The Federal Commission for the Protection against Sanitary Risks (“COFEPRIS“) holds the authority over manufacturing, distributing, labelling, advertising and selling drugs, medical devices, food and food supplements, and over advertising for prescription medications and certain categories of medical devices pursuant to, mainly (i) the General Health Law (“GHL“), (ii) the Regulation for Health Supplies (“SRMP“), (iii) the Regulation on the Health Control of Products and Services, (iv) the Mexican Official Standards (“NOMs“), and (v) the Mexican Pharmacopoeia, (vi) and multiple official decrees for various product categories, regulated services, and establishments.

The NOMs and official decrees are technical regulations that maintain authority over several topics. For example:

• NOM-137-SSA1-2008 – Labelling of Medical Devices;
• NOM-251-SSA1-2009 – Hygienic Practices in the Process of food, drinks, and dietary supplements;
• NOM-051-SCFI/SSA1-2010 – Labelling of pre-packaged food products;
• NOM-012-SSA3-2012 – Criteria for the execution of research projects for health in humans.
• NOM-072-SSA1-2012 – Labelling of Medicinal Products;
• NOM-240-SSA1-2012 – Technovigilance;
• NOM-177-SSA1-2013 – Interchangeability of Medicines;
• NOM-059-SSA1-2015 – Good Manufacturing Practices of Medicinal Products;
• NOM-220-SSA1-2016 – Pharmacovigilance (and its modifications);
• NOM-241-SSA1-2021 – Good Manufacturing Practices for medical devices.
• Decree that regulates the use of additives and adjuvants in food, drinks, and dietary supplements, and its amendments;
• Decree that establishes plants, prohibited or permitted, for use in teas, infusions, and edible vegetable oils;
• Decree for the Operation of Ethics Committees issued by the National Commission of Bioethics.
• Guidelines of Good Clinical Practice published by the COFEPRIS;

Our legal framework focuses on the sanitary risk they pose to human health. Low-risk products like dietary supplements are monitored post-commercialization, while high-risk products, such as medicinal products and MD, require pre-commercialization approval via product registration or market authorization (“MA“).

The proper classification of a product within its regulatory category is crucial because each category has specific regulations applicable to certain types of products. Therefore, the formulation, composition, quality, brand, generic, and specific denomination of the product must adhere to the specifications of that product’s regulatory category as defined in the regulation.

If a regulated product is incorrectly classified and incorrect regulations are applied, the health authority may impose administrative sanctions such as fines, temporary suspension of activities, and securing the product until the irregularities are corrected.

The General Health Law (“GHL“) defines Medicinal Products (“MP“) as any substance or mixture of substances of natural or synthetic origin that has any therapeutic, preventative, or rehabilitative properties, which is presented under any pharmaceutical form and is identified as such for its pharmacological activity and physical, chemical and biological characteristics. There are many classifications for medicinal products, including reference and generic, biotechnological and biocomparable drugs, prescription and non-prescription drugs, standard and controlled drugs, among others.

Medical Devices (“MD“) are defined under the NOM-241-SSA1-2021, Good manufacturing practices for medical devices, as any “…instrument, apparatus, utensil, machine, software, implantable product or material, diagnostic agent, material, substance or similar product, to be used, alone or in combination, directly or indirectly in human beings; with any of the following purposes of use:

1. diagnosis, prevention, surveillance or monitoring, and/or aid in the treatment of diseases;
2. diagnosis, surveillance or monitoring, treatment, protection, absorption, drainage, or aid in the healing of an injury;
3. substitution, modification or support of the anatomy or of a physiological process;
4. life support;
5. control of conception;
6. disinfection of medical devices;
7. disinfectant substances;
8. provision of information through an in vitro examination of samples taken from the human body, for diagnostic purposes;
9. devices incorporating tissues of animal and/or human origin, and/or
10. devices used in in vitro fertilisation and assisted reproductive technologies,

as well as those whose main purpose of use is not through pharmacological, immunological or metabolic mechanisms; however, they can be assisted by these means to achieve their function. Medical devices include supplies for health in the following categories: medical equipment, prostheses, orthoses, functional aids, diagnostic agents, supplies for dental use, surgical and healing materials, and hygienic products.”

MD are categorized into three classes based on the risk they pose to human health:

• Class I: Recognised in medical practice, proven safe and effective, and generally not introduced into the human body.
• Class II: Recognised in medical practice, can vary in manufacturing or concentration, and are regularly introduced into the human body for less than 30 days.
• Class III: New products or those recently accepted in medical practice, or those that are introduced into the human body and remain there for more than 30 days.

In addition, there is a “List of Products that for its Nature, Characteristics and Uses are not Considered Medical Devices”. Products included on this list are not regulated as MD.

MP and MD require a prior Marketing Authorization (“MA“). The Federal Commission for the Protection against Sanitary Risks (“COFEPRIS“) grants only one type of MA for pharmaceuticals for human health and MD. The requirements for quality, safety, and efficacy are generally consistent across all products, whether they are allopathic, biologic, biotechnologic, homeopathic, herbal, or vitamin pharmaceuticals.  The validity period of any MA for pharmaceuticals and medical devices is five years. After this time, MAs must be renewed for additional five-year periods.

MA holders are required to adhere to good manufacturing practices, as well as standards and regulations pertaining to stability, pharmacovigilance or technovigilance, and labelling. Additionally, they must abide by the advertising regulations applicable to MP or MD. The obligations related to product recall are becoming increasingly significant.

MP and MD are subject to post-approval vigilance. These obligations are outlined in regulations, which typically specify the rights and responsibilities of relevant stakeholders, including MA holders, distributors, research sites, health institutions, physicians, and patients. They are required to monitor adverse events or incidents and to investigate and report them. It is essential to establish a pharmacovigilance or technovigilance unit, designate an individual responsible for pharmacovigilance, appoint someone for technovigilance, and maintain a comprehensive pharmacovigilance or technovigilance manual. Phase IV data is usually only required for more complex products, such as complex biologics or biotech drugs, as determined by the New Molecules Committee.

The import of all MP and certain MD requires health import permits issued by COFEPRIS. There are exceptions to the requirement for obtaining a health import permit, applicable only for non-commercial purposes, including (i) personal use, (ii) donations, (iii) experimental use, and/or (iv) treatment of low-prevalence diseases.

Food products are typically subject to post-marketing surveillance and do not require a Marketing Authorization (“MA“). A notable category is specialized nutritional formulations, which are regulated under the Regulation for Health Supplies (“SRMP“) and require an MA. This requirement is a unique aspect of the local legal framework, as the regulatory treatment of specialized nutritional formulations in other jurisdictions is more similar to that of food products.

