The Federal Commission for the Protection against Health Risks (“COFEPRIS”) holds the authority over manufacturing, distributing, labelling, advertising and selling drugs, medical devices, food and food supplements, and over advertising for prescription medications and certain categories of medical devices pursuant to, mainly (i) the General Health Law (“GHL”), (ii) the Regulation for Health Supplies (“SRMP”), (iii) the Regulation on the Health Control of Products and Services, (iv) the Mexican Official Standards (“NOMs”), and (v) the Mexican Pharmacopoeia, (vi) and multiple official decrees for various product categories, regulated services, and establishments.

The NOMs and official decrees are technical regulations that govern several topics. For example:

• NOM-137-SSA1-2008 – Labelling of Medical Devices;
• NOM-251-SSA1-2009 – Hygienic Practices in the Process of food, drinks, and dietary supplements;
• NOM-051-SCFI/SSA1-2010 – Labelling of pre-packaged food products;
• NOM-012-SSA3-2012 – Criteria for the execution of research projects for health in humans.
• NOM-072-SSA1-2012 – Labelling of Medicinal Products;
• NOM-240-SSA1-2012 – Technovigilance
• NOM-177-SSA1-2013 – Interchangeability of Medicines;
• NOM-059-SSA1-2015 – Good Manufacturing Practices of Medicinal Products;
• NOM-220-SSA1-2016 – Pharmacovigilance (and its modifications);
• NOM-241-SSA1-2021 – Good Manufacturing Practices for medical devices.
• Decree that regulates the use of additives and adjuvants in food, drinks, and dietary supplements, and its amendments;
• Decree that establishes plants, prohibited or permitted, for use in teas, infusions, and edible vegetable oils;
• Decree for the Operation of Ethics Committees issued by the National Commission of Bioethics.
• Guidelines of Good Clinical Practice published by the COFEPRIS;

Our legal framework focuses on the health risk they pose to human health. Low-risk products, such as dietary supplements, are monitored post-commercialization, while high-risk products, such as medicinal products and MDs, require pre-commercialization approval via product registration or market authorization (“MA”).

The proper classification of a product within its regulatory category is crucial because each category has specific regulations applicable to certain types of products. Therefore, the formulation, composition, quality, brand, generic, and specific denomination of the product must adhere to the specifications of that product’s regulatory category as defined in the regulation.

If a regulated product is incorrectly classified and incorrect regulations are applied, the health authority may impose administrative sanctions such as fines, temporary suspension of activities, and securing the product until the irregularities are corrected.

The GHL defines Medicinal Products (“MP”) as any substance or mixture of substances of natural or synthetic origin that has any therapeutic, preventative, or rehabilitative properties, which is presented under any pharmaceutical form and is identified as such for its pharmacological activity and physical, chemical, and biological characteristics. There are many classifications of medicinal products, including reference and generic drugs, biotechnological and biocomparable drugs, prescription and non-prescription drugs, standard and controlled drugs, among others.

Medical Devices (“MD”) are defined under the NOM-241-SSA1-2021, Good manufacturing practices for medical devices, as any “…instrument, apparatus, utensil, machine, software, implantable product or material, diagnostic agent, material, substance or similar product, to be used, alone or in combination, directly or indirectly in human beings; with any of the following purposes of use:

(i) diagnosis, prevention, surveillance, or monitoring, and/or aid in the treatment of diseases;

(ii) diagnosis, surveillance or monitoring, treatment, protection, absorption, drainage, or aid in the healing of an injury;

(iii) substitution, modification, or support of the anatomy or of a physiological process;

(iv) life support;

(v) control of conception;

(vi) disinfection of medical devices;

(vii) disinfectant substances;

(viii) provision of information through an in vitro examination of samples taken from the human body, for diagnostic purposes;

(ix) devices incorporating tissues of animal and/or human origin, and/or

(x) devices used in in vitro fertilisation and assisted reproductive technologies,

as well as those whose main purpose of use is not through pharmacological, immunological, or metabolic mechanisms; however, they can be assisted by these means to achieve their function. Medical devices include supplies for health in the following categories: medical equipment, prostheses, orthoses, functional aids, diagnostic agents, supplies for dental use, surgical and healing materials, and hygienic products.”

MDs are categorized into three classes based on the risk they pose to human health:

• Class I: Recognised in medical practice, proven safe and effective, and generally not introduced into the human body.
• Class II: Recognised in medical practice, can vary in manufacturing or concentration, and are regularly introduced into the human body for less than 30 days.
• Class III: New products or those recently accepted in medical practice, or those that are introduced into the human body and remain there for more than 30 days.

In addition, there is an “Official Decree that lists low-risk medical devices that require Marketing Authorization, low-risk medical devices that do not require a MA, Products that, for their nature, characteristics, and Uses, are not Considered Medical Devices”. Products included on this list are not regulated as MD.

MP and MD require a prior MA. The COFEPRIS grants only one type of MA for pharmaceuticals for human health and MD. The requirements for quality, safety, and efficacy are generally consistent across all products, whether they are allopathic, biologic, biotechnologic, homeopathic, herbal, or vitamin pharmaceuticals. The validity period of any MA for pharmaceuticals and medical devices is five years. After this time, MAs must be renewed for an additional five-year period.

MA holders are required to adhere to good manufacturing practices and to standards and regulations pertaining to stability, pharmacovigilance, or technovigilance, and labelling. Additionally, they must abide by the advertising regulations applicable to MP or MD. The obligations related to product recall are becoming increasingly significant.

MP and MD are subject to post-approval vigilance. These obligations are outlined in regulations, which typically specify the rights and responsibilities of relevant stakeholders, including MA holders, distributors, research sites, health institutions, physicians, and patients. They are required to monitor adverse events and incidents, investigate and report them. It is essential to establish a pharmacovigilance or technovigilance unit, designate an individual responsible for pharmacovigilance or technovigilance, as applicable, and maintain a comprehensive pharmacovigilance or technovigilance manual. Phase IV data is usually required only for more complex products, such as biologics or biotech drugs, as determined by the New Molecules Committee.

The import of all MP and certain MD requires health import permits issued by COFEPRIS. There are exceptions to the requirement for obtaining a health import permit, applicable only for non-commercial purposes, including (i) personal use, (ii) donations, (iii) experimental use, and/or (iv) treatment of low-prevalence diseases.

Food products are typically subject to post-marketing surveillance and do not require an MA. A notable category is specialized nutritional formulations, which are regulated under the SRMP and require an MA. This requirement is a unique aspect of the local legal framework, as the regulatory treatment of specialized nutritional formulations in other jurisdictions is more similar to that of food products.

