Interview: Ricardo García Giorgana and Xavier Careaga on AI, M&A and the Future of Regulation in Mexico  

"AI governance cannot be only a reactive response. Anticipation is the winning strategy."
 

At Latin Counsel, we are pleased to speak with two of the leading voices at the intersection of M&A, digital regulation and artificial intelligence in Mexico and Latin America.

Ricardo García Giorgana, M&A and Technology partner at Galicia Abogados, has played a leading role in some of the region’s most sophisticated transactions and technology-driven deals in the past decade.

Xavier Careaga, AI, Technology and Media counsel at the firm, brings more than three years of experience at Galicia and previously served as GC for Latin America at Meta. His in-house and strategic perspective have positioned him as a trusted advisor and expert on high-profile technology, AI and regulatory matters for major clients, at a time when AI is reshaping not only business models, but also the legal and strategic architecture of corporate transactions.

From the transformation of due diligence processes and risk allocation in M&A transactions, to the emerging regulatory challenges surrounding data, algorithms, digital platforms and "as a service" business models, both lawyers offer a particularly valuable perspective on how companies, private equity funds and legal advisors must prepare for an economy increasingly driven by artificial intelligence and technology.

It is a privilege to present this conversation with two highly regarded practitioners recognised for their deep understanding of Mexico’s corporate, technological and regulatory landscape, as well as for their ability to anticipate the trends that will shape the future of business and law across the region.

LATIN COUNSEL: How is artificial intelligence redefining the way M&A transactions are structured, negotiated and executed in Mexico, from due diligence through to risk allocation and the valuation of intangible assets?

Ricardo García Giorgana: AI is of course transforming M&A from within and across the entire process. Due diligence is without doubt the process that has received the greatest attention from legal teams, identifying areas of opportunity that can immediately benefit from AI tools that allow the generation of matrices with specific contractual terms, the filtering and creation of lists with easily adjustable thresholds, which identify contractual risks, regulatory contingencies and patterns across hundreds of documents.

On the buy side of a transaction, the use of AI is now indispensable, as it enables the work that previously took weeks or months to be completed in days (if not hours). At the same time, those same tools can be used, especially on the sell side, for the generation of disclosure schedules linked to the representations and warranties of a transaction agreement; both special counsel (external firm) and the in-house team of a seller or target, as the case may be, can and should now rely on AI for the generation of these documents, whose effect is to identify and mitigate risks in a transaction which, in turn, may translate into indemnity obligations that are most frequently enforced post-closing of a transaction.

It is not difficult to imagine that in the immediate future, a lawyer’s ability to work with multiple AIs (at any stage of their professional development) will be as useful and important as having mastery of the legal knowledge they are presumed to already possess. For this reason, one of the most relevant challenges we face as lawyers and for firms in general is training and upskilling to implement AI in these types of processes in the most responsible, efficient and careful manner. We are achieving this through training sessions, clear usage policies and sharing use cases in weekly focus groups. In Mexico, the regulatory gap adds uncertainty in cross-border transactions, especially when the foreign buyer demands standards from its own jurisdiction. In our practice we already use AI responsibly in document review processes, which allows us to be more agile and precise, but always with the lawyer’s legal judgement at the forefront and as the priority.

LATIN COUNSEL: What opportunities and new legal challenges are you seeing in transactions involving companies whose value depends on AI, data and "as a service" models, especially for private equity funds and strategic buyers?

Ricardo García Giorgana: Companies whose core is AI, data or SaaS/AIaaS models represent a new category of target that private equity funds and strategic buyers are evaluating with great interest. In due diligence, new critical questions arise such as determining who owns training data, whether third-party licences are involved, or whether the model was trained on personal data and under which regulatory framework. "As a service" models present novel contractual risks: reliance on third-party APIs, acceptable use clauses that change unilaterally, and post-closing operational continuity. For private equity funds, the real asset is not just the code, but the entire ecosystem of data, talent and contracts surrounding the model. That is the lens that must be brought into the analysis.

LATIN COUNSEL: As a lawyer recognised in both M&A and TMT, at what point does a transaction stop being primarily a corporate deal and become one that requires a completely different legal-technology strategy?

Ricardo García Giorgana: The inflection point occurs when the most valuable asset of the transaction is not on the traditional balance sheet; when what is truly being acquired is an AI model, a dataset or a technological architecture, the tools of classic M&A are simply not sufficient and therefore must evolve and adapt. In practice, this moment arises when conventional corporate due diligence begins to generate more questions than answers: Who owns the training data? Are there critical dependencies on third-party APIs? How is the underlying software licensed? It also occurs when standard reps & warranties do not cover the real risks, such as algorithmic bias, compliance with privacy regulations, or the accelerated obsolescence of the technological asset post-closing.