The regulatory category of food supplements in Mexico includes products formulated based on herbs, plants, algae vegetable extracts, traditional foods, and concentrated or dehydrated foods; which may or may not be added with vitamins or minerals, in combination or in isolated form, that are presented in a pharmaceutical form; with the purpose of incrementing, complementing the total dietary ingest, or substitute any of its components. Dietary supplements may contain any permitted plant included in the Decree of Plants and the List of 18 Plants, as well as additives contained in the Decree of Additives, but must comply with the limits and restrictions outlined in these decrees. This regulation is also applicable to food ingredients, additives, and adjuvants.

The Decree of Plants, published in 1999, communicates a list of plants which, in addition to psychotropics and narcotics, are forbidden for their use in teas, infusions, as well as in food products. It also contains a list of plants that may be used, but should always include the warning “Attention: Do not ingest if pregnant”. Finally, it contains a list of vegetable oils and their permitted sources. In 2017, COFEPRIS published a List of 18 plants on its website that complements the Decree of Plants. While not officially integrated into the Decree of Plants, COFEPRIS has authorized its use in the meantime.

The Decree of Additives contains a list of additives divided into 11 Sections. Each section corresponds to a category of additives that describes the allowed use of the additive within each category and indicates the maximum dose permitted for each one.

Dietary supplements may not contain in their formulation procaine, ephedrine, yohimbine, germanium, animal or human hormones, or plants forbidden for use in teas and infusions or any other pharmacological substance as ingredients.

Food supplements are subject to a system of health notifications, which includes (i) a notice of operation for its commercialization, (ii) an import permit, and (iii) an advertising permit.

While food supplements are subject to post-commercialization control, the Regulations Regarding Advertising (Reglamento de la Ley General de Salud en Materia de Publicidad “RLGSMP”) contains very stringent regulations applicable to its labelling and advertising, including the requirement for advertising authorization and the prohibition of food supplements containing active pharmaceutical ingredients or making any therapeutic claims.

It is essential to ascertain whether a product aligns with the local definition of a dietary supplement because there are some products that may be considered a food supplement in other jurisdictions but fall under another regulatory category in Mexico and because other products closely resemble other regulated product categories. For instance, border products could fall under the classification of a food product, a food supplement, or a medicinal product, depending on the quantities of its ingredients.

To confirm the correct product classification, permitted limits and restrictions on certain ingredients based on the product’s qualitative and quantitative composition, as well as the assessment of the product’s label and advertising materials, must be considered.

A formal product classification, known as “a ruling request,” may be requested to COFEPRIS, which, in turn, may be litigated if the result is not consistent with the company’s initial product evaluation.

MA holders must comply with good manufacturing practices, as well as stability, pharmacovigilance, or technovigilance standards and regulations, and labelling requirements. They are also required to follow advertising regulations related to Medicinal Products (MP) or Medical Devices (MD). The importance of obligations related to product recall is increasing.

Following NOM-240-SSA1-2012 – Technovigilance and NOM-220-SSA1-2016 – Pharmacovigilance (and its modifications), MP and MD must undergo post-approval vigilance. These regulations delineate the rights and responsibilities of relevant stakeholders who are required to monitor, investigate, and report adverse events or incidents. It is imperative to establish a pharmacovigilance or technovigilance unit, designate an individual responsible for pharmacovigilance, appoint a person for technovigilance, and maintain a comprehensive pharmacovigilance or technovigilance manual.

The Federal Commission for the Protection against Sanitary Risks (“COFEPRIS“) is responsible for overseeing Mexico’s healthcare supply chain, which includes medicinal products, medical devices, food, and supplements. COFEPRIS operates as an autonomous agency within the administrative framework of the Ministry of Health (MoH), possessing complete technical, operational, and administrative independence. COFEPRIS has the primary responsibility for issuing and enforcing health regulations, which is encapsulated in its authority over health control. This authority is principally demonstrated through (i) the issuance of health authorizations and (ii) the verification of compliance with health regulations.

COFEPRIS is a federal authority that oversees the entire system and shares health control power with similar State authorities in each of the 32 federal entities, including Mexico City. The distribution of health control powers between COFEPRIS and any given federal entity is defined in Coordination Agreements, which are state-specific. Generally, in Coordination Agreements, COFEPRIS retains the power to issue authorizations, while the power to verify compliance is primarily delegated to the state health authorities.

Verification of compliance is conducted through either (i) on-site inspection visits, where inspectors pay a visit to a physical establishment and review compliance with regulations applicable to different types of establishments, the type of activities performed therein, and/or the products handled there, or (ii) a desk review, in case of advertising verification, which is done remotely from the authorities’ offices, over the respective advertising material.

COFEPRIS possesses the discretionary authority to determine whether an inspection should progress to a sanctioning phase. The range of potential sanctions includes (i) a warning, (ii) a fine, and (iii) the closure of an establishment. The most common penalty is an administrative fine, which is determined based on the applicable range (minimum and maximum) corresponding to the specific regulatory obligation that was not fulfilled.

Consumer protection is regulated through the Federal Law of Consumer Protection (“FLCP“), which is enforced by the Mexican Consumer Protection Agency (“PROFECO“). The FLCP aims to offer protection against false advertising and consumer fraud. When such issues are detected, PROFECO may impose preventive measures, including immobilization, securing of products, suspension of commercialization, product recalls, and suspension of advertising. Advertising is considered false if it refers to characteristics or information about a product that may not be truthful or if it induces error or confusion due to being falsely or exaggeratedly presented by the supplier. Under these regulations, consumers are entitled to reimbursement and, in some cases, both reimbursement and compensation. If PROFECO finds a violation of the FLCP or that a certain product is not compliant with applicable technical regulations, it may also sanction the supplier. In 2023, PROFECO published The Advertising Guide for Influencers to highlight that influencers’ activities on social media constitute advertising. PROFECO is especially vigilant in sectors where there may be significant risks to individuals or vulnerable groups, including health services and products.  Nonetheless, influencers are not quite captured by the consumer protection legal framework.