The regulatory category of food supplements in Mexico includes products formulated based on herbs, plants, algae vegetable extracts, traditional foods, and concentrated or dehydrated foods; which may or may not be added with vitamins or minerals, in combination or in isolated form, that are presented in a pharmaceutical form; with the purpose of incrementing, complementing the total dietary ingest, or substitute any of its components. Dietary supplements may contain any permitted plant included in the Decree of Plants and the List of 18 Plants, as well as additives contained in the Decree of Additives, but must comply with the limits and restrictions outlined in these decrees. This regulation is also applicable to food ingredients, additives, and adjuvants.

The Decree of Plants, published in 1999, lists plants that, in addition to psychotropic and narcotic substances, are forbidden for use in teas, infusions, and food products. It also contains a list of plants that may be used, but should always include the warning “Attention: Do not ingest if pregnant”. Finally, it contains a list of vegetable oils and their permitted sources. In 2017, COFEPRIS published a List of 18 plants on its website that complements the Decree of Plants. While not officially integrated into the Decree of Plants, COFEPRIS has authorized its use in the meantime.

The Decree of Additives lists additives in 11 Sections. Each section corresponds to a category of additives, which describes the allowed use of the additive within that category and indicates the maximum dose permitted for each.

Dietary supplements may not contain in their formulation procaine, ephedrine, yohimbine, germanium, animal or human hormones, or plants forbidden for use in teas and infusions, or any other pharmacological substance as ingredients.

Food supplements are subject to a system of health notifications, which includes (i) a notice of operation for their commercialization, (ii) an import permit, and (iii) an advertising permit.

While food supplements are subject to post-commercialization control, the Regulations Regarding Advertising (Reglamento de la Ley General de Salud en Materia de Publicidad “RLGSMP”) contains very stringent regulations applicable to their labelling and advertising, including the requirement for advertising authorization and the prohibition of food supplements containing active pharmaceutical ingredients or making any therapeutic claims.

It is essential to ascertain whether a product aligns with the local definition of a dietary supplement because some products may be considered a food supplement in other jurisdictions but fall under a different regulatory category in Mexico, and because other products closely resemble regulated product categories. For instance, border products could be classified as a food product, a food supplement, or a medicinal product, depending on the quantities of their ingredients.

To confirm the correct product classification and the permitted limits and restrictions on certain ingredients based on the product’s qualitative and quantitative composition, as well as the assessment of its label and advertising materials, must be considered.

A formal product classification, known as a “ruling request,” may be submitted to COFEPRIS, which, in turn, may be litigated if the result is inconsistent with the company’s initial product evaluation.

MA holders must comply with good manufacturing practices, as well as stability, pharmacovigilance, or technovigilance standards and regulations, and labelling requirements. They are also required to comply with advertising regulations applicable to MPs or MDs. The importance of obligations related to product recall is increasing.

Following NOM-240-SSA1-2012 – Technovigilance and NOM-220-SSA1-2016 – Pharmacovigilance (and its modifications), MP and MD must undergo post-approval vigilance. These regulations delineate the rights and responsibilities of relevant stakeholders who are required to monitor, investigate, and report adverse events or incidents. It is imperative to establish a pharmacovigilance or technovigilance unit, designate an individual responsible for pharmacovigilance, appoint a person for technovigilance, and maintain a comprehensive pharmacovigilance or technovigilance manual. In addition, standard operating procedures for product recalls are required.

COFEPRIS oversees Mexico’s healthcare supply chain, which includes medicinal products, medical devices, food, and supplements. COFEPRIS operates as an autonomous agency within the administrative framework of the Ministry of Health (MoH), possessing complete technical, operational, and administrative independence. COFEPRIS has the primary responsibility for issuing and enforcing health regulations, which is encapsulated in its authority over health control. This authority is principally demonstrated through (i) the issuance of health authorizations and (ii) the verification of compliance with health regulations.

COFEPRIS is a federal authority that oversees the entire system and shares health control power with similar State authorities in each of the 32 federal entities, including Mexico City. The distribution of health control powers between COFEPRIS and any given federal entity is defined in state-specific Coordination Agreements. Generally, under Coordination Agreements, COFEPRIS retains the authority to issue authorizations, while the authority to verify compliance is primarily delegated to state health authorities.

Verification of compliance is conducted through either (i) on-site inspection visits, where inspectors pay a visit to a physical establishment and review compliance with regulations applicable to different types of establishments, the type of activities performed therein, and/or the products handled there, or (ii) a desk review, in case of advertising verification, which is done remotely from the authorities’ offices, over the respective advertising material.

COFEPRIS has discretionary authority to determine whether an inspection should proceed to a sanctioning phase. The range of potential sanctions includes (i) a warning, (ii) a fine, and (iii) the closure of an establishment. The most common penalty is an administrative fine, determined by the applicable range (minimum and maximum) for the specific regulatory obligation not fulfilled. In 2024, COFEPRIS published The GRRUPI: Quick Guide for Influencers Responsible for Advertising in Health to provide orientation on influencers’ social media activities regarding regulated products that may constitute advertising. Nonetheless, influencers are not captured by the health advertising legal framework, which is focused on MA holders.

Consumer protection is regulated through the Federal Law of Consumer Protection (“FLCP”), which is enforced by the Mexican Consumer Protection Agency (“PROFECO”). The FLCP aims to offer protection against false advertising and consumer fraud. When such issues are detected, PROFECO may impose preventive measures, including immobilization, product seizure, suspension of commercialization, product recalls, and suspension of advertising. Advertising is considered false if it refers to characteristics or information about a product that may not be truthful, or if it induces error or confusion because it is falsely or exaggeratedly presented by the supplier. Under these regulations, consumers are entitled to reimbursement and, in some cases, both reimbursement and compensation. If PROFECO finds a violation of the FLCP or that a certain product is not compliant with applicable technical regulations, it may also sanction the supplier. In 2023, PROFECO published The Advertising Guide for Influencers to highlight that influencers’ social media activities constitute advertising. PROFECO is especially vigilant in sectors where there may be significant risks to individuals or vulnerable groups, including health services and products. Nonetheless, influencers are not quite captured by the consumer protection legal framework.

Mexico’s data protection regulator is the Data Protection Unit of the Ministry of Anticorruption and Good Government (“SABG”), which has authority over the data contained in the MA dossiers and the personal data of clinical trial patients. SABG promotes awareness of data protection rights, encourages their exercise, and ensures compliance with relevant laws and regulations. The SABG can audit, request information, and enforce access, correction, cancellation, opposition, and revocation rights on public and private entities. It is expected that the new DPA will adopt a significantly tougher enforcement stance. The SAGB has already called for a comprehensive reform of the data protection law to increase sanctions, stating that the current framework is “toothless” and insufficient to ensure corporate compliance. This reinforces the expectation that enforcement will become more assertive while the government simultaneously pursues broader legislative changes.

Litigation against decisions made by COFEPRIS is fairly common, especially regarding sanctions. Since the COVID-19 pandemic, there has been an increase in regulatory litigation primarily related to the lack of responses on renewals, modifications, rejections, and inspection procedures. This type of litigation is more sophisticated and requires a thorough understanding of technical regulations and their proper interpretation. In 2022, the total number of litigation cases against COFEPRIS surged to 12,000, averaging approximately 40 cases per day.

