI law — Mexico has none. May 2026 is the country's only binding rule that expressly names AI systems, and it reaches only the voice and image of performing artists.

What this actually costs

The same breakdown as in the European article, computed on a Mexican basis: 150 to 500 employees, two to three production use cases, operated in-house. The effort in person-days is unchanged — the work does not change when the law does.

The basis is MXN 6,000 per internal person-day — fully loaded cost, not gross salary — and MXN 10,000 externally as an agency or consultancy price including margin. The internal figure derives from MXN 65,000 gross monthly salary, a loading factor of 1.40 and 225 productive days a year, plus overhead. Engaging a single freelancer directly costs closer to MXN 4,500–8,900 a day.

Twelve cost blocks that recur every year after go-live

Annual range in thousands of Mexican pesos

Model and provider changes90–300Prompt and retrieval upkeep150–450Quality measurement120–350Regulatory work and evidence90–300Data protection48–150IT security90–250Operations and incidents120–400Infrastructure180–1190Model usage under load120–950Training and AI literacy48–150Rework and technical debt120–400Knowledge continuity30–150020040060080010001200MXN k
Staff effortDirect costs, in dollars
The two longest bars are the only ones not priced in pesos: compute and model usage are billed in dollars and do not fall with Mexican wages at all.
Operating costs in detail
Cost blockWhat sits behind it in MexicoEffort p. a.Cost p. a.
Model and provider changesTracking retirement dates, testing version changes, fallback routing. Cheaper than in the EU: no localisation duty, no authorisation for international transfers (Arts. 35–36). Banks do need CNBV approval.15–30 PDMXN 90,000–300,000
Prompt and retrieval upkeepUpdating prompts, adjusting chunking, re-indexing, onboarding new document types. Purely technical, unchanged from Europe.25–45 PDMXN 150,000–450,000
Quality measurementReference set, regression tests, error rate, drift. Mexico imposes no legal accuracy duty — this is the first item cut, and that is exactly what later produces the evidence gap.20–35 PDMXN 120,000–350,000
Regulatory work and evidenceNo AI Act. Instead: re-papering every privacy notice, contract and policy to the 2025 statute — and a second time once the overdue implementing regulation appears.15–30 PDMXN 90,000–300,000
Data protectionNo DPIA duty, no European-style DPO, no regulator notification. But: the ARCO clock of 20 + 15 business days (Art. 31), objection to automated decisions (Art. 26), notice to data subjects "de forma inmediata" (Art. 19).8–15 PDMXN 48,000–150,000
IT securityNo NIS2, no catalogue of measures, no reporting deadlines for ordinary companies — only LFPDPPP Arts. 18–20. The operational effort is unchanged. In the financial sector this block is larger than Europe's.15–25 PDMXN 90,000–250,000
Operations and incidentsLogging, alerting, on-call, restore testing — plus the electronic working-time registry for standby duty, and a working week scheduled to fall from 48 to 40 hours by 2030.20–40 PDMXN 120,000–400,000
InfrastructureCompute and hosting, vector database, observability, staging. Billed in dollars, so no cheaper here. If outsourced, the REPSE calendar comes on top.Direct costMXN 180,000–1,190,000
Model usage under loadUsage-based billing or running your own models. Identical price to Europe — but since January 2026 every one of these invoices needs a materiality file, producible within five business days.Direct costMXN 120,000–950,000
Training and AI literacyThere is no Mexican counterpart to AI Act Article 4. The legal duty is zero. Binding are only the annual teleworking training under NOM-037 and the NOM-035 diffusion duty.8–15 PDMXN 48,000–150,000
Rework and technical debtFramework migrations, architecture changes, paying down prototype shortcuts. Vendor-driven, unchanged from Europe.20–40 PDMXN 120,000–400,000
Knowledge continuityHiring, onboarding, documentation, cover — sharpened by tax retention, which is not one period but several, each running from a different trigger date depending on the record.5–15 PDMXN 30,000–150,000
Total151–290 PDMXN 1.2–5.0 m

Basis: MXN 6,000 per internal person-day (fully loaded), MXN 10,000 external as an agency price. Direct costs are billed in dollars, converted at MXN 19.78 per euro. Estimates on a stated basis, not measurements.

The most telling comparison is not the total but its composition. A person-day in Mexico costs about 38 percent of the German one. Tokens and compute cost exactly the same.

It follows that the saving is not sixty percent but roughly half. And the item that weighs most on a Mexican AI operation is not the payroll — it is the dollar invoice. In Germany direct costs are 11 to 21 percent of the total; in Mexico 25 to 42 percent.

Where the person-days go

Midpoint of the range, roughly 220 person-days per year

220person-daysTechnical upkeep: models, prompts, testing, rework115 PD, 52 %Operations and security50 PD, 23 %Regulation, data protection, training46 PD, 21 %Knowledge continuity10 PD, 5 %
Here too the largest block is the least remarkable one: adapting systems to changes somebody else set in motion.