Mexico’s data protection regulator is the National Institute of Transparency, Access to Information, and Protection of Personal Data (“INAI“), which maintains authority over the data contained in the Marketing Authorization (“MA“) dossiers and the personal data on the clinical trial patients. INAI promotes awareness of data protection rights, encourages their exercise, and ensures compliance with relevant laws and regulations. The INAI can audit, request information, and enforce access, correction, cancellation, opposition, and revocation rights on public and private entities. In November 2024, a constitutional amendment mandated the dissolution of seven autonomous entities responsible for overseeing government activities and compliance in various sectors, including the INAI. The dissolution of the INAI has resulted in uncertainty regarding the entity that will assume its functions. According to available information, the responsibilities for personal data protection previously handled by the INAI will now be managed by the new Secretariat of Public Function, which will be renamed the Secretariat of Anti-Corruption and Good Governance. The Secretariat of Anti-Corruption and Good Governance will oversee the management of archives and the National Transparency Platform and handle sanctions pertaining to personal data protection. We are awaiting the secondary regulations to confirm the attributions related to data protection. The Congress has 90 days to implement the legal changes required for the dissolution of the INAI, after which the INAI will be legally dissolved. The scope of the legal adjustments for implementing the dissolution of the INAI and how they will operate in practice is still unknown. While we have a clear definition from the Authority, the market practice is to keep abiding by data protection regulations for MA dossiers’ data and clinical trial patients, among others.

Litigation against decisions made by the Federal Commission for the Protection against Sanitary Risks (“COFEPRIS“) is fairly common, especially regarding sanctions. Since the COVID-19 pandemic, there has been an increase in regulatory litigation primarily related to the lack of responses on renewals, modifications, rejections, and inspection procedures. This type of litigation is more sophisticated and requires a thorough understanding of technical regulations and their proper interpretation. In 2022, the total number of all types of litigation cases against COFEPRIS surged to 12,000, averaging approximately 40 cases per day throughout the year.

President Claudia Sheinbaum has announced a plan to address the administrative backlog by prioritizing pending applications that have received tacit approval under secondary regulations.

Tacit resolution is a legal rule that gives certainty to the applicant. Under this rule, after the legal time for an authority to issue a resolution has elapsed, if the authority has not issued a final resolution, the application is generally considered denied. However, in some instances, there is a special rule by which such an application is considered tacitly approved.

Generally, COFEPRIS’s decisions over denying an MA or imposing a sanction may be challenged through three main appeal proceedings:

• a revision recourse/writ of revision, decided, in this case, by the same authority that issued the original administrative decision;
• a nullity trial, decided by the Federal Administrative Tribunal; and
• an amparo trial, decided by a judicial body, a judge, or a court, depending on the nature of the decision being challenged.

Depending on the specific circumstances of each case, a different appeal proceeding will be best suited to achieve the business objectives.

Clinical trials are regulated by (i) the General Health Law (“GHL“), (ii) the Secondary Regulations on Clinical Research (“SRCR“), (iii) NOM-012-SSA3-2012 – Criteria for the execution of research projects for health in humans, (iv) the Guidelines of Good Clinical Practice published by the Federal Commission for the Protection against Sanitary Risks (“COFEPRIS“), and (v) the Decree for the Operation of Ethics Committees issued by the National Commission of Bioethics.

Additionally, a Mexican Official Standard (“NOM“) on Good Clinical Practices is currently undergoing regulatory improvement. This new NOM aims to regulate the role of Contract Research Organizations (“CROs“) and align with international best practices in clinical research, including standards set by the International Conference on Harmonisation, the Nuremberg Code, the Helsinki Declaration, the World Health Organization guidelines.

Clinical research requires authorization from COFEPRIS, which is connected to the approval of the research protocol by an ethics committee and a research institution. Typically, clinical trials (Phases I–IV) must be based on pre-clinical data, conducted according to scientific and ethical standards, performed with the informed consent of participants, executed under a research protocol, overseen by a principal investigator, and carried out within licensed health institutions.

Securing authorization to conduct a clinical trial for a pharmaceutical or medical device involves three basic steps, which must be completed sequentially and cannot be applied for simultaneously, as follows:

1. A favourable opinion of the research protocol by the ethics committee of the health institution where the trial is to be conducted must be obtained. According to the Decree for the Operation of Ethics Committees, this review must occur within 30 business days of filing.
2. The research protocol must be authorized by the director of the health institution where the trial is to be conducted in accordance with the appropriate internal regulations.
3. Approval of the research protocol from COFEPRIS within three months of filing.

Mexico’s clinical research industry faces challenges due to an underdeveloped legal framework and regulatory backlog. Despite this, Mexico remains an appealing destination for clinical research due to its diverse population, skilled workforce, and suitable infrastructure.

Most trials are recorded in the National Registry of Clinical Trials (Registro Nacional de Ensayos Clínicos, or “RNEC“) after the Federal Commission for the Protection against Sanitary Risks (“COFEPRIS“) authorizes their protocols. COFEPRIS and clinical trial sponsors, Contract Research Organizations (“CROs“), or healthcare institutions collect the information in the RNEC. The RNEC provides an electronic database containing general clinical trial information. This demonstrates progress, as previously, very little local information was publicly available. Confidential information does not form part of the RNEC; similarly, patients’ health information is classified as sensitive personal information under data protection laws and will be safeguarded accordingly.

There is no binding requirement to disclose or publish the results of clinical trials. However, CETIFARMA’s (Council of Ethics and Transparency of the Pharmaceutical Industry) Code of Ethics includes an obligation for sponsors to disseminate both positive and negative trial results, including information on adverse events.

In Mexico, the rules for using data from clinical trials depend on whether the data contains personal information or is disaggregated. If the data is disaggregated and does not contain any identifiable information, it is not considered personal data and is not subject to privacy laws. However, if the data contains personal information, it is classified as sensitive personal data (as it contains patient health data). In this case, express consent from the data subject is required for the collection and transfer of this type of data. Privacy notices must be clear, concise, and easily accessible. For sensitive data, privacy notices must include an express warning regarding the collection and list all sensitive data items being processed.

The data must be handled in accordance with the Federal Law on the Protection of Personal Data held by Private Parties (“FDPL“). This law outlines the responsibilities of data controllers and processors (to be engaged by the sponsor as the owner of the clinical trial data) and the security measures that must be implemented to protect the data. Data controllers are responsible for determining the purposes and means of processing personal data. Their responsibilities include ensuring that personal data is processed lawfully, fairly, and transparently, collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes. Data controllers must also ensure the accuracy and integrity of the data and implement appropriate technical and organizational measures to protect it.

On the other hand, data processors process personal data on behalf of the data controller. Their responsibilities include processing data only according to the data controller’s instructions, implementing appropriate security measures to protect the data, and assisting the data controller in ensuring compliance with data protection obligations. Data processors must also maintain records of processing activities and notify the data controller of any data breaches.

Both data controllers and processors must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The data controller must incorporate and maintain administrative, technical, and physical measures within its organization to protect personal data from damage, loss, alteration, destruction, or unauthorized use, access, or processing. To define these measures, the data controller must assess factors such as risks associated with personal data, whether sensitive personal data is being processed, current technical developments, and possible consequences for data subjects in case of a breach.

The data controller should also create and maintain inventories of personal data items collected from subjects and security systems used for processing this data. They must define functions and obligations for officers in charge of protecting personal data, conduct regular risk assessments to identify potential risks affecting personal data, conduct gap analysis and regular audits to identify risks and areas for improvement, design action plans to address issues identified in assessments or audits, provide training to officers involved in processing activities, and update security measures based on audit recommendations or after confirming unauthorized access or disclosure of personal data.

Currently, there are no specific regulations, trend or initiatives to govern the digitization of the process for conducting clinical trials. If a trend or initiative were to emerge, it would be critical for it to consider that platforms that support clinical research processes comply with regulations regarding the recruitment of and interaction with patients enrolled in a clinical trial if those functionalities are included. This theoretical platform could also involve regulatory considerations, such as advertising medical products and services and privacy protection. Therefore, it is important to review its content on a case-by-case basis.

In this context, since 2022, the Federal Commission for the Protection against Sanitary Risks (“COFEPRIS”) has implemented efforts to transition to a fully digital administration of its applications and procedures, including clinical trials, through its digital platform DIGIPRIS. This is an ambitious project, and full implementation is expected in 2027. Along with this digitalization trend, COFEPRIS has taken significant steps for the simplification of administrative procedures and to achieve regulatory harmonization with other regulatory authorities of reference to align technical criteria, further implement reliance, eliminate obsolete applications, and tackle the administrative backlog.

In the context of health regulations, process is meant to encompass all activities, including obtaining, elaborating, manufacturing, preparing, conserving, mixing, conditioning, bottling, manipulating, transporting, distributing, warehousing, and wholesale products, such as medicinal products (“MP“), medical devices (“MD“), food products, food supplements.

Establishments involved in the process of MP and MD require health authorization and the designation of a health-qualified person who oversees applicable regulations and standard operating procedures to ensure quality is applied. Moreover, establishments in which MP are manufactured require a manufacturing license. In contrast, establishments in which MD are manufactured are subject to a notice of operation.

Establishments involved in the wholesale of MP and MD are only required to submit a notice of operation to the Federal Commission for the Protection against Sanitary Risks (“COFEPRIS“). The notice of operation is free of cost, enters effect at the moment of filing in DIGIPRIS (the COFEPRIS platform that allows for more agile procedures and services), and does not have an expiry date. The exception to the general rule is warehouses dedicated to the wholesale of controlled pharmaceuticals (e.g., psychotropic and narcotics) and/or biological products for human use, which are subject to a license.

To obtain a manufacturing license for a MP establishment, it is necessary to secure a certificate of Good Manufacturing Practices (“GMP“). To proceed, a COFEPRIS inspection visit must be requested at the manufacturing facility. This visit will assess the establishment compliance with NOM-059-SSA1-2015 – Good Manufacturing Practices of Medicinal Products. If COFEPRIS determines during the inspection visit that the facility complies with the required standards, a certificate will be issued. This certificate must be included in the manufacturing license application. Upon submission of the application, COFEPRIS will process and issue the manufacturing license within a maximum of 60 business days. The activities generally permitted by the manufacturing license include the production and storage of pharmaceuticals within the same facility. The manufacturing license is issued without an expiration date.

Establishments involved in the process of food and food supplements are subject to a notice of operation only.

The notice of operation reflects the holder’s declaration of the industrial activity performed in the establishment related thereto. The industrial activity in a notice of operation is stated using the North American Industrial Classification System (“SCIAN“), which allocates a code to each industrial activity in the catalogue. The catalogue of industrial activities is the attachment I to COFEPRIS’s Decree of Procedures. The relevance of correctly stating the activities performed in a certain establishment derives from the fact that, in case of a visit from the Authority, it will check compliance with the regulations applicable to that specific activity.

See question #11. The distribution of medicinal products, medical devices, and food supplements in Mexico is a regulated activity and, as such, shall be declared in the notice of operation or health license, if applicable, by stating the North American Industrial Classification System (“SCIAN“) code that correctly reflects both the regulated product and activity.

In Mexico, the private and public markets for medical products have separate rules depending on whether the products are patented. This mainly applies to pharmaceuticals and has changed during the new federal administration.

The very general legislative bases of the dual system are contained in two laws: the General Health Law (“GHL“) (Article 31) and the Federal Economic Competition Law (Article 9). However, the rest of the rules are largely contained in separate regulatory instruments of lower hierarchy, including the Addendum to the Agreement for Drug Pricing Co-ordination signed in 2004 between the Ministry of Economy and the National Chamber of the Pharmaceutical Industry, and NOM-072-SSA1-2012 – Labelling of Medicinal Products.

Patented drugs for the private market are subject to a hybrid system that is largely self-regulated and voluntary. Under this system, companies compile their own information about their prices in other jurisdictions and submit that to the authority, which monitors the accuracy of the data. The manufacturer is required to stamp the price on the product’s label at the end of the manufacturing process. The Mexican Consumer Protection Agency (“PROFECO“) verifies that the prices at the point of sale (e.g., pharmacies) do not exceed that price.

Generic drugs, off-patent products, and medical devices in general are not covered by this pricing regulation, as they are subject to direct price competition in the market. As explained here, newly launched products are initially exempt.

The Mexican system operates not through a reimbursement model but through a model of public procurement of drugs and medical devices.

There is a comprehensive legal framework for public procurement in Mexico, which is overseen by the Ministry of Antibribery and Good Government and coordinated with the purchasing entity. On December 22, 2023, and October 29, 2024, a Presidential decree was published that ordered Laboratorios de Biológicos y Reactivos de México, S.A. de C.V. (“BIRMEX“) (a majority state-owned company that develops, produces, imports and markets vaccines and anti-venoms) to consolidate public procurement processes for the public health care sector which encompasses the Mexican Social Security Institute (“IMSS“), the Institute for Social Security and Services for State Workers (“ISSSTE“) and IMSSS- Bienestar, National Health Institutes, and Federal Reference Hospitals. Under this decree, the Vice Ministry of Health was tasked with preparing a diagnostic of necessities and planning the consolidated purchase of medical products. Thus, BIRMEX now conducts the public procurement process on behalf of healthcare institutions, following the instructions of the Vice Minister of Health. The first consolidated public procurement process under this scheme was initiated in December 2024 and is still ongoing to date, February 2025, as challenges in its implementation presented.