President Claudia Sheinbaum has announced a plan to address the administrative backlog by prioritizing pending applications that have received tacit approval under secondary regulations.

Tacit resolution is a legal rule that gives certainty to the applicant. Under this rule, after the legal time for an authority to issue a resolution has elapsed, if the authority has not issued a final resolution, the application is generally considered denied. However, in some instances, there is a special rule by which such an application is considered tacitly approved.

Generally, COFEPRIS’s decisions over denying an MA or imposing a sanction may be challenged through three main appeal proceedings:

• a revision recourse/writ of revision, decided, in this case, by the same authority that issued the original administrative decision;
• a nullity trial, decided by the Federal Administrative Tribunal; and
• an amparo trial, decided by a judicial body, a judge, or a court, depending on the nature of the decision being challenged.

Depending on the specific circumstances of each case, a different appeal proceeding will be best suited to achieve the business objectives.

Clinical trials are regulated by (i) the GHL, (ii) the Secondary Regulations on Clinical Research, (iii) NOM-012-SSA3-2012 – Criteria for the execution of research projects for health in humans, (iv) the Guidelines of Good Clinical Practice published by the COFEPRIS, and (v) the Decree for the Operation of Ethics Committees issued by the National Commission of Bioethics.

In March 2025, an Official Decree was published to set out Guidelines on the authorization of Clinical Trials authorized by foreign regulatory authorities, including the European Medicines Agency, the Food and Drug Administration, Health Canada, and the Medicines and Healthcare products Regulatory Agency. This official decree represents the legal basis for regulatory reliance on clinical trials.

Clinical research requires authorization from COFEPRIS, which is connected to the approval of the research protocol by an ethics committee and a research institution. Typically, clinical trials (Phases I–IV) must be based on pre-clinical data, conducted according to scientific and ethical standards, performed with the informed consent of participants, executed under a research protocol, overseen by a principal investigator, and carried out within licensed health institutions.

Securing authorization to conduct a clinical trial for a pharmaceutical or medical device involves three basic steps, which must be completed sequentially and cannot be applied for simultaneously, as follows:

(I) A favourable opinion of the research protocol by the ethics committee of the health institution where the trial is to be conducted must be obtained. According to the Decree on the Operation of Ethics Committees, this review must be completed within 30 business days of filing.

(II) The research protocol must be authorized by the director of the health institution where the trial is to be conducted in accordance with the appropriate internal regulations.

(III) Approval of the research protocol from COFEPRIS within three months of filing.

Mexico’s clinical research industry faces challenges stemming from an underdeveloped legal framework and a regulatory backlog. Despite this, Mexico remains an appealing destination for clinical research due to its diverse population, skilled workforce, and suitable infrastructure.

Most trials are recorded in the National Registry of Clinical Trials (Registro Nacional de Ensayos Clínicos, or “RNEC”) after the COFEPRIS authorizes their protocols. COFEPRIS and clinical trial sponsors, Contract Research Organizations (“CROs”), or healthcare institutions collect the information in the RNEC. The RNEC provides an electronic database containing general clinical trial information. This demonstrates progress, as previously, very little local information was publicly available. Confidential information does not form part of the RNEC; similarly, patients’ health information is classified as sensitive personal information under data protection laws and will be safeguarded accordingly.

There is no binding requirement to disclose or publish the results of clinical trials. However, the Council of Ethics and Transparency of the Pharmaceutical Industry (“CETIFARMA”) Code of Ethics requires sponsors to disseminate both positive and negative trial results, including information on adverse events.

In Mexico, the rules for using data from clinical trials depend on whether the data contains personal information or is disaggregated. If the data is disaggregated and does not contain any identifiable information, it is not considered personal data and is not subject to privacy laws. However, if the data contains personal information, it is classified as sensitive personal data (e.g., patient health data). In this case, the data subject’s express consent is required for the collection and transfer of this type of data. Privacy notices must be clear, concise, and easily accessible. For sensitive data, privacy notices must include an express warning regarding the collection and list all sensitive data items being processed.

The data must be handled in accordance with the Federal Law on the Protection of Personal Data held by Private Parties (“LFPDPPP”). The new LFPDPPP replaced a previous LFPDPPP enacted in 2010, and seeks to provide a comprehensive framework for safeguarding personal data and upholding individuals’ rights. It outlines the responsibilities of data controllers and processors (to be engaged by the sponsor as the owner of the clinical trial data) and the security measures that must be implemented to protect the data.

Despite confusing terms being introduced to the LFPDPPP in 2025, it could be argued (and it should be clearly asserted from the contract) that data controllers are responsible for determining the purposes and means of processing personal data. Their responsibilities include ensuring that personal data is processed lawfully, fairly, and transparently, collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes. Data controllers must also ensure the accuracy and integrity of the data and implement appropriate technical and organizational measures to protect it.

On the other hand, data processors process personal data on behalf of the data controller. Their responsibilities include processing data only in accordance with the data controller’s instructions, implementing appropriate security measures to protect the data, and assisting the data controller in ensuring compliance with data protection obligations.

Both data controllers and processors must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The data controller must incorporate and maintain administrative, technical, and physical measures within its organization to protect personal data from damage, loss, alteration, destruction, or unauthorized use, access, or processing. To define these measures, the data controller must assess factors such as risks to personal data, whether sensitive personal data is being processed, current technical developments, and the possible consequences for data subjects in the event of a breach.

The data controller should also create and maintain inventories of personal data items collected from subjects and of the security systems used to process this data. They must define functions and obligations for officers in charge of protecting personal data, conduct regular risk assessments to identify potential risks affecting personal data, conduct gap analysis and regular audits to identify risks and areas for improvement, design action plans to address issues identified in assessments or audits, provide training to officers involved in processing activities, and update security measures based on audit recommendations or after confirming unauthorized access or disclosure of personal data.

Since 2022, the COFEPRIS has implemented efforts to transition to a fully digital administration of its applications and procedures, including clinical trials, through its digital platform DIGIPRIS. This is an ambitious project, and full implementation is expected in 2027. Along with this digitalization trend, COFEPRIS has taken significant steps to simplify administrative procedures and achieve regulatory harmonization with other reference authorities to align technical criteria, further implement reliance, eliminate obsolete applications, and tackle the administrative backlog.

In the context of health regulations, “process” is meant to encompass all activities, including obtaining, elaborating, manufacturing, preparing, conserving, mixing, conditioning, bottling, manipulating, transporting, distributing, warehousing, and wholesale, as well as retail, activities, for products such as MPs, MDs, food products, and food supplements.

Establishments involved in the MP and MD processes require health authorization and the designation of a health-qualified person who oversees applicable regulations and standard operating procedures to ensure quality is applied. Moreover, establishments in which MP are manufactured require a manufacturing license. In contrast, establishments in which MDs are manufactured are subject to a notice of operation.

