When algorithms hire: AI recruitment and employment risk in Mexico

Anti-discrimination risks

Mexican labour law and the Federal Law to Prevent and Eliminate Discrimination prohibit employment decisions based on protected characteristics, including gender, age, disability, and health status. AI systems trained on historical hiring data from another jurisdiction may reproduce patterns that correlate with these characteristics, even without relying on them directly.

A résumé-ranking algorithm that penalises employment gaps, for example, could disproportionately affect women who take maternity leave. This is a pattern unlikely to trigger review under the compliance framework the tool was built for, but one that creates direct exposure under Mexican law.

The practical challenge is accountability. Job applicants have no legal relationship with the software vendor, only with the potential employer, therefore a discrimination claim can be brought against the company that made the hiring decision, regardless of whether an AI tool influenced it.

Data protection considerations

Mexico's data protection framework, reformed in 2025, requires transparency through an appropriate privacy notice and a valid legal basis for processing, with additional requirements for sensitive data. Some AI recruitment tools process biometric information through facial or voice analysis, which may fall into that category.

The 2025 reform also expanded the right of access, allowing individuals to request not only their personal data, but information on how it was processed. Mexican law does not establish a standalone right to an explanation of automated decisions. The exposure instead comes from the underlying transparency obligation: if the privacy notice does not describe how the AI tool processes candidate data, there is a gap in compliance, not in the algorithm.

A practical scenario

Consider a company using a centralised AI screening platform across jurisdictions, relying on a global privacy notice drafted elsewhere. A rejected applicant requests access to their data. If the notice was never localised into Spanish and never disclosed the relevant processing activities, the company faces a documented gap regardless of how the algorithm reached its decision. Combined with a plausible discrimination pattern, this creates exposure on two fronts at once.

Building a defensible process

Companies do not need to abandon AI recruitment tools to operate compliantly in Mexico. They need a governance framework that withstands scrutiny: 

• A Mexico-specific privacy notice;
• A documented legal basis for processing; 
• Meaningful human oversight of AI-assisted decisions; and 
• Periodic bias assessments.

In Mexico, the legal risk around AI in recruitment is often less about the sophistication of the technology than the governance surrounding it. Employers that can demonstrate how AI-assisted decisions are disclosed, reviewed, and monitored will be better positioned if challenged.

---

Mauricio Saul Ramos, Consulting Director at Guerrero Santana, has more than 15 years of experience advising domestic and international clients on a wide variety of matters. He is also a professor at the undergraduate level teaching courses like Innovation, Project Feasibility, and Strategic Planning.