Chile's Cybersecurity Law 21.663: What Boards Must Prove to ANCI

Chile's Law 21.663, the Cybersecurity Framework Law, requires every organization that provides an essential service in Chile to register with ANCI (the National Cybersecurity Agency) and to send an early warning within 3 hours of becoming aware of a significant-impact incident. The 1,154 operators of vital importance (OIVs) designated as of July 2026 must also run a continuous security management system, maintain continuity plans, apply minimum containment measures and appoint a cybersecurity delegate with a direct line to the highest authority in the organization.

The law is already in force: 1,154 OIVs and more than 400 incidents reported

For the board, the question is no longer “what does the law say.” The question is what your company can prove when ANCI asks, because the framework is already running with real lists, deadlines and reports.

Law 21.663 was published on April 8, 2024. It created ANCI and set management and reporting obligations backed by a sanctions regime. Since March 1, 2025, every public or private organization that provides an essential service must report significant-impact incidents to ANCI. According to the agency itself, the content of the report is governed by Decree 295/2024, published that same day, and there is an official incident taxonomy and an operational reporting portal.

The first year produced concrete numbers. According to ANCI's annual review, published in January 2026, 3,258 institutions registered in 2025, the agency received more than 400 incident reports, 18 of them involving ransomware, and more than 26,000 people were trained.

The OIV designation process has also completed its first cycle. The preliminary list for the first stage was published on September 16, 2025 and the final list on December 17, 2025, with 915 institutions, through Exempt Resolution No. 87. According to TrendTIC, the preliminary list included 1,712 entities. The public consultation cut the list almost in half, which shows that well-founded objections made a difference.

The second stage began with a preliminary list of 372 institutions on April 24, 2026, which drew 179 objections. The final list, dated July 24, 2026 (Exempt Resolution No. 187), designated 239 institutions and closed the first process with 1,154 OIVs. Both resolutions are available in ANCI's register of resolutions.

What this means for a regional operation

Chile ranked first in Latin America and the Caribbean in the 2025 cybersecurity report by the IDB (Inter-American Development Bank) and the OAS (Organization of American States), with 228 points, equivalent to 74% of a 62-indicator model. According to ANCI's January 2026 review, the country also ranked 19th worldwide in the NCSI (National Cyber Security Index, an international index of national cybersecurity capabilities) in the edition current at the end of 2025.

For a multinational, the Chilean model of staged reporting, a dedicated delegate and supply chain coverage is a reasonable reference point for preparing other operations. That is an editorial inference, not a regulatory certainty: what is certain is that the law applies to anyone providing essential services in Chile.

The contrast with neighboring countries has practical consequences. Each country in the region sets its own authorities, deadlines and reporting criteria, so there is no single regional clock; confirm the rules in every country where you operate with local counsel. A protocol designed to issue an alert within 3 hours in Chile can be adapted to other countries' deadlines; one designed for longer deadlines cannot be accelerated overnight. If you also operate in Brazil, add to that map the notification obligations under the LGPD (Brazil's General Data Protection Law) before the ANPD (National Data Protection Authority), and confirm them with local counsel.

Is your company an OIV, an essential service, or neither?

The law sets two levels of obligation, and confusing them is the first compliance mistake.

Essential service provider. Article 4 of the law covers State Administration bodies, the National Electricity Coordinator, services provided under public service concessions, and private companies in electricity generation, transmission and distribution; fuels; drinking water and sanitation; telecommunications; digital infrastructure; third-party managed digital and IT services; transportation and its infrastructure; banking, financial services and payments; social security; postal services; institutional healthcare; and pharmaceuticals. These organizations must register and report significant incidents.
OIV. These are the entities ANCI has designated by resolution. They carry additional, ongoing management duties.

Registration is not a minor formality. General Instruction No. 1, issued on June 4, 2025, requires essential service providers to register on the reporting platform, and failing to do so is a minor infringement.

For OIVs, the additional duties include a continuous ISMS (information security management system), a record of actions, continuity and cybersecurity plans, reviews and exercises, training, and a delegate. In practice, each of these duties must leave documentary evidence that the company can produce.

