Diagnostic

The legal risk matrix by severity: how to read it from the CEO’s office

A useful matrix does not paint everything red: it ranks what to fix first by the actual cost the law assigns to each failure to comply.

LEXURE Preventive Diagnostics Practice Team 7 min read Regulatory status verified in 2026

A legal risk matrix exists to decide what gets fixed first. If every­thing shows up in red, it cannot sup­port that deci­sion; if it is ranked by how often the author­i­ties have come knock­ing, it mis­leads, because a single inspec­tion is enough to trig­ger a con­tin­gency that has been open for years.

What the law requires

Mexico has no offi­cial, manda­tory method­ol­ogy for clas­si­fy­ing legal risks by sever­ity. Even so, sever­ity has an objec­tive mea­sure in the law itself, which sets how much each fail­ure can cost, whom it reaches, and how it esca­lates. A seri­ous matrix is built on that data.

The penalty ceil­ing. The fig­ures vary by orders of mag­ni­tude. Exceed­ing the max­i­mum daily work­ing hours or fail­ing to grant the weekly rest day car­ries a fine of 50 to 250 Units of Mea­sure­ment and Update, or UMA (MXN 5,865.50 to MXN 29,327.50), under Arti­cle 994, sec­tion I, of the Fed­eral Labor Law (Ley Fed­eral del Tra­bajo). In per­sonal data, the most seri­ous vio­la­tions reach 320,000 UMA: Arti­cle 59, sec­tion III, of the Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares) penal­izes them with 200 to 320,000 UMA (MXN 23,462 to MXN 37,539,200).

The mul­ti­pli­ers. The Fed­eral Labor Law imposes one penalty per affected worker when a single act or omis­sion affects sev­eral, and dou­bles the fine for a repeat vio­la­tion within the fol­low­ing two years (Arti­cle 992). The Fed­eral Tax Code (Código Fiscal de la Fed­eración) applies the ben­e­fi­cial own­er­ship fine per ben­e­fi­cial owner (Arti­cle 84-N). A fail­ure that is modest on its own can thus become the com­pany’s most expen­sive one, depend­ing on the number of people it touches.

Who is liable. Sever­ity also depends on how many par­ties the penalty reaches. In unreg­is­tered sub­con­tract­ing, the fine of 2,000 to 50,000 UMA (MXN 234,620 to MXN 5,865,500) is imposed on both the provider and the recip­i­ent of the ser­vice (Arti­cle 1004-C of the Fed­eral Labor Law). That is why, even if the breach is the provider’s, the con­tract­ing com­pany must rate that line item as its own.

The indi­vid­u­al­iza­tion cri­te­ria. In per­sonal data, the author­ity must con­sider the nature of the data, whether the refusal to the data sub­ject was clearly unjus­ti­fied, whether the con­duct was inten­tional, the con­troller’s eco­nomic capac­ity, and any repeat vio­la­tion (Arti­cle 60). Under these cri­te­ria, the same fail­ure weighs more heav­ily in a com­pany that pro­cesses health or finan­cial data.

Effects other than fines. Some of the most expen­sive con­se­quences do not appear in any penalty sched­ule: pay­ments for unreg­is­tered sub­con­tract­ing are nei­ther deductible nor cred­itable for value added tax pur­poses, under Arti­cle 15-D of the Fed­eral Tax Code; an assign­ment of copy­right that is not in writ­ing is null, under Arti­cle 30 of the Fed­eral Copy­right Law (Ley Fed­eral del Dere­cho de Autor); and the share­hold­ers of an S.A.S. (sim­pli­fied stock cor­po­ra­tion) that exceeds its rev­enue cap with­out con­vert­ing bear unlim­ited lia­bil­ity, under Arti­cle 260 of the Gen­eral Law of Com­mer­cial Com­pa­nies (Ley Gen­eral de Sociedades Mer­can­tiles).

What to do and by when

  1. Draw up an inven­tory of obli­ga­tions by front: cor­po­rate, con­trac­tual, labor, per­sonal data, intel­lec­tual prop­erty, and reg­u­la­tory com­pli­ance.
  2. For each obli­ga­tion, record its legal basis, the max­i­mum penalty, the appli­ca­ble mul­ti­plier, and the non-mon­e­tary effects.
  3. Rate the expo­sure of each obli­ga­tion: whether the breach already exists, whether it leaves a trail in records or peri­odic reports that the author­ity receives, and whether a dead­line is already run­ning.
  4. Sort the result into three atten­tion hori­zons: IMMEDIATE, for items that com­bine high sever­ity and cur­rent expo­sure; SHORT TERM, for items with a near dead­line; and MEDIUM TERM, for pre­ven­tive items.
  5. Have the board or man­age­ment approve the matrix, with an owner and a date for each line item.
  6. Review it at least once a year and after every rel­e­vant reform. This review is a cor­po­rate gov­er­nance best prac­tice; the law does not impose it as a stand­alone obli­ga­tion.

Recommendations to mitigate risk

Not having a matrix car­ries no fine. The risk lies in allo­cat­ing resources to the wrong con­tin­gency, espe­cially when a fail­ure is viewed with­out its mul­ti­plier and looks smaller than it is. Take as an exam­ple, using the law’s own fig­ures, a plant with 120 people that exceeds the max­i­mum daily work­ing hours for its entire staff: it does not face one fine of 50 to 250 UMA; it faces one per worker, for a total of 6,000 to 30,000 UMA (MXN 703,860 to MXN 3,519,300), which dou­bles for a repeat vio­la­tion. A com­pany with three ben­e­fi­cial owners that never com­piled its file faces up to MXN 6,747,000, because the max­i­mum fine of MXN 2,249,000 applies to each one.

Self-assessment

Answer yes or no about your own com­pany.

  1. Do you have a writ­ten inven­tory of the com­pany’s legal obli­ga­tions, grouped by front?
  2. Does each line item in your matrix state the arti­cle that sets the obli­ga­tion and the cor­re­spond­ing penalty?
  3. Does your matrix account for the number of work­ers, ben­e­fi­cial owners, or data sub­jects affected by each fail­ure?
  4. Do you dis­tin­guish between what the law requires and what is merely best prac­tice?
  5. Did the board or man­age­ment approve the matrix and assign an owner to each line item?
  6. Was the matrix updated after the 2025 per­sonal data law and the 2026 labor reform?

How we approach it at LEXURE

The risk matrix by sever­ity is one of the core deliv­er­ables of Blin­daje Cor­po­ra­tivo. Each line item car­ries its legal basis, the offi­cial penalty with its equiv­a­lent in pesos, the appli­ca­ble mul­ti­plier, and the evi­dence reviewed, so that the CEO can defend before the board the order in which each cor­rec­tion is addressed. The accom­pa­ny­ing action plan is clas­si­fied as IMMEDIATE, SHORT TERM, and MEDIUM TERM.

If you want to know which line items in your matrix are mis­rated, sched­ule a diag­nos­tic meet­ing with us.

Schedule a diagnostic meeting Discover Blindaje Corporativo

Legal basis

  1. Federal Labor Law, Articles 992, 994, section I, and 1004-C. Current text (opens in a new tab)
  2. Federal Law on the Protection of Personal Data Held by Private Parties, Articles 58, 59, and 60. Current text (opens in a new tab)
  3. Federal Tax Code, Articles 15-D, 84-M, and 84-N. Current text (opens in a new tab)
  4. Federal Copyright Law, Article 30. Current text (opens in a new tab)
  5. General Law of Commercial Companies, Article 260. Current text (opens in a new tab)
  6. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes