The Senate approved a national security screening process for foreign acquisitions in strategic sectors. Artificial intelligence is on the list, although the reform does not define it. Here’s what buyers and sellers need to review starting today.
On September 30, 2026, the Senate of the Republic approved an amendment to the Foreign Investment Law that establishes a mechanism for reviewing acquisitions on national security grounds. For anyone buying, selling, or seeking a foreign partner in Mexico, the reform changes the way transactions are structured and timed, particularly in the technology sector.
The reform requires prior authorization from the National Commission on Foreign Investment (CNIE) when a foreign investor intends to acquire, directly or indirectly, more than 49% of the equity of a Mexican company that engages in strategic activities and whose assets exceed a certain threshold. That threshold has not yet been established: the CNIE will have 180 calendar days to publish it. Below the threshold, notification will be voluntary.
The CNIE is being expanded to include, with full voting rights, the Secretariats of National Defense, the Navy, and Security, as well as the Digital Transformation Agency. It may authorize the operation, authorize it with conditions, or deny it. Carrying out actions despite a denial will be punishable by fines ranging from 5,000 to 200,000 times the daily value of the UMA.
The bill now goes to the Chamber of Deputies.
What does “artificial intelligence” mean for the purposes of the reform?
The reform does not define artificial intelligence. However, based on the coverage in the approved text, the list of strategic activities encompasses it in three different ways:
- Infrastructure. This includes physical or virtual infrastructure, data processing and storage, and digital systems. This encompasses the data centers and cloud services that support AI.
- Technology. AI is listed alongside robotics, semiconductors, and cybersecurity as a critical or dual-use technology. This includes those who develop models, software, and applications.
- Data. This includes companies with access to or control over sensitive information, including personal data. This category encompasses fintech, healthcare, telecommunications, e-commerce, and any business whose value lies in its databases.
In practice, a company may be subject to review even if it does not “do AI” in the strict sense. It is enough that it operates the infrastructure or manages the data on which AI depends.
A well-known model
The design closely resembles that of the U.S. Committee on Foreign Investment (CFIUS), which grants special treatment to companies involved in critical technologies, critical infrastructure, and sensitive personal data—known as TID businesses. For U.S. investors, the logic will be familiar. For Mexican companies, it represents a paradigm shift: the buyer no longer just evaluates the company; they also assess whether the government will approve the acquisition.
Practical implications
Regulatory due diligence. We need to review each of the three layers—infrastructure, technology, and data—not just the company’s stated line of business.
Condition precedent. Approval from the CNIE must be agreed upon as a condition for the closure, and it must be determined who will bear the risk if approval is denied or if it is granted with conditions (divestitures, reporting requirements, operational restrictions).
Calendar. Deadlines (long-stop dates) must take into account the procedure before the CNIE and any possible extensions.
Indirect structures. Indirect acquisitions are covered, so the purchase of a holding company abroad may trigger a review in Mexico.
Voluntary notification. Below the threshold, voluntarily notifying the CNIE can be a useful tool for ensuring the certainty of the transaction.
What’s Next
The vote by the Chamber of Deputies, the publication of the asset threshold, and the criteria to be applied by the CNIE are still pending. In the meantime, any transaction in the technology sector currently under negotiation should account for this risk starting with the letter of intent.
At Vega Guerrero, we will monitor the legislative process and its implementation.
