On June 24, 2026, the National Cybersecurity Agency (ANCI) published the Executive Summary of the public consultation conducted during the second stage of the first designation process for Operators of Vital Importance (OIVs), carried out under Law No. 21,663 and Supreme Decree No. 285. This marks an important milestone in the process of identifying the entities that will be subject to the enhanced cybersecurity obligations established by the new regulatory framework.
- Contexto regulatorio
La Ley N°21.663 establece un régimen especial de ciberseguridad para determinadas entidades cuya continuidad operacional resulta esencial para el funcionamiento del país. Entre estas se encuentran los Operadores de Importancia Vital (OIV), definidos como aquellas instituciones que dependen de redes y sistemas informáticos para la provisión de sus servicios y cuya afectación podría generar un impacto significativo en la seguridad pública, la continuidad de servicios esenciales o el cumplimiento de funciones del Estado.
The procedure for identifying these entities is governed by Supreme Decree No. 285, which provides that OIV designations will be carried out on a sector-by-sector basis and will include public consultation periods before ANCI issues the final list of designated entities.
- Sectors Covered in the Second Stage
The second stage of the designation process included entities operating in the following sectors:
- Fuel transportation, storage, and distribution.
- Drinking water supply and sanitation.
- Land, air, rail, and maritime transportation.
- Administration of social security benefits.
- Postal and courier services.
- Pharmaceutical manufacturing and research.
- Public utility concessionaires.
Following its preliminary assessment, ANCI identified 372 organizations as potential Operators of Vital Importance.
Results of the Public Consultation
The public consultation was conducted between April 24 and May 25, 2026, during which 439 comments were submitted by individuals and legal entities.
According to ANCI's Executive Summary, the principal issues raised included:
- The omission of certain entities from the preliminary list, particularly telecommunications companies providing emergency-related services.
- Objections by certain organizations to their proposed designation as OIVs, arguing that they do not satisfy the statutory requirement of depending on information systems and networks for the provision of their services.
- Requests for clarification regarding the timelines for implementing and complying with the obligations applicable to Operators of Vital Importance.
ANCI will consider these comments in preparing the final list of designated entities.
- Next Steps
Pursuant to Supreme Decree No. 285, ANCI has 30 calendar days from the publication of the Executive Summary to issue the final list of Operators of Vital Importance for the sectors covered during this stage.
Once the final list is published in the Official Gazette, designated entities should promptly assess the obligations applicable to them under Law No. 21,663 and its implementing regulations.
Entities that disagree with their designation may pursue the administrative remedies available under Law No. 19,880, as well as the judicial appeal provided for in Article 46 of Law No. 21,663.
- Practical Implications for Organizations
Designation as an Operator of Vital Importance entails compliance with a comprehensive set of enhanced cybersecurity obligations, including:
Organizations operating within the affected sectors should therefore assess, as early as possible, whether they are likely to be designated as Operators of Vital Importance and evaluate their current level of compliance with the requirements established under Law No. 21,663 and its implementing regulations.
For further information regarding the OIV designation process or the obligations established under Law No. 21,663, please contact Macarena Naranjo (mnaranjo@jdf.cl) or Consuelo Santana (csantana@jdf.cl).