The cost of non-compliance

Fines are expressed in UTM (unidad tributaria mensual), an inflation-adjusted unit of account used in Chilean law. Article 40 of the law sets three tiers, with higher ceilings for OIVs, as the analysis published by the IAPP also details:

Infringement	Essential service	OIV
Minor	Up to 5,000 UTM	Up to 10,000 UTM
Serious	Up to 10,000 UTM	Up to 20,000 UTM
Very serious	Up to 20,000 UTM	Up to 40,000 UTM

Ask your CFO to convert these ceilings into Chilean pesos (or your reporting currency) using the UTM value for the month you present them. Show them to the board alongside the estimated cost of an essential service outage: that comparison is what lets the board prioritize the investment.

The 3-hour clock is won before the incident

Reporting follows a three-deadline scheme: an early warning within 3 hours of becoming aware of the incident, an update within 72 hours and a final report within 15 calendar days. If the affected entity is an OIV and its essential service is disrupted, the update must be delivered within 24 hours. Build your procedures on that scheme, not on third-party summaries.

Three hours is not enough time to convene a committee. If your protocol requires the CEO or the board to approve the alert, the company will be late. The board must decide in advance who is authorized to report, with what minimum information, and how the board is informed afterward.

The supply chain is part of the report

The regulation requires taking into account services delivered by suppliers and the supply chain. An incident at your cloud, managed services or software provider can become an incident you must report. If your contract gives the provider 48 hours to notify you, your 3-hour clock is already compromised.

One point to review in your contracts: because Article 4 covers third-party managed IT services, your provider may have its own reporting obligations. Agree in writing on how both reports will be coordinated so that two different versions of the same event are not sent to the regulator.

Minimum containment is already defined

General Instruction No. 4 sets minimum containment measures: access restrictions, system isolation, changing administrative credentials, closing exposed remote access, possible temporary suspension of services, default-deny firewalls and network segmentation.

Several of these measures carry a business cost. Suspending a service or isolating a plant affects revenue and customers. That decision needs an owner, written criteria and board backing before an incident occurs.

The cybersecurity delegate reports to the top, not to IT

General Instructions No. 2, 3 and 4 were published in the Official Gazette on December 26, 2025. They govern registration, the cybersecurity delegate and minimum containment. For OIVs, they take effect 60 calendar days after the final list that designates them.

In concrete terms, the 60 calendar days run from the final list that designates each OIV: December 17, 2025 for the first stage and July 24, 2026 for the second. Because the instructions were published after the first list, Legal should confirm the exact deadline. If your company appears on either list, ask Legal for your exact deadline and for evidence that the delegate has been appointed and notified.

General Instruction No. 3 requires that the delegate be able to report directly to the highest authority and have autonomy, without technical subordination to operational areas. This may change the security org chart at companies where the head of cybersecurity reports to the CIO (chief information officer). In addition, changes of delegate must be notified within 5 business days, and the delegate does not replace the person responsible for incident reporting.

For the board, the consequence is direct: the delegate needs a regular slot on the agenda, a budget and an escalation path that does not run through the people who operate the systems the delegate must oversee.

One incident may require two notifications

An attack that compromises systems and exposes customer data can trigger two regimes. Law 21.663 requires reporting it to the National CSIRT (computer security incident response team), under its Article 9. Law 21.719, which reforms personal data protection in Chile and creates a specialized authority, introduces a separate duty to notify security breaches affecting personal data.

The deadlines, recipients and content of the two reports are not identical. Check with your legal counsel the effective-date timeline for Law 21.719 and its notification deadline. What makes sense to do now is build a single decision matrix that the CISO (chief information security officer) and the DPO (data protection officer) use together. Two separate protocols produce contradictory messages to two authorities about the same event.

Checklist: what your company must be able to prove to ANCI

Use this table at your next risk committee meeting. Every row should be backed by documentary evidence, not just a verbal answer.