Establishments involved in the wholesale of MP and MD are only required to submit a notice of operation to the COFEPRIS. The notice of operation is free of charge, takes effect upon filing in DIGIPRIS (the COFEPRIS platform that enables more agile procedures and services), and has no expiry date. The exception to the general rule is warehouses dedicated to the wholesale of controlled pharmaceuticals (e.g., psychotropic and narcotics) and/or biological products for human use, which are subject to a license.

To obtain a manufacturing license for an MP establishment, it is necessary to secure a certificate of Good Manufacturing Practices (“GMP”). To proceed, a COFEPRIS inspection visit must be requested at the manufacturing facility. This visit will assess the establishment’s compliance with NOM-059-SSA1-2015 – Good Manufacturing Practices of Medicinal Products. If COFEPRIS determines during the inspection visit that the facility complies with the required standards, a certificate will be issued. This certificate must be included in the manufacturing license application. Upon submission of the application, COFEPRIS will process and issue the manufacturing license within 60 business days. The activities generally permitted by the manufacturing license include the production and storage of pharmaceuticals within the same facility. The manufacturing license is issued without an expiration date.

Establishments involved in the process of food and food supplements are subject to a notice of operation only.

The notice of operation reflects the holder’s declaration of the industrial activity performed in the establishment related thereto. The industrial activity in a notice of operation is specified using the North American Industrial Classification System (“SCIAN” in Spanish), which assigns a code to each industrial activity in the catalogue. The catalogue of industrial activities is the attachment I to COFEPRIS’s Decree of Procedures. The relevance of correctly stating the activities performed in a given establishment stems from the fact that, in the event of an Authority visit, it will verify compliance with the regulations applicable to that specific activity.

See question #11. The distribution of medicinal products, medical devices, and food supplements in Mexico is a regulated activity and, as such, shall be declared in the notice of operation or health license, if applicable, by stating the SCIAN code that correctly reflects both the regulated product and activity.

In Mexico, the private and public markets for medical products have separate rules depending on whether the products are patented. This mainly applies to pharmaceuticals and has changed during the new federal administration.

The general legislative basis of the dual system is contained in two laws: the GHL (Article 31) and the Federal Economic Competition Law (Article 9). However, the remaining rules are largely set out in separate regulatory instruments at a lower hierarchical level, including the Addendum to the Agreement for Drug Pricing Co-ordination, signed in 2004 between the Ministry of Economy and the National Chamber of the Pharmaceutical Industry, and NOM-072-SSA1-2012 – Labelling of Medicinal Products.

Patented drugs for the private market are subject to a hybrid system that is largely self-regulated and voluntary. Under this system, companies compile their own information on prices in other jurisdictions and submit it to the authority, which monitors the accuracy of the data. The manufacturer is required to stamp the price on the product’s label at the end of the manufacturing process. The PROFECO verifies that the prices at the point of sale (e.g., pharmacies) do not exceed the price.

Generic drugs, off-patent products, and medical devices in general are not covered by this pricing regulation, as they are subject to direct price competition in the market. As explained here, newly launched products are initially exempt.

The Mexican system operates not through a reimbursement model but through a public procurement model for drugs and medical devices.

The RLGSMP contains general regulations on advertising and specific rules for each regulated product category, some of which are mentioned in question #1. Advertising of products shall always be consistent with the product’s regulatory classification and authorized conditions. The primary legislation regarding advertising is the General Health Law and the RLGSMP; other laws, such as the Intellectual Property Law and the Federal Consumer Protection Law, also regulate advertising and include provisions on it. These regulations are enforced by the COFEPRIS, ensuring that the advertising and labeling of medications provide adequate directions for use and are not misleading or false in any way.

COFEPRIS has issued and continues to modify guidelines for the voluntary review of direct-to-consumer advertisements of medical products. The MA of medicinal products and the MD contain an indication of the audience towards which advertising of the product may be directed. In turn, this determines whether the advertising is subject to a health advertising permit or a health advertising notice. Generally, advertising directed to a broader audience requires an advertising permit, whereas advertising directed to the medical and scientific audience requires an advertising notice.

Regulated products not subject to an MA, such as pre-packaged food products with front-of-package labeling and food supplements, are subject to a health advertising permit.

The RLGSMP also establishes that advertising of regulated products shall avoid making claims that are not supported by a specific regulatory category or by scientific or clinical evidence. For instance, a food supplement may not claim therapeutic effects, or a cosmetic may not claim to modify the proportions or characteristics of the human body, but a medical device may.

Patents and trademarks for medical products, medical devices, and food supplements are regulated by General Industrial Property Regulations, specifically, the Federal Law for the Protection of Industrial Property (“FLPIP”), which came into force on November 5, 2020, and are granted by the Mexican Institute of Industrial Property (Instituto Mexicano de la Propiedad Industrial “IMPI”). This law was enacted to comply with some international treaties, including the United States-Mexico-Canada Agreement (USMCA) Chapter 20 and Trade-Related Aspects of Intellectual Property Rights. The new regulations for the FLPIP have not yet been published. Although additional amendments to the FLPIP are anticipated, the previous regulation remains in force for now.

Article 167 Bis of the Health Supplies Regulation and Article 47 of the FLPIP Regulation establish the legal foundation for Mexico’s Patent Linkage system. This system strengthens communication between the IMPI and the COFEPRIS, helping prevent patent infringement issues related to marketing authorizations. In practice, before a medicine can be approved for sale, authorities must verify that the applicant either owns the relevant patent or has authorization from the patent holder to use it.

Under these provisions, applicants seeking marketing authorization for an allopathic medicine must include documentation showing that they hold the patent covering the medicine, or that they have a valid license, both duly registered with IMPI. IMPI also publishes the Gazette of Medicaments at least twice a year, which COFEPRIS consults when reviewing marketing authorization requests.

In Mexico, patent listings are associated with the International Nonproprietary Name (INN) of the active ingredient, rather than with a particular company or specific approved product. This allows multiple patents to be linked to a single active ingredient, and a single patent may appear multiple times if it covers more than one ingredient. The Gazette includes patents for active ingredients, compositions, and uses.

Additionally, COFEPRIS requests a technical opinion from IMPI to confirm whether any patent could be infringed by the approval requested.

Furthermore, despite the above rules, it is possible to apply for marketing authorization for a generic medicine still protected by a patent solely for the purpose of conducting studies, tests, and experimental production during the final three years of the patent term. In such cases, the marketing authorization may only be granted once the patent expires.

Finally, an agreement published in the Official Gazette on March 6, 2025, formalized the collaboration between IMPI and COFEPRIS. This agreement reinforces their existing cooperation on patent linkage, allows for the Medicine Gazette to be published at least twice a year, and institutionalizes an opposition process for generic and biosimilar marketing authorization applications that may infringe valid patents.

