LEXURE Editorial
The law, translated into decisions.
Impact notes, risk bulletins and diagnostics on the reforms that change how companies operate in Mexico. Each note explains what changes, what your company must do and by when, and which recommendations apply to mitigate the risk, with the official legal basis in plain view.
Signed by each practice teamRegulatory status verifiedOfficial legal basis in every note
50 notes
- Diagnostic
How legal risk builds up in a technology company and when it surfaces
Risk does not arrive with the inspection: it is triggered by the first hire, the first piece of personal data, and the first partner.
Preventive diagnostics7 min read - Diagnostic
The legal risk matrix by severity: how to read it from the CEO’s office
A useful matrix does not paint everything red: it ranks what to fix first by the actual cost the law assigns to each failure to comply.
Preventive diagnostics7 min read - Diagnostic
The six fronts of a comprehensive legal diagnostic and the evidence each one reviews
Having the document is not enough: a serious diagnostic asks for evidence that the obligation is met in day-to-day operations.
Preventive diagnostics7 min read - Diagnostic
Before the funding round: the legal review the investor will conduct
The investor will review share certificates, corporate books, code, and personal data. Anything not in order becomes a condition or a discount.
Corporate7 min read - Risk bulletin
When a corporate client audits its supplier: what it will ask for and how to prepare
Your client asks for your REPSE registration because the law holds it liable for you. Understanding its risk is the best way to pass the audit.
Preventive diagnostics4 min read - Diagnostic
S.A.S., S.A.P.I., or S.A. de C.V.: which vehicle can withstand a funding round
The corporate form that worked for the launch is rarely the one that can take a fund as a shareholder. It pays to know this before the term sheet.
Corporate7 min read - Diagnostic
Shareholders’ agreements in technology companies: what they protect and what they do not
A shareholders’ agreement protects founders and investors, but the law limits what can be enforced against the company. That is where the design begins.
Corporate7 min read - Risk bulletin
Corporate books, shareholders’ meetings, and powers of attorney up to date: evidence your company cannot afford to lose
Without books in order, the law takes your counterparty’s books as true. Without revoking powers of attorney before the third party, the company stays bound by someone who already left.
Corporate4 min read - Diagnostic
Family protocol: when it binds and when it is only a statement of good intentions
The family protocol has no specific regulation in Mexico. It binds only when its rules are carried into bylaws, agreements, trusts, or wills.
Corporate7 min read - Impact note
Beneficial owner: two laws, two thresholds, and a single obligated company
The Federal Tax Code measures control from more than 15 percent; the anti-money laundering law, from more than 25. Since 2025, both reach every commercial company.
Corporate5 min read - Diagnostic
Software as a service agreements: who pays when the platform fails
Mexico has no SaaS statute. The risk of an outage is allocated through clauses that the Federal Civil Code allows the parties to agree on and also limits.
Contracts7 min read - Diagnostic
Critical cloud providers: what your company still owes when the data is hosted elsewhere
Moving to the cloud transfers the operations, not the liability. Before the authority and the data subject, the data controller is still your company.
Contracts7 min read - Impact note
Subscriptions and recurring charges: what the December 2025 amendment requires
Since December 13, 2025, platforms must obtain express consent, give notice five days before renewal, and allow immediate cancellation.
Contracts5 min read - Diagnostic
Software development agreements: why paying for the code does not make it yours
Mexican copyright law requires an assignment that is written, for consideration, and for a term. Without one, the code your company paid for may still belong to whoever wrote it.
Intellectual property7 min read - Diagnostic
Electronic signatures and contract retention: when a signed PDF actually serves as proof
The Commercial Code recognizes electronic contracts. What gets litigated is whether the signing and retention method is reliable.
Contracts7 min read - Impact note
The 2025 personal data law: what changed and what your company must update
The 2010 law was repealed, the INAI was dissolved and the article numbering changed. Any notice or contract that cites the former law now cites a statute that no longer exists.
Personal data6 min read - Diagnostic
Privacy notice: the six elements the 2025 law requires and how to review them
The privacy notice is the most frequently copied personal data document and the one an authority can review most easily. Six elements determine whether it complies.
Personal data7 min read - Risk bulletin
Person or department for personal data: the designation the law requires of every company
The law exempts no one based on size or sector. Every company that processes personal data must designate someone to handle data subjects' requests.
Personal data4 min read - Impact note
Automated decisions and artificial intelligence: the new right to object
If your company scores, screens or makes decisions about individuals with an automated model, the 2025 law gave those individuals a right they did not have before.
Personal data6 min read - Diagnostic
Rights of access, rectification, cancellation and objection: deadlines in business days
Twenty days to respond and fifteen to comply. A poorly handled request is the most common entry point to a proceeding before the authority.
Personal data7 min read - Diagnostic
The duty to secure personal data: what measures the law requires and how to prove them
The law does not impose a closed list of technical controls. It requires measures proportionate to the risk, and the company must be able to show it adopted them.
Cybersecurity7 min read - Risk bulletin
Security breach: immediate notice to data subjects and the 72-hour myth
Mexican law does not grant 72 hours or require notice to the authority. It requires informing affected data subjects immediately, and that takes preparation.
Cybersecurity4 min read - Diagnostic
Legal incident response protocol: the decisions that cannot be improvised
The technical team contains the attack. But notifying data subjects, preserving evidence, filing a criminal complaint and responding to customers are legal decisions with consequences.
Cybersecurity7 min read - Impact note
Cybersecurity in Mexico: what can be required of a private company today
There is no general cybersecurity law in force. The enforceable obligations are spread across the data protection law, e-commerce rules and the Criminal Code.
Cybersecurity6 min read - Impact note
The April 2026 amendment to the industrial property law: what changes for companies
Maximum deadlines for the IMPI, new types of marks, provisional patent applications and penalties for conduct carried out with artificial intelligence.