The Regulations Regarding Advertising (Reglamento de la Ley General de Salud en Materia de Publicidad “RLGSMP”) contains general regulations on advertising and specific rules for each regulated product category, some of which are mentioned in question #1. Advertising of products shall always be consistent with the product’s regulatory classification and authorized conditions. The primary legislation regarding advertising is the General Health Law and the RLGSMP; other laws do regulate and have provisions on advertising such as Intellectual Property Law, Federal Consumer Protection Law. These regulations are enforced by the Federal Commission for Protection Against Sanity Risks (“COFEPRIS”), ensuring that the advertising and labeling of medications provide adequate directions for use and are not misleading or false in any way.

COFEPRIS has issued and continues to modify guidelines for the voluntary review of direct-to-consumer advertisements of medical products. Marketing Authorization (“MA”) of medicinal products and medical devices (“MD”) contain an indication of the audience towards which advertising of the product may be directed. In turn, this determines whether the advertising is subject to a health advertising permit or health advertising notice. Generally, advertising directed toward the broader audience requires an advertising permit, whereas advertising directed toward the medical and scientific audience requires an advertising notice.

Regulated products not subject to a MA, such as pre-packaged food products with front-of-package labeling and food supplements, are subject to a health advertising permit.

The RLGSMP also establishes that advertising of regulated products shall avoid making claims that are not supported by a specific regulatory category or by scientific or clinical evidence. For instance, a food supplement may not claim to have a therapeutic effect, or a cosmetic may not claim to be able to modify the proportions or characteristics of the human body, but a medical device may.

Patents and trademarks for medical products, medical devices, and food supplements are regulated by General Industrial Property Regulations, specifically, the Federal Law for the Protection of Industrial Property (“FLPIP“), which came into force on November 5, 2020 and are granted by the Mexican Institute of Industrial Property (Instituto Mexicano de la Propiedad Industrial “IMPI”). This law was enacted to comply with some international treaties, including the United States-Mexico-Canada Agreement (“USMCA“) Chapter 20 and Trade-Related Aspects of Intellectual Property Rights (“TRIPS”). The new regulations for the FLPIP are expected to be published this year. The previous regulations are still in effect, but they require some updates to align with the new law’s provisions.

On September 19, 2003, a decree was published in the Official Gazette of the Federation creating a mechanism for preventing violation of patent rights (Mexican Linkage System); improving communication between IMPI and the Federal Commission for the Protection against Sanitary Risks (“COFEPRIS”) preventing problems regarding the marketing authorization, meaning before any medication can be approved for sale, it must be verified that the owner company or person applying for the approval is the owner of the patent or has permission from patent owner to use the patent. The Gazette for Medicaments (“GM”) is published twice a year and contains the list of granted patents.

In Mexico, patent listings are not associated with a particular company or approved pharmaceutical product. They are connected to the International Nonproprietary Names (“INN“) of the active ingredient, allowing multiple patents to be listed for the same active ingredient. This entails that a single patent may appear multiple times if it covers more than one active ingredient.

In Mexico, patent litigation in general, including those related to medicinal products and medical devices, is initially handled by the Mexican Institute of Industrial Property (“IMPI”), which addresses cases of patent infringement and invalidity. Unlike other jurisdictions, Mexico does not have a discovery process. Instead, parties must submit evidence along with the initial complaint. Any type of evidence, except testimonial and confessional evidence, is admissible to establish infringement. It is common for parties to provide expert opinions and request inspection visits conducted by IMPI.

Preliminary injunctions are available to cease from performing infringing activities. Once the plaintiff files the infringement claim and supporting evidence, and it is accepted by IMPI, the defendant has 10 business days to respond. The defendant can argue non-infringement and may also counterclaim the invalidity of the patent. The invalidity process is similar to the infringement process, with the main difference being that the response time for an invalidity complaint is one month. If an invalidity counterclaim is filed, both the infringement and invalidity actions will be resolved together by IMPI to avoid contradictory decisions.

Additionally, since 2020, the Federal Law on the Protection of Industrial Property (“LFPPI“) stipulates that the indemnity for patent infringement will never be less than 40% of the “legitimate value indicator” presented by the affected party, either directly before a Federal Civil Court or before IMPI after concluding the infringement action. If the case is brought to the Civil Court and an invalidity action is filed before IMPI, the Civil Court case will be suspended until the invalidity decision is final. The “legitimate value indicator” can be calculated using any of the following methods, starting from the date of infringement:

• The value of the infringed goods or services, calculated at the market price or suggested retail price;
• The profits that the owner would have lost due to the infringement;
• The profits that the infringer has gained from the infringement;
• The price the infringer would have had to pay the owner for a license, considering the commercial value of the infringed right and any existing contractual licenses.

Decisions made by the IMPI can be appealed to the IP Specialized Court of the Federal Tribunal on Administrative Matters. If necessary, the decisions of the IP Specialized Court can be further appealed to the Federal Circuit Courts.

Mexican culture has promoted the use of alternative dispute resolution mechanisms, reducing the reliance on jurisdictional procedures. The LFPPI (Chapter IV) includes a conciliation procedure for patent violation cases.

There are no direct restrictions on the use of the trademark rights unless a prior annulment declaration has been issued by the Mexican Institute of Industrial Property (“IMPI”). However, antitrust, consumer protection, and sanitary restrictions could affect the use of trademarks, although they do not compromise the validity of the trademark. For example, the name of a pharmaceutical product might initially be protected by a registered trademark but could eventually be disallowed by Federal Commission for the Protection against Sanitary Risks (“COFEPRIS”) due to different approval criteria on distinctiveness (e.g., the health law legal framework prohibits names that contain the same three letters in a word or any reference to organs and diseases in the product’s name).

In addition, limitations on the use of a trademark may arise from infringement actions related to unfair competition practices or trade dress violations. Since prior use rights are recognized under Mexican Federal Law on the Protection of Industrial Property (“LFPPI”), restrictions on the exclusive use of a protected trademark could also be updated, as prior users are not considered infringers.

From a health regulatory standpoint, the concept of health-related “product liability” is not extensively developed in Mexico. The most explicit regulations pertain to liability arising from clinical trials, where there is a clear obligation for the sponsor to cover medical treatment required to address complications directly related to the clinical research. However, broader notions of damage are not as clearly defined.

Regarding health-related services, liability pertains to the field of medical negligence, where physicians (individuals) may be held professionally liable for acts or omissions evaluated against the lex artis.

In Mexico, general rules of damages establish both contractual and non-contractual liability. Within non-contractual liability, there are different scenarios:

Objective liability – For inherently risky products arises under two circumstances: (i) within the consumer protection framework, when the supplier fails to provide the Instructions of Use; and (ii) under the civil code framework, unless it is proven that the damage resulted from the fault or inexcusable negligence of the victim. Regarding to the objective liability circumstance number (i), from a consumer protection perspective, it is important to consider that in the case of products or services that are considered potentially dangerous for the consumer, the supplier must include an instruction that warns about their harmful characteristics and clearly explains the recommended use or destination and the possible effects of their use, application or destination outside the recommended guidelines.