In Mexico, patent litigation, including cases related to medicinal products and medical devices, is initially handled by the IMPI, which addresses cases of patent infringement and invalidity. Unlike other jurisdictions, Mexico does not have a discovery process; however, parties may request that IMPI order the defendant or relevant third parties to submit evidence and information necessary for the proceeding. Because discovery is not available, parties must submit evidence along with the initial complaint. Any type of evidence, except testimonial and confessional evidence, is admissible to establish infringement. It is common for parties to provide expert opinions and request IMPI inspection visits.

Preliminary injunctions are available to cease from performing infringing activities. Once the plaintiff files the infringement claim and supporting evidence, and IMPI accepts it, the defendant has 10 business days to respond. The defendant can argue non-infringement and may also counterclaim the patent’s invalidity. The invalidity process is similar to the infringement process, with the main difference being that the response time for an invalidity complaint is one month. If an invalidity counterclaim is filed, both the infringement and invalidity actions will be resolved together by IMPI to avoid contradictory decisions.

Additionally, since 2020, the Federal Law on the Protection of Industrial Property (“LFPPI”) stipulates that the indemnity for patent infringement will never be less than 40% of the “legitimate value indicator” presented by the affected party, either directly before a Federal Civil Court or before IMPI after concluding the infringement action. If the case is brought to the Civil Court and an invalidity action is filed with IMPI before the IMPI decision is final, the Civil Court case will be suspended until the IMPI decision is final. The “legitimate value indicator” can be calculated using any of the following methods, starting from the date of infringement:

• The value of the infringed goods or services, calculated at the market price or suggested retail price;
• The profits that the owner would have lost due to the infringement;
• The profits that the infringer has gained from the infringement;
• The price the infringer would have had to pay the owner for a license, considering the commercial value of the infringed right and any existing contractual licenses.

Decisions made by the IMPI can be appealed to the IP Specialized Court of the Federal Tribunal on Administrative Matters. If necessary, the decisions of the IP Specialized Court can be further appealed to the Federal Circuit Courts.

Mexican culture has promoted the use of alternative dispute resolution mechanisms, reducing the reliance on jurisdictional procedures. The LFPPI (Chapter IV) includes a conciliation procedure for patent violation cases.

There are no direct restrictions on the use of the trademark rights unless a prior annulment declaration has been issued by the IMPI. However, antitrust, consumer protection, and sanitary restrictions could affect the use of trademarks, although they do not compromise the validity of the trademark. For example, the name of a pharmaceutical product might initially be protected by a registered trademark but could eventually be disallowed by the COFEPRIS due to different approval criteria on distinctiveness (e.g., the health law legal framework prohibits names that contain the same three letters in a word or any reference to organs and diseases in the product’s name).

In addition, limitations on the use of a trademark may arise from infringement actions based on unfair competition or trade dress violations. Since prior use rights are recognized under the LFPPI, restrictions on the exclusive use of a protected trademark could also be updated, as prior users are not considered infringers.

From a health regulatory standpoint, the concept of health-related “product liability” is not extensively developed in Mexico. The most explicit regulations pertain to liability arising from clinical trials, where there is a clear obligation for the sponsor to cover medical treatment required to address complications directly related to the clinical research. However, broader notions of damage are not as clearly defined.

Regarding health-related services, liability pertains to medical negligence, where physicians (individuals) may be held professionally liable for acts or omissions evaluated against the lex artis.

In Mexico, general rules of damages establish both contractual and non-contractual liability. Within non-contractual liability, there are different scenarios:

Objective liability – For inherently risky products arises under two circumstances: (i) within the consumer protection framework, when the supplier fails to provide the Instructions of Use; and (ii) under the civil code framework, unless it is proven that the damage resulted from the fault or inexcusable negligence of the victim. Regarding to the objective liability circumstance number (i), from a consumer protection perspective, it is important to consider that in the case of products or services that are considered potentially dangerous for the consumer, the supplier must include an instruction that warns about their harmful characteristics and clearly explains the recommended use or destination and the possible effects of their use, application or destination outside the recommended guidelines.

Subjective liability – This form of liability requires proof of illegal conduct, and it applies unless it can be demonstrated that the damage occurred due to the fault or inexcusable negligence of the victim. Manufacturers are required to adhere to quality control systems under the regulations that govern NOMs. These systems play a critical role in evaluating the standard of care within the subjective liability framework.

Class Actions were created in Mexico in 2011. While healthcare wasn’t explicitly included in the legal framework, the private healthcare market is covered by consumer protection law. So far, we have not seen a Class Action in the healthcare sector.

Administrative liability

The principal risk areas for administrative liability in a healthcare context are 1) interactions with Healthcare Professionals (“HCP”) who may work, at least part-time, in government hospitals or clinics, 2) interactions with government officials involved in the procurement of healthcare products or services and 3) legal actions related to failures or alleged failures to comply with regulatory requirements that apply to operations (including manufacturing, distribution, and detailing) medicinal products, medical devices, foods, and food supplements. Additionally, liability in privacy and consumer protection matters is considered under the administrative scope. This includes ensuring compliance with data protection and consumer protection laws and regulations to avoid penalties.

Companies must consider the risks related to interactions with public officials when managing permits or licenses for pharmaceutical products or medical devices, or when marketing or promoting them. The General Law of Administrative Responsibilities (“GLAR”) establishes the obligations, responsibilities, and sanctions for public officials and private parties who commit administrative offenses. Under the GLAR, “serious administrative offenses” (faltas administrativas graves), both for government officials and private parties, include bribery, and officials who engage in any of these offenses may face consequences ranging from suspension of office to dismissal from their job, position, or commission.

The GLAR provides that private parties commit the administrative offense of bribery if they promise, offer, or deliver any undue benefit to public officials in exchange for the public official performing or refraining from performing any act related to their functions or those of another public official or abusing their influence to obtain or maintain a benefit or advantage, whether or not the benefit or advantage materializes.

Companies that commit serious administrative offenses are subject to financial sanctions, disqualification from participating in public contracts, suspension of activities, and even corporate dissolution. Legal entities may be sanctioned with the suspension of activities and/or dissolution when (i) the company has obtained an economic benefit and the participation of the administration or oversight bodies or its partners is proven, and (ii) when the entity has been used systematically for the commission of serious administrative offenses.

In practice, many HCPs in Mexico work in both the public and private sectors by operating their private practices while also working in public hospitals. For that reason, if HCPs hold a position in any public hospital, the GLAR provisions apply to them because they are considered public officials. In this scenario, companies should conduct a case-by-case analysis of any HCP with whom they have contact or a business relationship and the position held by the HCP in any public entity due to the risk it may represent for companies and for the HCP himself or herself.

Additionally, the GLAR sanctions “collusion” (colusión) when two or more private entities engage in actions that involve or have the purpose or effect of obtaining an undue benefit or advantage in federal, local, or municipal public contracting processes. This provision correlates to the administrative sanctions established in the Mexican Competition Law.