Intellectual property6 min read - Diagnostic
Trademark registration with IMPI: what decides whether your brand is really yours
Anyone may use a trademark; holding it exclusively is another matter. Only registration grants that right, and filing errors can cost you the trademark or years of proceedings.
Intellectual property7 min read - Risk bulletin
Trademark declaration of use: the omission that makes a registration lapse without notice
In the third year of the registration and upon renewal, the owner must declare that it uses its trademark. If it does not, the registration lapses by operation of law.
Intellectual property4 min read - Diagnostic
Software and copyright: what the law protects, what it does not and what registration is for
Code is protected from the moment it is written. Registration does not create the right, but it determines who can prove it and against whom it can be enforced.
Intellectual property7 min read - Impact note
Content generated with artificial intelligence: who owns it and what can be protected
In Mexico, the author is a natural person. What a machine generates without human creative input cannot be registered, and that has consequences for your brand.
Intellectual property6 min read - Diagnostic
Trade secrets: why the information in your plant may not be protected
The law protects a trade secret only if the company took measures to keep it and gave notice of its confidentiality. Without evidence, there is no secret.
Intellectual property7 min read - Impact note
Medical devices: the abbreviated regulatory pathway COFEPRIS opened in 2025
A device already authorized by a reference authority can obtain registration in Mexico within a maximum of 30 business days, if it is identical to the approved product.
Health regulation6 min read - Diagnostic
Sanitary registration, notice of operation and responsible health officer: who needs what
The product, the establishment and the responsible person have different obligations. Confusing them is the most common way of operating without authorization.
Health regulation7 min read - Risk bulletin
Advertising regulated products on social media and through content creators
The sanitary advertising permit does not distinguish between television and social media. Each advertisement needs its own, even if a third party publishes it.
Health regulation4 min read - Diagnostic
Sanitary inspection visit: from the inspector’s arrival to the resolution
The visit lasts a few hours; its consequences, months. The record, the samples and the calendar-day deadlines to defend yourself are decided that day.
Health regulation7 min read - Impact note
Financial technology: when your platform needs CNBV authorization
Crowdfunding and electronic payment funds are reserved activities. Operating them without authorization is a crime, even if the platform is a technology company.
Financial services6 min read - Impact note
Anti-money laundering: the 2025 amendment and the rules taking effect on November 30, 2026
Suspicious activity reports within 24 hours, risk assessment, manual, automated monitoring and annual audit. The schedule is set and begins in weeks.
Financial services6 min read - Risk bulletin
Importers Registry: the suspension that halts your operations without any fine
No registration, no customs clearance. Registration depends on being current with tax obligations, and the SAT can suspend it.
Foreign trade4 min read - Impact note
Electricity Sector Law: what changed for plants that generate their own power
The March 2025 law repealed the 2014 law, created the self-consumption category and set the permit threshold at 0.7 MW. Earlier permits will not be extended.
Energy6 min read - Diagnostic
Integrity policy: the seven elements of Article 25 and what they are for
The law does not require an integrity policy, but it weighs one when imposing penalties and awards it points in public tenders. That is where its real value lies.
Integrity and competition7 min read - Impact note
National Antitrust Commission: the 2025 amendment and what changed for companies
Higher fines, information exchange as a form of collusion, merger decisions within 30 days and a different authority.
Integrity and competition6 min read - Impact note
Forty-hour workweek: the schedule that begins on January 1, 2027
The reduction is now law. In 2027 the maximum workweek drops to 46 hours, with no pay cuts, and electronic recording of working hours becomes mandatory.
Employment6 min read - Risk bulletin
REPSE: what happens when your provider’s registration expires or is canceled
The specialized services registration must be renewed every three years and can be canceled at any time. The consequences also reach the client.
Employment4 min read - Impact note
Work on digital platforms: the obligations in force since June 2025
Anyone who provides services through a platform and earns at least one monthly minimum wage is a worker, with registration, weekly pay, and clear algorithmic rules.
Employment6 min read - Diagnostic
Requests and inspections by authorities: the deadlines that run from the first minute
An inspection visit or a tax request follows precise rules. Knowing them lets you comply without conceding more than required and defend yourself in time.
Defense before authorities7 min read - Diagnostic
Fines and closures: administrative appeal or court proceeding, and the deadlines to decide
There are two paths to challenge a federal fine. Choosing late is the same as not choosing: the decision becomes final and enforceable.
Defense before authorities7 min read - Diagnostic
Amparo for companies after the 2025 reform: narrower and more demanding
No general effects, a stricter standard for legitimate interest, and new cases in which a stay is denied. It still works, though differently.
Defense before authorities7 min read - Diagnostic
Softlanding in Mexico: subsidiary, branch, or office, and what each one requires
The form of entry defines who is liable, how invoicing works, and which registrations are triggered. Choosing it before the first contract avoids costly restructuring.
Softlanding7 min read - Risk bulletin
National Registry of Foreign Investments: registration, annual renewal, and calendar
Forty business days to register and a renewal every year, in April or May depending on the first letter of the company name. Missing them is easy, and it is penalized.
Softlanding4 min read - Diagnostic
Foreign documents in Mexico: apostille, translation, and powers of attorney that actually work
A certificate of incorporation or a power of attorney from abroad has no effect on its own. It needs authentication, translation, and, to be registered, notarial recording.
Softlanding7 min read - Diagnostic
Generative artificial intelligence in the company: the internal policy the law already requires
Mexico has no artificial intelligence law, but every use of a tool triggers duties regarding personal data, trade secrets, and copyright.
Artificial intelligence7 min read
No notes match these filters.
Try another area or clear the filters. If your topic is not here, write to us and we will review it in a diagnostic meeting.