Chile's cybersecurity law:
what Law 21.663 requires of companies

In brief

Law 21.663, the Ley Marco de Ciberseguridad, was published in April 2024. It creates the National Cybersecurity Agency (ANCI), which has been operating since 01.01.2025, and its remaining rules apply since 01.03.2025. The law has two tiers: providers of essential services and, as a narrower circle, Operators of Vital Importance (Operadores de Importancia Vital, OIV). Both must report incidents within short deadlines. OIVs also have duties that come very close to a management system under ISO 27001.

Anyone who knows the European NIS2 Directive will find their way quickly. Structure, terms and goals are similar. On two points Chile is even stricter: the first reporting deadline and the explicit certification of continuity plans.

Who the law covers

Article 4 lists the essential services. It covers all bodies of the state administration and holders of public service concessions, plus private companies in these areas: electricity generation, transmission and distribution, fuels, drinking water and sanitation, telecommunications, digital infrastructure, land, sea, rail and air transport with their infrastructure, banking, financial services and payments, social security, postal and courier services, hospitals, clinics and medical centres, and the production and research of pharmaceuticals.

Operators of Vital Importance

ANCI decides by resolution which companies are OIVs. The service must depend on IT networks and systems, and its disruption must have a significant impact on public order, supply or state functions. The agency can also designate companies outside the listed sectors if they have become critical for supplying the population. It has to take company size into account. The procedure runs through a preliminary list, a 30-day public consultation and a final list. The designation is reviewed at least every three years.

The first lists are out. The preliminary list of the first round appeared in September 2025. For the second stage, the preliminary list followed in April 2026 with Resolución Exenta 85 and the final one in July 2026 with Resolución Exenta 187. It covers 239 institutions, including new sectors such as fuels, water, transport and pharmaceuticals. Not being on the list is no permanent exemption: the next review will come.

Under Article 8, an OIV must, among other things:

• run a continuous information security management system and keep a record of its actions,
• draw up operational continuity and cybersecurity plans, have them certified and review them at least every two years,
• continuously review networks and systems, run exercises and drills and report findings to the CSIRT Nacional,
• train staff on an ongoing basis and appoint a cybersecurity delegate as ANCI's counterpart.

Reporting deadlines compared with NIS2

All covered institutions, not only OIVs, must report incidents with significant effects to the CSIRT Nacional. The clock starts when you become aware of the incident.

In practice: a reporting process designed for three hours meets NIS2 automatically. You do not need a second process for your EU customers, only an extra list of recipients.

Fines

Article 40 sets fines in monthly tax units (UTM). For OIVs the caps double. The amount depends on factors such as the company's size and economic capacity and whether it reoffended within three years.

For comparison: NIS2 allows up to 10 million euros or 2 % of worldwide turnover for essential entities. Chile's cap is lower, but the duty to keep certified plans makes violations easier to prove.

What it means for your EU customers

European customers ask Chilean suppliers about information security, reporting deadlines and audit rights, because NIS2 requires them to secure their supply chain. A Chilean OIV already has most of the answers: management system, continuity plans, training, reporting channel. It pays to document this evidence so that it also holds up in your EU customer's audit, for example with a mapping to ISO 27001.

One way to do it: keep Law 21.663, NIS2 and ISO 27001 in one shared register. In Sightadel you can use NIS2 and ISO 27001 as frameworks and add the Chilean requirements as a framework of your own; the platform is available in Spanish.

First steps

1. Use Article 4 to check whether your company provides an essential service. IT providers should look at this especially carefully.
2. Look for your company in ANCI's OIV resolutions and follow the next public consultation.
3. Set up a reporting process that meets the three hours, with on-call duty, templates and a clear decision on who reports.
4. Build the management system to ISO 27001 even if you are not an OIV. It covers most questions from EU customers.
5. Check regularly what is reachable from the internet. ANCI requires continuous reviews, and EU customers ask about it.

The free EU Readiness Check shows where you stand overall. More on data protection and trade on the Chile page.

FAQ