Subjective liability – This form of liability requires proof of illegal conduct, and it applies unless it can be demonstrated that the damage occurred due to the fault or inexcusable negligence of the victim. Manufacturers are required to adhere to quality control systems under the regulations that govern Official Mexican Standard (“NOMs”). These systems play a critical role in evaluating the standard of care within the subjective liability framework.

Class Actions were created in Mexico in 2011. While healthcare wasn’t explicitly included in the legal framework, the private healthcare market is covered by consumer protection law. So far, we have not seen a Class Action in the healthcare sector.

Administrative liability

The principal risk areas for administrative liability in a healthcare context are 1) interactions with Healthcare Professionals (“HCP“) who may work, at least part-time, in government hospitals or clinics, 2) interactions with government officials involved in the procurement of healthcare products or services and 3) legal actions related to failures or alleged failures to comply with regulatory requirements that apply to operations (including manufacturing, distribution, and detailing) medicinal products, medical devices, foods, and food supplements. Additionally, liability in privacy and consumer protection matters is considered under the administrative scope. This includes ensuring compliance with data protection and consumer protection laws and regulations to avoid penalties.

Companies must consider the risks related to the interactions with public officials when managing permits or licenses for pharmaceutical products or medical devices or when marketing or promoting them. The General Law of Administrative Responsibilities (“GLAR”) establishes the obligations, responsibilities, and sanctions for public officials and private parties who commit administrative offenses. Under the GLAR, “serious administrative offenses” (faltas administrativas graves), both for government officials and private parties, include bribery, and officials who engage in any of the serious administrative offenses may face consequences ranging from suspension of office to dismissal from their job, position or commission.

The GLAR provides that private parties commit the administrative offense of bribery if they promise, offer, or deliver any undue benefit to public officials in exchange for the public official performing or refraining from performing any act related to their functions or those of another public official or abusing their influence to obtain or maintain a benefit or advantage, whether or not the benefit or advantage materializes.

Companies that engage in serious administrative offenses are subject to financial sanctions, disqualification from participating in public contracts, suspension of activities, and even the corporate dissolution of the entity. Legal entities may be sanctioned with the suspension of activities and/or dissolution when (i) the company has obtained an economic benefit and the participation of the administration or oversight bodies or its partners is proven, and (ii) when the entity has been used systematically for the commission of serious administrative offenses.

In practice, many HCPs in Mexico work in both public and private sectors by operating their private practice (often in the afternoon) but also working in public hospitals (commonly in the morning hours). For that reason, if HCPs hold a position in any public hospital, the GLAR provisions apply to them because they are considered public officials. In this scenario, companies should conduct a case-by-case analysis of any HCP with whom they have contact or a business relationship and the position held by the HCP in any public entity due to the risk it may represent for companies and for the HCP himself or herself.

On the other hand, the Federal Commission for the Protection against Sanitary Risks (“COFEPRIS”) can request reports from the marketing authorization (“MA”) and make on-site inspections of the manufacturing, distribution, and/or storage facilities. COFEPRIS can initiate legal proceedings that can result in the revocation of authorizations, seizure of products, the suspension of activities. COFEPRIS also has the authority to impose fines up to 16,000 times the minimum wage to the closure of the facility.

Privacy

Failure to comply with the Federal Law on the Protection of Personal Data held by Private Parties (“FDPL“) may result in monetary penalties as high as US 3.6 million when Sensitive Personal Data is involved. It should be noted that, under the FDPL, these penalties are exclusive of any claim for damages that could be filed by the data subject.

Additionally, there are some criminal implications to be aware of regarding data privacy. The act of compromising the security of a database containing Personal Data to profit is a criminal offense, which can be punished with up to three years of imprisonment and up to six years when Sensitive Personal Data is involved. Furthermore, the act of collecting, using, disclosing, or storing Personal Data through deceit and with the intention to profit is also considered a criminal offense punishable with up to five years of imprisonment and up to ten years when Sensitive Personal Data is involved.

In the past, the National Institute of Transparency, Access to Information, and Protection of Personal Data (“INAI“) has demonstrated a strong pace as an enforcement authority. However, its practice is currently on standby due to the political context and recent reforms that have dissolved the INAI, transferring its powers to the Secretary of Anticorruption and Good Governance. As of now, we have not seen this new secretary resolve any cases.

Consumer Protection

Among the general obligations of consumer protection are to provide adequate and clear information about the different products and services, with correct specification of quantity, characteristics, composition, quality, and price, as well as about the risks they represent, and to avoid misleading advertising. Failure to comply with the Federal Consumer Protection Law (“FCPL“) may result in monetary penalties as high as US 205,925 and up to US $307,877 for particularly severe cases.

Criminal liability

The National Code of Criminal Procedures (“NCCP”) establishes that companies are guilty of a crime if the crime has been committed for the benefit of, on behalf of, or in the name of the company or with its resources, and if the company has failed to establish “due control.” This liability is regardless of the criminal liability that individuals may have. However, because corporate crime does not require showing intent (only a lack of “due control”), individuals may be liable as accessories to corporate crime even if the individual criminal guilt would be harder to prove. The NCCP’s burden of proof to sanction private parties is “beyond any reasonable doubt.”

The NCCP limits corporate crimes to those listed by the Federal Congress and each Mexican state. Among others, the Federal Criminal Code establishes corporate liability for money laundering, bribery, influence peddling, drug trafficking, fraud, tax fraud, and concealment. Nevertheless, in states that have not published their limited list of crimes for corporate liability, companies may be liable for homicide, assault, crimes that threaten life or against the health of people, etc. These may be relevant in a healthcare context.

The General Health Law (“GHL”) expresses a list of actions that constitute criminal offenses and administrative responsibility; stating the following:

1. Article 464: Anyone who adulterates, falsifies, contaminates, or alters food, non-alcoholic beverages, or any other substance intended for human use, posing a health risk, shall face one to nine years of imprisonment and a fine of one hundred to one thousand days of the minimum wage.
2. Article 464 Bis: Anyone who, knowingly or by the means of another person, authorizes or orders the distribution of spoiled or unsafe food, endangering another’s health, for their position in food institutions, shall face six months to two years of imprisonment or a fine of five hundred to five thousand days of the minimum wage.
3. Article 464 Ter: Whoever adulterates, counterfeits, contaminates, alters, or manufactures medicines without the requirements mandated by law shall face three to fifteen years of imprisonment and a fine of fifty thousand to one hundred thousand general minimum wages.
4. Article 464 Quarter: Whoever adulterates, falsifies, contaminates and alters or permits the adulteration, falsification of medical devices, their final containers for use or manufactures them without corresponding marketing authorization (“MA”) shall be condemned to three to fifteen years of imprisonment.

