Mexico's Senate AI Commission is reviewing a 223-article General Law to Regulate and Promote AI, reported in October 2026. The report describes risk-based obligations and tiered sanctions, a specialised governance authority and a national data sovereignty strategy. It also says the bill has no assigned budget and no constitutional backing yet. It does not say whether the sovereignty strategy would require data to be stored inside Mexico. That silence is the most important open question in the text, and it should be settled before the bill moves.
The case for sovereignty, stated fairly
The strongest argument for a sovereignty strategy is practical. A country that cannot reach, audit or train on its own public-sector data is a customer of other countries' models. Senator Rolando Zapata, who chairs the Senate AI commission, put it this way in May 2025: public-sector data is "un activo del país" that can feed Mexico's own models and strengthen technological sovereignty. Regulators also have a real interest in being able to inspect systems and compel records during an investigation. None of that is frivolous, and a good strategy can serve those goals without requiring any data to stay on Mexican soil.
What the bill reportedly builds
The design resembles earlier Senate drafts. Excélsior reported in April 2026 that the proposal would create a Autoridad Nacional de IA, a Fondo Nacional para el Desarrollo de la IA, a Sistema Nacional de Certificación de la IA and a national AI strategy. It also reported that high-risk systems would face registration, evaluation, certification and audit, and that the worst prohibited practices could carry prison. An earlier summary of the draft said it takes into account at least eight separate initiatives. That is a consolidation effort, not a single author's vision.
A risk-based approach is the right instinct. Tiering obligations by harm is far more proportionate than a flat rulebook. But a specialised authority, a certification system and a development fund all cost money, and the reported absence of a budget matters. An unfunded regulator tends to default to broad discretion and slow, uneven enforcement. Zapata also said in 2025 that a constitutional reform must come first, and the report that the bill still lacks that backing suggests the sequencing problem has not gone away.
Where USMCA draws the line
If the sovereignty strategy turned into a storage mandate, it would collide with Mexico's treaty commitments. Article 19.12 of the USMCA's digital trade chapter says plainly that "No Party shall require a covered person to use or locate computing facilities in that Party's territory as a condition for conducting business in that territory". Article 19.11 separately bars restrictions on cross-border transfers of information for business purposes. It allows a measure only if it is necessary for a legitimate public policy objective and imposes no greater restriction than necessary.
The same chapter points toward a different model. Article 19.15 recognises that risk-based approaches rely on consensus-based standards and may be more effective than prescriptive regulation in addressing cybersecurity threats. That logic fits AI governance as well: regulate the risk, not the server location.
The government-cloud wrinkle
The report notes that the government is consolidating its own systems on the Nube MX public cloud. That is not automatically a localisation problem. Analysts at the Wilson Center noted in 2021 that the USMCA digital trade chapter does not apply to government procurement or to information held or processed by or on behalf of the government. A state can therefore choose to host its own data domestically with few treaty consequences. Whether Nube MX hosting rules would be extended to private deployers through the AI law is a separate question the report does not answer.
The risk is mission creep. The same Wilson Center analysis flagged that Mexico's draft fintech rules would have forced firms to choose cloud providers based in Mexico, and criticised the use of self-judging national security exceptions. A national sovereignty strategy attached to a general AI law could become the vehicle for a similar requirement. Public-sector hosting choices would then spill over onto private companies that sell AI services into the Mexican market.
What lawmakers should do
The costs of localisation are well known. It raises compute costs for startups, concentrates data in a few domestic facilities that become attractive targets, and invites retaliation under a treaty already under pressure. The benefits it is usually sold on, regulator access and resilience, can be met by less restrictive tools. Three would do most of the work:
- Write the data sovereignty strategy to apply to public-sector data first, where the treaty gives Mexico the most room.
- Replace any storage mandate with regulator-access and audit-cooperation duties, so that supervisors can inspect records wherever they are held.
- Put the localisation answer in the bill text, not in later secondary rules, so that developers can see it before they invest.
The unresolved items are all the same kind: no budget, no constitutional footing and no stated position on data location. Closing those gaps before the vote would give Mexico a regime that is credible to investors and enforceable in practice. Leaving them to implementing regulations would invite exactly the uncertainty a pro-innovation law is meant to remove.