The standard of evidence to impose sanctions for these administrative offenses is the same as in the criminal setting, which is “beyond a reasonable doubt.” The investigation of these violations is the responsibility of the Secretary of Anti-Corruption and Good Governance, who may initiate an investigation into contracts entered into between government entities and private parties.

On the other hand, COFEPRIS can request reports from the MA and conduct on-site inspections of manufacturing, distribution, and/or storage facilities. COFEPRIS can initiate legal proceedings that can result in the revocation of authorizations, seizure of products, and suspension of activities. COFEPRIS also has the authority to impose fines up to 16,000 times the minimum wage for facility closures.

Privacy

Failure to comply with the LFPDPPP may result in monetary penalties of up to USD 3.6 million when Sensitive Personal Data is involved. It should be noted that, under the LFPDPPP, these penalties are exclusive of any claim for damages that could be filed by the data subject.

Additionally, there are some criminal implications to be aware of regarding data privacy. The act of compromising the security of a database containing Personal Data to profit is a criminal offense, punishable by up to 3 years’ imprisonment and up to 6 years when Sensitive Personal Data is involved. Furthermore, the act of collecting, using, disclosing, or storing Personal Data through deceit and with the intent to profit is also considered a criminal offense, punishable by up to five years of imprisonment and up to ten years when Sensitive Personal Data is involved.

As noted above, the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) demonstrated a strong enforcement record. We anticipate that SABG would become an even tougher authority.

Consumer Protection

Among the general obligations of consumer protection are to provide adequate and clear information about the different products and services, with correct specification of quantity, characteristics, composition, quality, and price, as well as about the risks they represent, and to avoid misleading advertising. Failure to comply with the Federal Consumer Protection Law may result in monetary penalties of up to USD 205,925 and USD 307,877 for particularly severe cases.

Criminal liability

The National Code of Criminal Procedures (“NCCP”) establishes that companies are guilty of a crime if the crime has been committed for the benefit of, on behalf of, in the name of, or with the resources of the company, and if the company has failed to establish “due control.” This liability is irrespective of the criminal liability that individuals may have. However, because corporate crime does not require showing intent (only a lack of “due control”), individuals may be liable as accessories to corporate crime even if the individual criminal guilt would be harder to prove. The NCCP’s burden of proof to sanction private parties is “beyond any reasonable doubt.”

The NCCP limits corporate crimes to those listed in the catalogues established in the Federal Criminal Code and by the local criminal code of each Mexican state. Among others, the Federal Criminal Code establishes corporate liability for money laundering, bribery, influence peddling, drug trafficking, fraud, tax fraud, and concealment. Nevertheless, in states that have not published their limited list of crimes for corporate liability, companies may be liable for homicide, assault, crimes that threaten life or against the health of people, etc. These may be relevant in a healthcare context.

The GHL expresses a list of actions that constitute criminal offenses and administrative responsibility, stating the following:

1. Article 464: Anyone who adulterates, falsifies, contaminates, or alters food, non-alcoholic beverages, or any other substance intended for human use, posing a health risk, shall face one to nine years of imprisonment and a fine of one hundred to one thousand days of the minimum wage.
2. Article 464 Bis: Anyone who, knowingly or by the means of another person, authorizes or orders the distribution of spoiled or unsafe food, endangering another’s health, for their position in food institutions, shall face six months to two years of imprisonment or a fine of five hundred to five thousand days of the minimum wage.
3. Article 464 Ter: Whoever adulterates, counterfeits, contaminates, alters, or manufactures medicines without the requirements mandated by law shall face three to fifteen years of imprisonment and a fine of fifty thousand to one hundred thousand general minimum wages.
4. Article 464 Quarter: Whoever adulterates, falsifies, contaminates, and alters or permits the adulteration, falsification of medical devices, their final containers for use, or manufactures them without a corresponding MA shall be condemned to three to fifteen years of imprisonment.

The same goes for anyone who adulterates, falsifies, permits adulteration or falsification of medical device packaging material, labelling, or changes its legend information and/or its identification numbers or keys.

While the field of digital health is constantly evolving, it remains relatively new in México, limiting its practical application. A recent amendment to the GHL, published in January 2026 (the ”Amendment”), included the first regulatory definition of digital health as the application of TICs to health services, as is the case, among others, with telehealth, telemedicine, mobile health, medical or health records, and portable devices. The inclusion of portable devices in the definition of digital health is a key addition to the regulatory framework that lays the basis for developing secondary regulations aimed at addressing the broad categories and health applications of medical devices with a top-to-bottom approach.

The health regulatory framework includes various product and service categories that encompass digital health applications, primarily the GHL, the SRMP, NOM-241-SSA1-2021 (Good Manufacturing Practices for medical devices), and the Mexican Pharmacopeia.

From a health regulatory perspective, the lack of specific regulations for digital health applications results in these being governed by the existing general rules that apply to traditional medical consulting rooms. These rules typically assume a physical establishment and in-person interactions.

The MD product category is highly pertinent to digital health applications. MDs encompass sub-categories such as medical equipment, prostheses, diagnostic tools, dental products, surgical and healing products, and hygienic products. Currently, the Mexican Pharmacopeia and its supplements serve as the most comprehensive legal instrument for regulating digital health applications.

The Mexican Pharmacopeia Supplement on Establishments encompasses technical requirements pertinent to digital health, including key elements of e-prescriptions. Additionally, the recently revised Mexican Pharmacopeia Supplement on MDs has introduced a comprehensive Appendix on SaMD, which outlines detailed rules concerning the definition of SaMD, risk classification, quality system standards, clinical evaluation procedures, and mobile applications.

From a health regulatory standpoint, digital health applications can be classified as products, services, or both. When a regulatory category is triggered, numerous obligations and requirements become enforceable.

If a digital health product is determined to be an MD, several regulatory obligations will apply, including obtaining prior MA. Additionally, other requirements must be met, such as (i) product-related requirements like advertising rules, (ii) establishment-related requirements such as good distribution practices regulations, and (iii) company-wide requirements including operating a techno-vigilance system.

If a digital health application is determined to be a healthcare service, several requirements must be met, including (i) filing a notice of operation for at least one consulting room, (ii) verifying the physician of record has a valid license to practice medicine in Mexico, and (iii) ensuring that the consulting room operates in full compliance with other technical requirements including minimal requirements of infrastructure and equipment.

The lack of specific regulations for digital platform providers in the digital health sector means that these entities are governed by existing general rules applicable to digital health applications, such as products, services, or establishments. These rules often assume in-person interactions or a brick-and-mortar establishment.

In recent years, several legislative initiatives have been introduced, including proposals to amend the GHL and specific NOMs, aimed at expressly regulating certain digital health applications. However, none of these initiatives has successfully passed into law.