The same goes for anyone who adulterates, falsifies, permits adulteration or falsification of medical device packaging material, labelling, or changes its legend information and/or its identification numbers of keys.

While the field of digital health is constantly evolving, it remains relatively new in México, making its practical application limited. However, the health regulatory framework includes various product and service categories that can encompass digital health applications, primarily the General Health Law (“GHL”), the Regulation for Health Supplies (“SRMP“), NOM-241-SSA1-2021 – Good Manufacturing Practices for medical devices, and the Mexican Pharmacopeia.

From a health regulatory perspective, the lack of specific regulations for digital health applications, such as telemedicine, results in these being governed by the existing general rules that apply to traditional medical consulting rooms. These rules typically assume a physical establishment and in-person interactions.

The medical device (“MD”) product category is highly pertinent to digital health applications. MDs encompass sub-categories such as medical equipment, prostheses, diagnostic tools, dental products, surgical and healing products, and hygienic products. Currently, the Mexican Pharmacopeia and its supplements serve as the most comprehensive legal instrument for regulating digital health applications.

The Mexican Pharmacopeia Supplement on Establishments encompasses technical requirements pertinent to digital health, including key elements of e-prescriptions. Additionally, the recently revised Mexican Pharmacopeia Supplement on MDs has introduced a comprehensive Appendix on SaMD, which outlines detailed rules concerning the definition of SaMD, risk classification, quality system standards, clinical evaluation procedures, and mobile applications.

From a health regulatory standpoint, digital health applications can be classified as products, services, or both. When a regulatory category is triggered, numerous obligations and requirements become enforceable.

If a digital health product is determined to be a MD, several regulatory obligations will apply, including obtaining prior Marketing Authorization (“MA”). Additionally, other requirements must be met, such as (i) product-related requirements like advertising rules, (ii) establishment-related requirements such as good distribution practices regulations, and (iii) company-wide requirements including operating a techno-vigilance system.

If a digital health application is determined to be a healthcare service, several requirements must be met, including (i) filing a notice of operation for at least one consulting room, (ii) verifying the physician of record has a valid license to practice medicine in Mexico, and (iii) ensuring that the consulting room operates in full compliance with other technical requirements including minimal requirements of infrastructure and equipment.

The lack of specific regulations for digital platform providers in the digital health sector means that these entities are governed by existing general rules applicable to digital health applications, such as products, services, or establishments. These rules often assume in-person interactions or a brick-and-mortar establishment.

In recent years, several legislative initiatives have been introduced, including proposals to amend the GHL and specific NOMs, aimed at expressly regulating certain applications of digital health. However, none of these initiatives have successfully passed into law.

From a privacy standpoint, digital health applications must comply with the Federal Consumer Protection Law (“FCPL“), which, as previously mentioned, outlines the responsibilities of data controllers and processors, the requirements for privacy notices, and the security measures that must be implemented. In this context, the privacy notice must adhere to the principles of purpose, proportionality, and legality, tailored to the specific digital health product or service in question. Typically, these applications involve the processing of sensitive personal data, such as information related to patients’ health status. Consequently, the relevant legislation applies, necessitating the implementation of appropriate security measures and obtaining the express consent of the data subject for the collection and transfer of such sensitive personal data. These requirements are explained in greater detail in the answer to the question #8.

Since 2019, Mexico’s Public Healthcare System has faced supply issues. These were primarily due to administrative changes in public procurement by former president Andres Manuel Lopez Obrador (2018-2024), who altered the medical supplies procurement process four times during his term.

On  December 22, 2023, and  October 29, 2024, a Presidential decree instructed Laboratorios y Reactivos Biologicos de Mexico, S. de R.L. de C.V. (“BIRMEX”) to consolidate public procurement for the healthcare sector, including the Mexican Social Security Institute (“IMSS“), the Institute for Social Security and Services for State Workers (“ISSSTE“), IMSSS-Bienestar, National Health Institutes, and Federal Reference Hospitals. The Vice Ministry of Health was tasked with assessing needs and planning the consolidated purchase of medical products.

The current presidential administration, led by President Claudia Sheinbaum, has continued to implement public procurement under which BIRMEX consolidates all public procurement processes on behalf of the healthcare institutions, following the instructions of the Vice Minister of Health. To ensure the supply of medical products for the public healthcare system, the Ministry of Health issued a decree on December 4, 2024, allowing for the importation of medicines and medical devices that do not have a Marketing Authorization (“MA”) in Mexico, provided they possess an MA from certain recognized jurisdictions and are intended exclusively for the public market. For this purpose, it is necessary that the medicine or medical device is included in the national tender of medical products consolidated by BIRMEX and that an MA application is submitted following the first import of the product.

Two official decrees issued by the Ministry of Health (MoH) on January 28, 2020, and June 22, 2021, initially permitted the importation of medicines and medical devices without an MA during the pandemic. These decrees established the conditions under which this option could be exercised. A prior declaration of necessity from multiple authorities was required to activate the importation without an MA under these decrees. Both decrees have since been amended, and their mechanisms were superseded by the decree issued on December 4, 2024.

The current administration has declared its objective of positioning Mexico as the most attractive country in the region for the production of medical products. The aim is for Mexico to implement the production of vaccines, including vaccines with mRNA technology. This initiative seeks to support the national vaccination program and ensure the country’s self-sufficiency in medical products, particularly in response to potential pandemics.

Medical devices

The Mexican Association of Innovative Industries of Medical Devices (Asociación Mexicana de Industrias Innovadoras de Dispositivos Médicos or “AMID“) is the association that represents companies of the medical devices innovation and diagnostic systems sector, and is dedicated to the development of innovative medical technologies. AMID issued self-regulation applicable to its affiliated entities, including a Code of Conduct and a Code of Interaction with Health Care Professionals (the “AMID Codes”).

