By means of Exempt Resolution No. 187, published in the Official Gazette on July 24, 2026, the National Cybersecurity Agency ("ANCI") approved the final list of Operators of Vital Importance ("OVIs") corresponding to the second stage of the first classification process, thereby concluding the first classification process for Operators of Vital Importance established under the Cybersecurity Framework Law.
Outcome of the Second Stage of the Classification Process
Following the review of the comments submitted during the public consultation process and the technical reports issued by the relevant sectoral authorities, ANCI classified 239 institutions as Operators of Vital Importance out of the 372 entities that had been preliminarily identified under Exempt Resolution No. 85 of 2026.
The entities classified as Operators of Vital Importance belong to the following sectors:
- • 25 companies engaged in the transportation, storage or distribution of fuels (including LPG, liquid fuels, natural gas, maritime terminals and regasification plants).
- • 18 drinking water supply and sanitation companies, which together provide services to approximately 98% of the country's regulated customers.
- • 40 land, air, rail and maritime transportation companies, including ports, airports, airlines, railway operators and Santiago's public transportation concessionaires.
- • 32 public utility concessionaires, including highway, airport and port operators.
- • 25 social security benefits administrators, including Pension Fund Administrators (AFPs), private health insurance institutions (Isapres), compensation funds and the unemployment insurance administrator.
- • 15 pharmaceutical manufacturing laboratories.
- • 84 entities belonging to sectors included during the first stage of the process that had not previously been classified.
With the completion of this second stage, ANCI has concluded the first classification process, resulting in a total of 1,154 institutions being designated as Operators of Vital Importance.
Main Implications for Classified Entities
Organizations included in the final list are now subject to the obligations established by the Cybersecurity Framework Law for Operators of Vital Importance, including:
- • Appointing a Cybersecurity Officer.
- • Implementing an Information Security Management System (ISMS).
- • Establishing ongoing cybersecurity training programs.
- • Developing and implementing business continuity plans with a cybersecurity focus.
- • Complying with the incident reporting and notification obligations established under the applicable legal framework.
Administrative and Judicial Remedies
Entities that consider their classification to be unwarranted may file the administrative remedies provided for under Law No. 19,880 before ANCI's Office of the Clerk (Oficina de Partes), without prejudice to the judicial appeal established in Article 46 of the Cybersecurity Framework Law.
Review of the Final List
The list of Operators of Vital Importance corresponding to this second stage is set forth in Exempt Resolution No. 187 of 2026, which is attached to this Legal Alert for reference.
Should you require further information regarding this matter, please contact Macarena Naranjo (mnaranjo@jdf.cl) or Consuelo Santana (csantana@jdf.cl).
