October 15th, 2026
On September 25, 2026, the Ibero-American Data Protection Network (RIPD), which brings together the data protection authorities of the region, approved the Ibero-American Standards on the Use of Personal Data in Artificial Intelligence Systems. The Standards were the result of a process of drafting, consultation and technical deliberation among its member authorities.
The Standards are a non-binding, complementary guidance instrument that specifies how data protection principles, rights and obligations apply when processing involves AI systems. They neither create a parallel regime nor replace national laws. Their approach centers on the processing lifecycle, based on risk and accountability. The most relevant points include:
- They declare incompatible with data protection principles any processing of personal data carried out through artificial intelligence systems intended to deceptively manipulate people’s behavior, improperly exploit situations of vulnerability, or establish social scoring mechanisms with discriminatory effects.
- They state that the publicly available nature of data does not, by itself, legitimize its use to train models.
- They set out criteria on:
- sensitive inferences, that is, sensitive data (such as health, sexual orientation or beliefs) that a system derives from data that was not sensitive, which become subject to the enhanced regime for sensitive data;
- neurodata;
- automated decisions, which must include effective human intervention;
- impact assessments;
- prior consultation with the authority where a high risk persists despite the measures adopted.
- They include specific rules for generative AI, agentic AI, biometrics and emotion recognition, and systems for scoring or selecting individuals.
The Standards are addressed to data protection authorities, legislators, data controllers and processors, AI system providers, and public and private sector organizations.
This instrument is one of the first regional efforts to set out systematic criteria on AI from a personal data protection perspective. Although it is not binding, Mexico and the region should follow it closely. Mexico does not yet have an approved General Law on Artificial Intelligence, and several bills are pending before Congress, including one introduced in the Chamber of Deputies on July 24, 2026, to enact the Federal Law for the Ethical, Sovereign and Inclusive Development of Artificial Intelligence. These Standards will serve as a reference both for that legislative discussion and for organizations that process personal data through AI systems.
Our firm’s Information Technology and Data Protection practice remains at your disposal to analyze how these Standards may impact your specific operations, and to support you in designing or strengthening AI and personal data governance models aligned with emerging regulatory trends.
Sincerely,
Adolfo Athié Cervantes
aathie@basham.com.mx
Renata Buerón Valenzuela
rbueron@basham.com.mx
Source: Red Iberoamericana de Protección de Datos [Ibero-American Data Protection Network]. (2026). Estándares iberoamericanos sobre el uso de datos personales en sistemas de inteligencia artificial (IA) [Ibero-American standards on the use of personal data in artificial intelligence (AI) systems].