From a privacy standpoint, digital health applications must comply with the LFPDPPP, which outlines the responsibilities of data controllers and processors, the requirements for privacy notices, and the security measures that must be implemented. In this context, the privacy notice must adhere to the principles of purpose, proportionality, and legality, tailored to the specific digital health product or service in question. Typically, these applications involve processing sensitive personal data, such as information about patients’ health status. Consequently, the relevant legislation applies, requiring the implementation of appropriate security measures and the data subject’s express consent to the collection and transfer of such sensitive personal data. These requirements are explained in greater detail in the answer to question #8.

Since 2019, Mexico’s Public Healthcare System has faced supply issues. These were primarily due to administrative changes in public procurement by former president Andres Manuel Lopez Obrador (2018-2024), who altered the medical supplies procurement process four times during his term.

There is a comprehensive legal framework for public procurement in Mexico, which is overseen by the Ministry of Anti-Corruption and Good Government and coordinated with the purchasing entity. On December 22, 2023, and October 29, 2024, a Presidential decree was published that ordered Laboratorios de Biológicos y Reactivos de México, S.A. de C.V. (“BIRMEX”) (a majority state-owned company that develops, produces, imports and markets vaccines and anti-venoms) to consolidate public procurement processes for the public health care sector which encompasses the Mexican Social Security Institute (“IMSS”), the Institute for Social Security and Services for State Workers (ISSSTE) and IMSS- Bienestar, National Health Institutes, and Federal Reference Hospitals. Under this decree, the Vice Ministry of Health was tasked with preparing a diagnostic of necessities and planning the consolidated purchase of medical products. Thus, BIRMEX now conducts the public procurement process on behalf of healthcare institutions, following the instructions of the Vice Minister of Health.

The current presidential administration, led by President Claudia Sheinbaum, has continued to implement public procurement under which BIRMEX consolidates all public procurement processes on behalf of the healthcare institutions, following the instructions of the Vice Minister of Health. To ensure the supply of medical products for the public healthcare system, the Ministry of Health issued a decree on December 4, 2024, allowing for the importation of medicines and medical devices that do not have an MA in Mexico, provided they possess an MA from certain recognized jurisdictions and are intended exclusively for the public market. For this purpose, it is necessary that the medicine or medical device is included in the national tender of medical products consolidated by BIRMEX and that an MA application is submitted following the first import of the product.

Two official decrees issued by the Ministry of Health (MoH) on January 28, 2020, and June 22, 2021, initially permitted the importation of medicines and medical devices without an MA during the pandemic. These decrees established the conditions under which this option could be exercised. A prior declaration of necessity from multiple authorities was required to activate the importation without an MA under these decrees. Both decrees have since been amended, and their mechanisms were superseded by the decree issued on December 4, 2024.

The current administration has declared its objective of positioning Mexico as the most attractive country in the region for medical product production. The aim is for Mexico to begin producing vaccines, including those based on mRNA technology. This initiative seeks to support the national vaccination program and ensure the country’s self-sufficiency in medical products, particularly in the event of a pandemic.

On July 2, 2025, an Official Decree to foster local investment, strengthen the pharmaceutical industry and the manufacture of health supplies was published (”Decree to Promote the Pharmaceutical Industry”) that establishes that participation in public procurement processes, shall be promoted amongst legal entities that (i) have investment in the manufacturing supply chain of medical products; (ii) demonstrate beginnings of investment in such supply chain; or (iii) develop scientific research or innovative health products. In the case of public procurement processes for generic medicines, a consideration will be given to legal entities that demonstrate (i) investment in the manufacturing supply chain of medical products; (ii) have begun to implement locally manufacturing facilities, laboratories or warehouses, that are part of such supply chain; or, (iii) develop scientific research or innovative health products.

The Decree to Promote the Pharmaceutical Industry also orders the creation of a Committee for the Promotion of the Pharmaceutical Industry (the ”Committee”), which will oversee public procurement procedures for single-source and patent medicines, to enable dialogue with the pharmaceutical and medical devices industries to analyse economic propositions to invest locally.

The guidelines to implement the Committee for the Promotion of the Pharmaceutical Industry were published on February 23, 2026 but the content and meaning of key terms such as ”investment”, ”supply chain”, ”demonstrate beginnings of investment’ or ”begun to implement locally” remain unclear leaving more doubts than certainty on the implementation of the Decree to Promote the Pharmaceutical Industry and the criteria under which the Committee will operate.

Medical devices

The Mexican Association of Innovative Industries of Medical Devices (Asociación Mexicana de Industrias Innovadoras de Dispositivos Médicos or “AMID”) is the association that represents companies of the medical devices innovation and diagnostic systems sector and is dedicated to the development of innovative medical technologies. AMID issued self-regulation applicable to its affiliated entities, including a Code of Conduct and a Code of Interaction with Health Care Professionals (the “AMID Codes”).

According to the AMID Code of Conduct, companies that commercialize medical devices must respect the following principles and guidelines:

• Companies must ensure that the medical devices they market are safe, effective, and of sufficient quality by complying with applicable current health regulations;
• Companies must implement the necessary mechanisms to ensure responsible conduct in activities such as sponsorship, donations, and promotion of their products;
• Companies must avoid any practices, agreements, or arrangements that have the effect or the purpose of reducing, obstructing, impeding, or conditioning free competition or economic competition among economic agents;
• Companies must not use their relationships with HCPs to influence or bias their commercial decisions through improper or undue advantages, avoiding any potential or actual conflict of interest;
• Relationships between companies and HCPs should remain independent from the use or recommendation of the companies’ products;
• Companies must always comply with applicable legal provisions in areas such as economic competition, anti-corruption, and health regulation, as well as market commercial standards.

Pharmaceutical associations

The National Chamber of Pharmaceutical Industry (Cámara Nacional de la Industria Farmacéutica or “CANIFARMA”) is an association that has established ethical standards, which are implemented by the Ethics and Transparency Council of the CETIFARMA. These standards are the expected behaviour of all pharmaceutical companies, whether or not formally members of the association.

Code of Integrity, Ethics, and Transparency for Healthcare Supply Companies

The CETIFARMA Code of Integrity, Ethics, and Transparency for Healthcare Supply Companies (Código de Integridad, Ética y Transparencia de Empresas de Insumos para la Salud or “Integrity Code”) establishes the guidelines for pharmaceutical companies established in Mexico, and is intended to develop an ethical culture and corporate integrity, based on a self-regulation system, committed to transparency, fighting corruption, etc. The Integrity Code requires that all promotional and marketing activities explicitly state their purpose and nature to avoid misunderstandings or deceit.

Code of Best Marketing Practices

CETIFARMA’s Code of Good Marketing Practices (Código de Buenas Prácticas de Promoción) defines the ethical principles for the interactions between HCPs and pharmaceutical companies to ensure that their marketing practices are not intended to unduly influence HCPs to prescribe their products. This Code prohibits pharmaceutical companies from providing or offering to a HCP anything of value as an inducement or reward for prescribing or recommending a particular medicine or course of treatment.