According to the AMID Code of Conduct, companies that commercialize medical devices must respect the following principles and guidelines:

• Companies must ensure that the medical devices they market are safe, effective, and of sufficient quality by complying with applicable current health regulations;
• Companies must implement the necessary mechanisms to ensure responsible conduct in activities such as sponsorship, donations, and promotion of their products;
• Companies must avoid any practices, agreements, or arrangements that have the effect or the purpose of reducing, obstructing, or impeding, or conditioning free competition or economic competition among economic agents;
• Companies must not use their relationships with Healthcare Professionals (“HCPs“) to influence or bias their commercial decisions through improper or undue advantages, avoiding any potential or actual conflict of interest;
• Relationships between companies and HCPs should remain independent from the use or recommendation of the companies’ products;
• Companies must always comply with applicable legal provisions in areas such as economic competition, anti-corruption, and health regulation, as well as market commercial standards.

Pharmaceutical associations

The National Chamber of Pharmaceutical Industry (Cámara Nacional de la Industria Farmacéutica or “CANIFARMA”) is an association that has established ethical standards implemented by the Ethics and Transparency Council of the Pharmaceutical Industry (“CETIFARMA“). These standards are considered to be the expected behaviour of all pharmaceutical companies, whether or not formally members of the association.

Code of Integrity, Ethics, and Transparency for Healthcare Supply Companies

The CETIFARMA Code of Integrity, Ethics, and Transparency for Healthcare Supply Companies (Código de Integridad, Ética y Transparencia de Empresas de Insumos para la Salud or “Integrity Code“) establishes the guidelines for pharmaceutical companies established in Mexico, and is intended to develop an ethical culture and corporate integrity, based on a self-regulation system, committed to transparency, fighting corruption, etc. The Integrity Code establishes that all promotional and marketing activities must make explicit their purpose and nature, avoiding misunderstandings or deceit.

Code of Best Marketing Practices

CETIFARMA’s Code of Good Marketing Practices (Código de Buenas Prácticas de Promoción) defines the ethical principles for the interactions between HCPs and pharmaceutical companies to ensure that their marketing practices are not intended to unduly influence HCPs to prescribe their products. This Code prohibits pharmaceutical companies from providing or offering to a HCP anything of value as an inducement or reward for prescribing or recommending a particular medicine or course of treatment.

In a related vein, this Code provides that CANIFARMA member companies can be held responsible for the misconduct of third parties that are acting on behalf of the CANIFARMA member companies. Therefore, companies must ensure that transactions involving third parties acting on behalf of the company are equally transparent and well-documented.

In March 2021, the First Chamber of the Supreme Court established guidelines to evaluate whether the human right to health has been properly protected (Legal precedent number 2022888, 1a. XIV/2021 (10a.)):

• Personal consideration: The Mexican state must consider the patient’s health, as well as their clinical and medical requirements, and must conduct its activities with the purpose of providing therapeutic and/or pharmaceutical treatment either to achieve a cure or to ensure the necessary treatment to control the disease symptoms (in case of chronic of degenerative disease), as well as controlling the worsening of patients’ physical and psychological integrity.
• Objective consideration: The Mexican state must guarantee that any medical treatment is suitable for the patient, to preserve the bioavailability and bioequivalence of the pharmaceutical product.
• Temporary consideration: The Mexican state must guarantee that the patient’s treatment is guaranteed in a timely, permanent and continuous way.
• Institutional consideration: The Mexican state must guarantee that health institutions in charge of guaranteeing medical treatments provide services with the highest standards of technology and medical specialization.

Similarly, in October 2023, the Supreme Court has established that the Mexican state has a duty of diligence and the obligation to provide medicines to patients facing diseases that involve the periodic supply of medicines for the protection of life, integrity and safety of people. This precedent was issued in the context of the shortages of drugs in public hospitals, impeding people’s right to access to a free healthcare system as established in the Constitution. (Legal precedent number 2027440, 1a./J. 151/2023 (11a.), issued by the First Chamber of the Supreme Court of Justice).

In 2018, Mexico introduced an Artificial Intelligence (“AI“) Strategy to establish a framework for AI development, becoming the 10th country to formalize an approach to AI. However, the previous administration under President Andrés Manuel López Obrador chose not to continue with this strategy. As the new administration of President Claudia Sheinbaum has only recently begun, it remains unclear whether developing regulations for AI are on the agenda. Consequently, it is unlikely that any policy developments on AI will occur in the near future. Nonetheless, since 2023, two draft bills aimed at regulating AI healthcare applications have been discussed in the lower chamber (Cámara de Diputados). Given that Mexico currently lacks specific regulations addressing AI their healthcare applications are governed solely by the existing health regulatory framework.

In November 2024, the Mexican President, Claudia Sheinbaum, presented the Digital Transformation and Telecommunications Agency tasked with simplifying procedures managed by federal authorities, merging technological capabilities of the federal government, promoting technological solutions, encouraging austerity and combating corruption. This Federal Simplification Program will reduce the more than 7,000 federal procedures by half and will have 80% of data to be digital.

In addition, the President presented the incorporation of a National Cybersecurity Plan to safeguard the information collected by governmental agencies. Although these new digitization processes are not related only to the healthcare system, there are expectations that they will benefit the administration by reducing the time of procedures by half, and a Digital Medical Record will be implemented among all Mexican healthcare institutions.

In this context, since 2022, The Federal Commission for the Protection against Sanitary Risks (“COFEPRIS”) has implemented efforts to transition to a fully digital administration of its applications and procedures through its digital platform DIGIPRIS. This is an ambitious project, and full implementation is expected for 2027. Along with this digitalization trend, COFEPRIS has taken significant steps for the simplification of administrative procedures and to achieve regulatory harmonization with other regulatory authorities of reference to align technical criteria, further implement reliance, eliminate obsolete applications, and tackle administrative backlog.

There is a draft project to modernize the Regulation for Health Supplies (“SRMP“) to the extent that a new regulation may have been published altogether. Although the final texts are not publicly available, it is common knowledge that this project will address certain digital health applications and potentially reflect the current digital nature of administrative procedures.

• During the first months of 2025, President Sheinbaum is expected to send proposals to amend the Law on Acquisitions, Leases, and Services of the Public Sector (“LALSPS”) with the purpose of fighting corrupt practices.
• According to public media, she will submit a bill to create a General Law to Investigate and Punish Crimes for Acts of Corruption (“GLIPCAC”), both of which aim to establish a uniform investigation and prosecution policy throughout the country by standardizing principles and guidelines of the anti-corruption prosecutor’s offices, and by giving them full autonomy to effectively investigate and punish cases of small- and large-scale corruption.
• President Sheinbaum announced that the Nation’s Science Council will be a “ Secretariat”. The Leader of the Science, Humanities, Technology and Innovation will be Rosaura Ruiz Gutiérrez an evolutionary biologist; she holds a PHD from the National Autonomous University of Mexico (“UNAM“) and has a postdoc at University of California (UC), she was Mexico City’s secretary of education, science, technology and innovation.