Mexican Official Standard on telework NOM-037-STPS-2023

In forceNOM-037 telework

Summary

Mandatory standard for workplaces with people who telework more than 40% of their working time. It requires a list of teleworkers, a telework policy and data and information protection mechanisms. It matters for AI when monitoring or remote-work management tools are used.

Who it applies to

Employers in Mexico with staff teleworking more than 40% of their working time.

Penalties

Fines of 250 to 5,000 UMA (per secondary sources).

Official name: NORMA Oficial Mexicana NOM-037-STPS-2023, Teletrabajo-Condiciones de seguridad y salud en el trabajo
Official reference: DOF 8-jun-2023 (edición vespertina); vigente desde el 5-dic-2023, 180 días naturales después de su publicación
Regulator: Ministry of Labor (STPS)
Official source: Check the sourceHow we verify sources

Key dates

June 8, 2023Published in the DOF
December 5, 2023Takes effect

Obligations and dates

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Telework policy with data protection	NOM-037-STPS-2023, numerales 5.1, 5.2 y 6.6; Apéndice 1 (informativo)	In force	Already applicable	If you have staff teleworking more than 40% of their time and use work monitoring or management tools, including AI-based ones.	Verified in the official source on November 4, 2026

Telework policy with data protection

NOM-037-STPS-2023, numerales 5.1, 5.2 y 6.6; Apéndice 1 (informativo)In force

Already applicable

When it relates: If you have staff teleworking more than 40% of their time and use work monitoring or management tools, including AI-based ones.
What the rule provides: Have a telework policy with data protection and information security rules.
Tell teleworkers which supervision mechanisms are used and respect their privacy and right to disconnect.
Keep the list of teleworkers.
Typical evidence: Signed and communicated telework policy.
List of teleworkers.
Supporting documents: Data Governance Guidelines for AI
AI Security Baseline
Responsible AI Use Policy (Including Generative AI)
Verification: Verified in the official source on November 4, 2026Checked in the DOF: item 5.1 (up-to-date list of remote workers), 5.2 (written telework policy, with monitoring mechanisms that respect privacy and disconnection), 6.6 (employer's data protection policies) and Appendix 1 (informative). Effective 180 calendar days after publication (Dec 5, 2023). Fines come from the Federal Labor Law per secondary sources. It is not an AI rule; it is included because it calls for data protection rules in remote work, where AI and monitoring tools are common.