MexicoCódigo Penal Federal, Unauthorised Access to Computer Systems and Equipment (Arts. 211 bis 1 to 211 bis 7)
Código Penal Federal, Arts. 211 bis 1 al 211 bis 7
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not modify, destroy, cause the loss of, learn of, or copy information in a computer system or equipment that is protected by a security mechanism, without authorisation to access it.
- Reading a publicly available, unauthenticated page that defeats no security mechanism has not itself been held to violate this chapter; defeating a login or another access control to reach the same data plausibly does.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 211 bis 1: 6 months to 2 years' imprisonment for unauthorised modification, destruction, or loss of protected information; 3 months to 1 year for unauthorised access to or copying of it. Articles 211 bis 2 to 211 bis 5 impose heavier ranges, up to 10 years, for State and financial-sector systems, with an additional penalty of removal from office and 4 to 10 years' disqualification for a public servant who commits the public-security variant. Article 211 bis 7 increases every penalty in the chapter by up to one half where the information is used for personal or third-party benefit.
What it makes you log
Logging duty
Articles 211 bis 1 to 211 bis 7 punish unauthorized modification, destruction, loss, knowledge or copying of information in protected computer systems (private, State and public-security systems), with higher penalties for insiders and where the information is used for gain. None requires a log or record; the reference in article 211 bis 2 to criminal-procedure records is an aggravating circumstance. The Code's general scope articles (arts. 1 to 4, offences begun or producing effects in the Republic, offences abroad) are not invoked by these articles, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 211 bis 1 punishes with 6 months to 2 years' imprisonment and a fine anyone who, without authorisation, modifies, destroys, or causes the loss of information contained in a computer system or equipment protected by a security mechanism, and with 3 months to 1 year's imprisonment anyone who, without authorisation, learns of or copies such protected information.
Articles 211 bis 2 and 211 bis 3 impose heavier penalties, up to 10 years for public-security systems, for the same conduct against a State computer system, distinguishing an outsider acting without authorisation from an insider authorised to access the system who acts improperly within it. Articles 211 bis 4 and 211 bis 5 apply a parallel regime to financial-sector computer systems.
Article 211 bis 7 increases every penalty in the chapter by up to one half where the information obtained is used for the offender's own benefit or a third party's. Each offence turns on defeating a security mechanism protecting the system ("protegidos por algún mecanismo de seguridad") without authorisation; the text does not on its face reach reading a page that carries no such mechanism. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .