AI in Mexico

Not yet. As of 2026, several proposals are in Congress and at state level, but none have passed. Compliance still runs through LFPDPPP (data protection), CFDI/SAT (financial), and sector-specific bodies (CNBV, COFEPRIS).

Sales lead automation across CRMs (especially HubSpot and Salesforce), Spanish-language customer support, and CFDI invoicing intelligence. Demand forecasting in retail is rising fast.

Any automation touching invoicing must reconcile to CFDI 4.0 schemas and SAT validation. AI agents that draft, send, or analyze invoices need this constraint baked in from day one.

CONDUSEF (Comisión Nacional para la Protección y Defensa de los Usuarios de Servicios Financieros) treats any automated channel that handles a user query, complaint, or contracting step as subject to the same servicing standards as a human agent. Practically, that means three things for an AI deployment: the user has to be told a non-human is on the other end (Disposiciones de Carácter General Aplicables a la Atención a Usuarios), the response and resolution timelines defined in the Buró de Entidades Financieras still apply (most complaint categories cap at 20 business days), and every interaction has to be logged in a format CONDUSEF inspectors can review. Fintechs operating under the 2018 Ley Fintech (sociedades financieras de tecnología — IFPE or IFC) face a parallel set of obligations from the CNBV. The pragmatic build pattern is to design the agent so a human reviewer can replay any conversation with full evidence: prompts, retrieved data, model response, and the user-side timestamps.

Yes — the SAT does not regulate how a CFDI is generated, only that the resulting XML conforms to the active schema (CFDI 4.0 as of 2026) and is sealed with a valid certificate of seal (Certificado de Sello Digital). An AI agent that drafts invoices, classifies tax keys (ClaveProdServ, ClaveUnidad), or reconciles complements (Carta Porte, Pagos 2.0, Comercio Exterior) is acceptable provided the final XML is timbrated through an authorized PAC (Proveedor Autorizado de Certificación). The risk to manage is not generation, it is correctness — the SAT can audit up to five years, and a Comprobante de Egresos that misclassifies the IVA position triggers retroactive penalties. The standard mitigation is a two-stage pipeline: the AI proposes the CFDI, a rules engine validates against the SAT XSD and the company's catálogo, and only validated documents are sent to the PAC. That gives the speed of AI with the deterministic safety the SAT actually cares about.