Obligation	Evidence you should be able to show	Suggested owner
Clear designation status	Review of Exempt Resolutions No. 87/2025 and No. 187/2026 for the parent company and each subsidiary	Legal
Platform registration	Registration receipt and up-to-date contact details	CISO
Delegate appointed (OIV)	Appointment record, reporting line to the highest authority and record of notification to ANCI	CEO and board
Incident reporting officer	Name, alternate and written authority to send the early warning	CISO
3 h / 72 h / 15-day reporting	Approved procedure and record of the latest exercise with measured times	CISO and Communications
Minimum containment (GI No. 4)	Evidence of segmentation, default-deny rules, reviewed remote access and a credential rotation procedure	CIO and CISO
Continuous ISMS (OIV)	Policies, record of actions, continuity and cybersecurity plans, review reports	CISO
Supply chain	Inventory of critical suppliers and notification clauses compatible with 3 hours	Procurement and CISO
Coordination with personal data rules	Single notification matrix for the CSIRT and the data authority	DPO and CISO
Training	Record of participants and content	Human Resources and CISO

Standards such as ISO 27001 or the NIST (U.S. National Institute of Standards and Technology) framework help structure this work. But the law and ANCI's instructions have requirements of their own, such as the reporting clock, the delegate and minimum containment. A current certification is a good foundation, not proof of compliance.

What to do in the next 90 days

Confirm your designation status (weeks 1–2; Legal and CISO). Check whether the company or its subsidiaries appear on either final list. Even if you are not an OIV, determine whether you provide an essential service and whether you are registered.
Validate the delegate (weeks 2–4; CEO and board). If you are an OIV, confirm that the delegate has been appointed and notified, reports to the highest authority and is not technically subordinate to IT operations. Schedule regular presentations to the board.
Delegate reporting authority (month 1; board and Legal). Approve in writing who sends the early warning without waiting for a committee, with alternates for nights and holidays.
Rehearse the clock (months 1–2; CISO, Communications and Legal). Run a crisis exercise that measures the actual time between detection and alert. If you are an OIV, also test the 24-hour update.
Walk through minimum containment (month 2; CIO and CISO). Compare your infrastructure against each measure in GI No. 4 and document gaps with deadlines and owners.
Renegotiate with critical suppliers (months 2–3; Procurement and CISO). Require notification deadlines compatible with your 3 hours, access to the information you need to report, and coordination rules if the supplier must also report.
Unify notification (month 3; DPO and CISO). Build a matrix that decides whether an incident goes to the CSIRT, the data authority or both. If you operate in other countries, add their deadlines and authorities.
Take the exposure to the board (month 3; CFO and CISO). Present the fines in pesos at the current UTM value, alongside the estimated cost of an essential service outage.

Four questions for your next board meeting: Are we an OIV or an essential service? Who sends the early warning at 3 a.m.? When was our last exercise and how long did it take us? Which suppliers could cause an incident we would have to report?

Frequently asked questions

If my company is not on the OIV list, is it outside the scope of the law?

Not necessarily. If you provide an essential service, you must register on ANCI's platform and have been required to report significant incidents since March 2025. OIV designation adds duties, but it is not the entry point to the law.

Is ISO 27001 certification enough to comply?

No. It helps organize the ISMS and generates useful evidence, but the law and ANCI's instructions have their own requirements, such as reporting deadlines, the delegate and minimum containment.

Has ANCI imposed any fines yet?

In the sources reviewed for this guide, we found no published sanctions. That does not reduce exposure: the Article 40 scale is in force, and failing to register is already classified as a minor infringement.

Can the CISO serve as the cybersecurity delegate?

The instruction requires the delegate to report directly to the highest authority and to be autonomous from operational areas. If your CISO reports to the CIO, review that reporting line with your legal counsel before making the appointment.

The GAITECX view

At GAITECX, we believe Law 21.663 is no longer just a legal matter: it is a test of corporate governance. The 3-hour clock is not won by the best firewall, but by the board that decided in advance who reports and with what information. That is why our Strategic Cybersecurity track brings CEOs, CISOs and legal leaders to the same table.