The materiality file

The European article does not know this item, and it is the most Mexican of them all. Since 1 January 2026 an invoice for AI consultancy, for tokens or for licences that cannot be backed by contracts, deliverables, staff, infrastructure and a payment trail is not a debatable invoice: under Article 29-A, fracción IX of the Fiscal Code it is false. Giving it fiscal effect carries two to nine years' imprisonment, and the deadline to produce the evidence on an Article 49 Bis inspection is five business days.

The difference from Europe fits in one sentence: there, documentation is requested. Here it is proven — against a clock and against a criminal provision.

The line items that appear in no table

  1. The evidence gapIn Mexico the largest of the four hidden items. Reconstructing model versions, prompt states, test results and supporting records once the audit has started costs a multiple of continuous logging — and on the tax side the clock runs in business days.
  2. The bus factorIn most mid-sized companies building AI in-house there is exactly one person who understands why the system is built the way it is. When that person leaves, what begins is not maintenance but archaeology.
  3. The opportunity costThe person spending 200 person-days a year maintaining AI systems is usually the best engineer in the building — and harder to replace in a market of roughly 390,000 people in that occupation than in Europe.
  4. Write-offs on technology shiftsWhat was built in 2024 on the framework of the day is often not the obvious architecture in 2026. Building in-house means paying for those shifts yourself.

In-house or specialist provider

The honest comparison, including the rows where in-house wins.

Two routes, the same job
CriterionBuilt in-houseSpecialist provider
Time to production4 to 9 months4 to 10 weeks
Ongoing operating costMXN 1.2–5.0 m per yearpredictable service fee
Model updatesyour risk, your effortincluded in the service
Legal monitoringhas to be built — and here the foundation movespart of the product
Evidence for inspectionsproduced by you, in business daysgenerated continuously
Knowledge riskhigh, often one persondistributed at the provider
Data sovereigntymaximumdepends on hosting model, the key selection criterion
Domain controlmaximumhigh where processes are configurable
Handling edge casesunlimitedbounded by product scope
Calendar obligationsthe ARCO clock, immediate notification, the materiality file and REPSE dates sit with youwith the provider

The two highlighted rows are why the answer is not always to outsource.

When building in-house is the right call

This calculation is not an argument against internal development. It is an argument against unexamined internal development. Building it yourself is right when at least two of these four apply.

Four-point check
  1. The use case is core to the business model and therefore a competitive advantage in itself.
  2. At least three people in-house have real operating experience with AI systems — not one person with an interest in the topic.
  3. No market product covers the domain.
  4. Somebody in-house genuinely owns the calendar obligations — the ARCO clock, immediate notification, the materiality file — and not just the technology.

If none or only one applies, in-house is usually the most expensive option — and it only reveals itself as such after 18 months, when unwinding it already hurts.

Three questions before any AI rollout in Mexico

  1. Do our privacy notices and contracts still cite the 2010 law or the abolished authority?If so, that is not a formality but an invoice you have not yet paid.
  2. Could we prove within five business days that last year's AI invoices correspond to real services?If the answer hesitates, the criminal provision is already in the room.
  3. Who can find everything held on one person — across databases, vector stores and logs — within 20 business days?That is an engineering task, not a legal one. But it falls due legally.

Our approach

This is exactly where Agentic360 comes in. The operating tasks listed above sit with us, not with the customer: model changes, quality assurance, legal monitoring and evidence generation run alongside. For Mexico that concretely means we track the LFPDPPP renumbering, the pending implementing regulation and the materiality requirement, instead of leaving them to you.

Two things matter to us. Data sovereignty stays with the customer — the platform runs locally hosted models, and on-premise and air-gapped installations are part of the product. And decisions stay traceable: rules are evaluated in a deterministic policy engine, not hidden inside a model prompt. Every assessment traces back to the underlying provision and the processing step that triggered it. In a country without an AI law that is not a compliance argument but an operating one: it is the difference between "the system says X" and "the system says X because".

If you are working out what your own AI operation costs in Mexico, or realising you have never done that calculation: talk to us. Even if the answer turns out to be building it yourself — at least let it be a deliberate decision with a budget behind it.

Key takeaway

The absence of an AI law is not an absence of exposure. In Mexico the regulatory cost block does not disappear — it moves somewhere harder to schedule: into a data-protection statute that has just been replaced, into a tax materiality file backed by a criminal provision, and into working-time law with dated steps to 2030.

Same question, different jurisdictionOperating practiceAdopting AI is a project. Running it is a full-time job.The same calculation for Germany and the EU: there the EU AI Act carries the regulatory cost block Mexico does not have — and the total comes out nearly twice as high.Read the article

As of 1 September 2026. Regulatory deadlines change; the details reflect the position at publication. This article is not legal or tax advice. The cost figures are estimates on the stated basis, not measurements. At the time of writing Mexico had no general AI statute; pending bills may change that.

Sources
Book a demo

Turn the regulation into a running system.

30 minutes, scoped to your frameworks and integrations. You leave with a concrete plan — not a sales loop.