In a related vein, this Code provides that CANIFARMA member companies may be held responsible for the misconduct of third parties acting on their behalf. Therefore, companies must ensure that transactions involving third parties acting on their behalf are equally transparent and well-documented.

In March 2021, the First Chamber of the Supreme Court established guidelines to evaluate whether the human right to health has been properly protected (Legal precedent number 2022888, 1a. XIV/2021 (10a.)):

• Personal consideration: The Mexican state must consider the patient’s health, as well as their clinical and medical requirements, and must conduct its activities with the purpose of providing therapeutic and/or pharmaceutical treatment either to achieve a cure or to ensure the necessary treatment to control the disease symptoms (in case of chronic of degenerative disease), as well as controlling the worsening of patients’ physical and psychological integrity.
• Objective consideration: The Mexican state must guarantee that any medical treatment is suitable for the patient, to preserve the bioavailability and bioequivalence of the pharmaceutical product.
• Temporary consideration: The Mexican state must guarantee that the patient’s treatment is guaranteed in a timely, permanent, and continuous way.
• Institutional consideration: The Mexican state must guarantee that health institutions in charge of guaranteeing medical treatments provide services with the highest standards of technology and medical specialization.

Similarly, in October 2023, the Supreme Court established that the Mexican state has a duty of diligence and the obligation to provide medicines to patients facing diseases that require the periodic supply of medicines to protect life, integrity, and safety. This precedent was issued in the context of drug shortages in public hospitals, impeding people’s right to access a free healthcare system as established in the Constitution. (Legal precedent number 2027440, 1a./J. 151/2023 (11a.), issued by the First Chamber of the Supreme Court of Justice).

One of the core items of the Amendment is digital health with a focus on public health. The Amendment states that the purposes of digital health are: the provision of at distance health services to attend population necessities without the need of moving; optimizing the use of resources during the provision of health services; expanded coverage of health services, particularly for communities with limited access to medical infrastructure; provide support and advise to healthcare professionals through consultations with specialists; implement educational programs through digital tools directed to healthcare professionals to prevent diseases; digitalize health information of the patient to enable access, updated, and the secure exchange of health data between healthcare professionals and health establishments to ensure continuity of medical attention; and, analyze large volumes of data to identify patterns, optimize diagnostics and improve hospital management.

Among other objectives, the objective is to implement the ”right of interchangeability” for the Mexican population to seek health services at any public health institution of the National Health System, regardless of whether they are affiliated with that institution by virtue of their employment, or lack thereof. For this reason, digitalization of health records is key.

The MoH shall issue further regulations to implement, supervise, and continuously improve digital health services in all public institutions of the National Health System, which shall consider, among others, advisory to integrate technological infrastructure, considering needs, conditions and existing infrastructure; continuous education of healthcare professionals in the adequate use of digital health tools; elaborate guides and criteria to provide medical attention, including telemedicine, to warrant safety and quality of the attention; elaborate safety protocols for the confidentiality of patient’s health information and personal data.

The Chapultepec Declaration on Artificial Intelligence, published in 2026 by the Mexican government, was developed by a group of academics, policymakers, and civil society organizations in Latin America to frame a regional vision for the responsible development and use of AI. The Declaration seeks to provide guiding principles to inform public policy, regulatory approaches, and private-sector practices, while promoting innovation and safeguarding democratic values and fundamental rights in the region.

Substantively, the Declaration calls for a human-centric and rights-based approach to artificial intelligence, emphasizing principles such as transparency, accountability, fairness, privacy, and non-discrimination. It supports risk-based and proportionate governance models, encourages explainability and oversight of AI systems, and highlights the shared responsibility of governments, companies, and other stakeholders to prevent harmful or abusive uses of AI while ensuring that its deployment contributes to social welfare, economic development, and the rule of law.

Since 2022, COFEPRIS has implemented efforts to transition to a fully digital administration of its applications and procedures through its digital platform, DIGIPRIS. This is an ambitious project, and full implementation is expected for 2027. Along with this digitalization trend, COFEPRIS has taken significant steps to simplify administrative procedures and achieve regulatory harmonization with other regulatory authorities of reference to align technical criteria, further implement reliance, eliminate obsolete applications, and tackle administrative backlog.

There is a draft project to modernize the SRMP to the extent that a new regulation may have been published altogether. Although the final texts are not publicly available, it is common knowledge that this project will address certain digital health applications and potentially reflect the current digital nature of administrative procedures.

In April 2025, the Federal Executive enacted a new Law of Acquisitions, Leases and Services of the Public Sector, that, among others, (i) created the Digital Platform for Public Procurement, replacing Compranet, to provide greater agility and transparency to contracting procedures; all procurement processed of the federal administration must be conducted through this platform; (ii) modified and include new procurement procedures that public entities must follow, (iii) empower the Secretary of the Treasury to carry out consolidated purchases and will be the only entity that may carry out direct award processes with negotiation strategy, (iv) prioritize the use of subsequent discount offers so that the Mexican State could obtain the best market conditions; and, (v) allow public entities to carry out strategic dialogues with potential participants to procurement processes, prior to the contracting procedure.

In November 2025, Mexico issued the General Law for the Prevention, Investigation, and Punishment of Crimes Related to Extortion, for the prevention, investigation, punishment, and enforcement of criminal actions against the crime of extortion and other related offenses. The enactment of this law took place within the framework of the National Strategy Against Extortion, following several reports of extortion threats by companies operating in Mexico.

According to public media, the Congress will submit a bill to amend the National Anti-Corruption System and to restructure the anti-corruption prosecutor’s office to renew their heads, eliminate re-election, and prevent prosecutors from acting as subordinates of power. Similarly, public media reports that the Federal Executive will submit a bill to create a General Law to Investigate and Punish Crimes for Acts of Corruption (“GLIPCAC”), aiming to establish a uniform investigation and prosecution policy throughout the country by standardizing principles and guidelines of the anti-corruption prosecutor’s offices, and by giving them full autonomy to effectively investigate and punish cases of small- and large-scale corruption.

Mandatory Interoperability Is Coming: What Digital Healthcare Companies Need to Know. A key and often-overlooked trend for digital healthcare providers operating in Mexico is the need to prepare for mandatory interoperability with government authorities in the context of missing-persons searches. Recent legal reforms expand the scope of entities required to collaborate with authorities, expressly classifying healthcare providers and health-related digital platforms as “diverse institutions” subject to these obligations. As a result, healthcare organizations must be technically and operationally ready to connect their systems with government databases and respond to legally mandated information requests. Compliance obligations are scheduled to apply as of 1 March 2026, leaving limited time for preparation. From a practical standpoint, this will pose substantial challenges across multiple fronts, including system architecture and interoperability, product and service design, data governance, privacy compliance, and cybersecurity. Healthcare companies should begin assessing these impacts now, as failure to prepare may expose them to regulatory scrutiny, enforcement risk, and reputational harm in a highly sensitive and regulated sector.