In joint ventures, the strategy changes from the very first negotiation; significant effort is dedicated by both parties to reaching agreements on who controls the data generated, identifying the correct vehicle that will act as the holder of shared intellectual property and how to protect it, as well as establishing corporate governance rules around that vehicle, rules for equity transfer in that same vehicle, and the mechanisms to be implemented if the joint venture is dissolved or ends prematurely. The challenge lies in identifying that moment early, before the corporate structure is already locked in and costly to fix.

LATIN COUNSEL: Are we facing a technology that accelerates transactions, expands business and improves efficiency, or one that requires a complete overhaul of the legal and competitive framework?

Ricardo García Giorgana: Both. It is precisely in that tension where the most relevant and nuanced work for M&A lawyers lies today. AI undoubtedly accelerates transactions, as it shortens due diligence timelines, improves risk identification and enhances valuation accuracy. That is a fact we already experience in practice.

But it also forces us to rethink legal structures we previously took for granted or that are standardised, such as who is liable when a model causes harm?

Our task is to consider all alternatives to cover every front. On the other hand, and without being an expert in competition law, a problem arises from the high concentration of data and computing power in a few hands, which is generating antitrust discussions that were previously unthinkable in technological contexts. My view is that there is no need to choose between either narrative.

The clients who will succeed are those who leverage the speed provided by AI without losing sight of the fact that the legal framework is still under construction, and that it must be strategically built with them.

LATIN COUNSEL: What are today’s main regulatory challenges and opportunities posed by artificial intelligence for the digital ecosystem in Mexico, and how can companies innovate while maintaining compliance, transparency and rights protection?

Xavier Careaga: In Mexico, more than 170 legislative initiatives related to AI have been presented before Congress, which reflects political will, but without a clear and organised strategy or a deep technical understanding by legislators and authorities, a sufficient regulatory standard cannot be achieved. It is anticipated that in the last quarter of 2026 or early 2027 a General AI Law with potential for advancement will be introduced, which makes it urgent for companies to begin preparing now rather than when the law is already in force.

The main challenge is fragmentation, as we have identified multiple isolated initiatives by sector or by specific topics such as criminal law, without a common architecture of principles, which creates uncertainty for those designing AI products.

The opportunity lies in actively participating in the regulatory conversation. Companies that implement AI and document their compliance, transparency and risk mitigation practices today will have a competitive advantage when regulation arrives. Responsible innovation requires legal design from the very beginning of the product, privacy by design, fairness by design, and not as a layer added at the end. And the trend indicates that future regulations will include obligations in this regard, especially concerning children in the digital environment.

LATIN COUNSEL: From your experience, which sectors and business models will face the greatest regulatory scrutiny due to the use of AI, and what international trends should Mexican companies observe to anticipate regulatory developments?

Xavier Careaga: The sectors with the highest imminent regulatory risk are financial services (credit scoring, automated AML), healthcare (AI-assisted diagnosis and clinical decision-making), and platforms with algorithmic recommendation systems.

There is also growing attention on AI systems applied to employment, education and any automated decision that significantly impacts individual rights. The EU AI Act is the most structured reference, classifying systems by risk level and imposing proportional requirements, which is not entirely adequate with respect to the nature of AI, but we have seen trends in Mexico, and regulation and architecture in this direction will inevitably emerge when legislating.

The United States is advancing in a more fragmented way, both by sector and by state, but with agency guidelines that set relevant trends we closely follow. Japan and Singapore offer interesting models of principle-based regulation, distribution of responsibility and regulatory sandboxes, particularly useful for ecosystems seeking not to hinder innovation while building legal certainty.

Mexican companies with foreign operations or investment are already subject to many of these rules today, even if they are sometimes unaware of it.

LATIN COUNSEL: What is forcing AI to be rethought in Mexico: innovation, regulatory risk, or the concentration of power in data and technology?

Xavier Careaga: These three factors operate simultaneously, but if one must be identified as the most structural, I consider it to be regulatory risk. The arrival of regulation is imminent, and examples of recent initiatives that have not progressed show a lack of understanding of the technical reality of how AI works, which will force companies to make operational changes to comply.

Mexico generates enormous volumes of data, but processing infrastructure, foundation models and large AI systems are concentrated in a handful of global companies. Regulatory risk is pushing companies towards better AI governance practices, which is positive, but it cannot be only a reactive response. Anticipation is the winning strategy.

Innovation, for its part, shows that AI can solve real problems in Mexico, such as access to services, institutional efficiency and financial inclusion, which justifies regulation that protects without paralysing. What interests me most in rethinking is the role of the lawyer in all of this, not as a compliance watchdog, but as an architect of solutions that are legally sustainable, socially responsible and competitively viable in the long term.