Chile's Ley 21.663, the Ley Marco de Ciberseguridad, gives essential service providers three hours from becoming aware of a significant incident to send an early alert to the national CSIRT, and since 1 March 2025 its reporting duty and sanctions regime have been in force. The law created the Agencia Nacional de Ciberseguridad (ANCI) as regulator, set duties for every institution providing essential services, imposed a heavier set of duties on designated operadores de importancia vital (OIV), and attached fines of up to 40,000 UTM for the most serious OIV infractions. This guide covers scope and OIV designation, the Article 8 and Article 9 duties, the reporting timeline and regulations, sanctions, and what the law means for machine identities and automated systems. It is for CISOs, compliance leads and incident response teams at Chilean essential service providers, OIV and their suppliers. It is a cyber law page; for personal data duties see the Chile Data Protection Law Guide. Status: summarised from the text of Ley 21.663 published by the Biblioteca del Congreso Nacional, ANCI material and Diario Oficial publications, checked 8 November 2026. English renderings of Spanish terms are our own. Article 9 deadlines, Article 40 fine amounts, the 8 April 2024 publication and Exempt Resolution No. 187 were checked against BCN and Diario Oficial texts. Confirm every obligation, deadline and penalty against the official text before relying on it.
Key takeaways
- 3, 72 and 15: an early alert within 3 hours, an update within 72 hours (24 hours for an OIV whose essential service is affected) and a final report within 15 calendar days, all to the CSIRT Nacional (Article 9).
- Two tiers of obligated entity: every essential service provider must report and apply ANCI protocols; OIV designated by ANCI resolution must also run an information security management system, certified continuity and cybersecurity plans, and appoint a cybersecurity delegate (Article 8).
- In force since 1 March 2025: OIV qualification, OIV duties, the reporting duty and the sanctions regime took effect on that date, alongside the incident reporting regulation and ANCI's incident taxonomy.
- Fines double for OIV: maximums of 5,000, 10,000 and 20,000 UTM for minor, serious and very serious infractions, doubled to 10,000, 20,000 and 40,000 UTM for OIV.
- OIV lists are live: ANCI is publishing final OIV lists in stages; the second stage of the first qualification process was approved by Exempt Resolution No. 187 of 21 July 2026.
Scope: who and what is covered
Article 1 sets the law's purpose: the institutions, principles and general rules for cybersecurity in state bodies and between the state and private parties, with minimum requirements to prevent, contain, resolve and respond to incidents. Article 4 applies the duties to institutions that provide essential services and to those designated as OIV.
| Category | Who is included (Article 4 and 5) |
|---|---|
| State bodies | Services provided by bodies of the state administration and the Coordinador Eléctrico Nacional |
| Public service concessions | Services provided under public service concessions |
| Private essential services | Electricity, fuels, water, telecommunications, digital services, transport, banking, health and pharmaceuticals, among the activities listed |
| Added services | Services ANCI qualifies as essential by reasoned resolution after public consultation, where disruption could seriously harm life, health, supply, the economy, the environment, national defence or public order |
| OIV | Essential service providers whose service depends on networks and IT systems and whose disruption would have a significant impact; private institutions outside the list can also qualify if critical to supply, distribution or strategic production |
ANCI designates OIV by resolution of its National Director, taking account of company size, particularly for micro, small and medium enterprises. The procedure runs through a report to sector authorities, a preliminary list within 30 calendar days, a final list within a further 30 calendar days, and a reasoned resolution that can be challenged under Ley 19.880. Designations are reviewed at least every three years. Being outside the OIV list does not take an essential service provider out of scope: the Article 9 reporting duty applies to every Article 4 institution.
| Body | Role |
|---|---|
| Agencia Nacional de Ciberseguridad (ANCI) | National cybersecurity authority; issues protocols, standards and instructions, designates OIV, supervises and, as a last resort, sanctions |
| CSIRT Nacional | Receives incident reports from essential services and OIV and notice of OIV exercises |
| CSIRT de Defensa Nacional | Defence sector response team |
| Sector authorities | Primary competence for supervision and sanctions in their sector under Article 37; ANCI handles the rest |
Key obligations
All essential service providers
- Apply ANCI protocols and standards (Article 7): ANCI sets protocols and standards for risk prevention and management and for containing impact on continuity, confidentiality and integrity, after public consultation, with measures differentiated by type of organisation. Sector-specific standards apply on top.
- Report significant incidents (Article 9): to the CSIRT Nacional on the timeline below, using the formats in the regulation and ANCI's instructions.
- Follow ANCI instructions: including during an incident; obstruction or refusal is a serious infraction.
Additional OIV duties (Article 8)
| Duty | What to produce |
|---|---|
| Continuous information security management system assessing likelihood and impact of incidents | ISMS with risk register |
| Record of the actions that make up the system | Evidence log as set by regulation |
| Continuity and cybersecurity plans, certified under Article 28 and reviewed at least every two years | Certified plans and review records |
| Ongoing reviews, exercises, drills and analyses, with findings reported to the CSIRT Nacional | Exercise programme and reports |
| Prompt action to limit an incident's impact and spread, including restricting access | Containment runbooks |
| Inform potentially affected parties when needed, especially where personal data is involved | Notification procedure |
| Training and cyber hygiene programmes for staff | Training records |
| Appoint a cybersecurity delegate as ANCI's point of contact | Named delegate registered with ANCI |
Reporting timeline (Article 9)
| Report | Deadline | Content |
|---|---|---|
| Early alert | 3 hours from becoming aware of an incident with significant effects | Initial notice |
| Update | 72 hours; 24 hours where an OIV's essential service is affected | Initial assessment, severity, impact, indicators of compromise where available |
| OIV action plan | As soon as adopted, no later than 7 calendar days after learning of the incident | Response and recovery plan |
| Final report | 15 calendar days from the early alert | Description and severity, likely threat or cause, mitigation taken and planned, cross-border effects |
| Situation report (ongoing incident) | In place of the final report; final report then due 15 calendar days after resolution | Status of the ongoing incident |
"Significant effects" is defined in Article 27. The incident reporting regulation (No. 295 of 2024) sets the minimum content of reports, and ANCI Exempt Resolution No. 7 of 2025 approves the incident taxonomy and the reporting process, with the official 24/7 reporting platform at portal.anci.gob.cl.
Vulnerability reporting
Articles 19 and 55 protect good-faith researchers who meet conditions, including registration with ANCI, prior notice, reporting to the system owner and ANCI as soon as possible, no intent to take or use information, no public disclosure, and the owner's consent for private systems. ANCI keeps the reporter's identity confidential. Organisations should align their vulnerability disclosure policy with these conditions.
Timeline and current status
| Date | Event |
|---|---|
| 8 April 2024 | Ley 21.663 published |
| 24 December 2024 | Decreto con Fuerza de Ley No. 1-21.663 published, deferring key provisions to 1 March 2025 |
| 1 March 2025 | Articles 5, 8, 9 and Title VII (sanctions) take effect; incident reporting regulation No. 295 of 2024 and ANCI Exempt Resolution No. 7 of 2025 (taxonomy) published |
| 21 July 2026 | ANCI Exempt Resolution No. 187 approves the final OIV list for the second stage of the first qualification process (Diario Oficial, 24 July 2026) |
The second-stage list covers sectors including fuel storage and distribution, potable water and sanitation, transport and ports, and public infrastructure concessions such as hospitals, prisons, airports and road tunnels. As of November 2026 the law is in force, and ANCI continues to issue general instructions; check ANCI's site and the Diario Oficial for the current OIV lists and instructions before you rely on a specific requirement.
Enforcement and penalties
| Infraction (Articles 38 to 40) | Maximum fine | OIV maximum | Examples |
|---|---|---|---|
| Minor (leve) | 5,000 UTM | 10,000 UTM | Late delivery of non-urgent information; not following ANCI instructions where no graver category applies; for OIV, no record of security actions, no training programme, no cybersecurity delegate, no notice of exercises to the CSIRT |
| Serious (grave) | 10,000 UTM | 20,000 UTM | Failing to implement protocols or standards; failing to report; false information to ANCI; obstructing ANCI during an incident; repeat minor infraction within a year; for OIV, no ISMS, no continuity or cybersecurity plans, no notice to affected parties |
| Very serious (gravísima) | 20,000 UTM | 40,000 UTM | False or erroneous information needed for an incident; repeat serious infraction within a year; not following ANCI instructions in a significant-impact incident; for OIV, failing to take timely measures to limit a significant-impact incident |
The UTM (unidad tributaria mensual) is an inflation-indexed unit published monthly by Chile's tax authority, so convert at the current value when sizing exposure. Sector authorities hold primary competence to supervise and sanction in their sectors (Article 37), with ANCI covering the remaining cases.
What it means for AI agents and non-human identities
- Containment means credential control: Article 8 requires prompt action to limit an incident's spread, including restricting access. For most intrusions that means revoking and reissuing service account credentials, API keys and tokens within hours. Map which machine identities reach each essential service before an incident.
- Three hours needs detection on machine activity: you cannot send an early alert about an incident you have not seen. Monitor service account and workload identity behaviour, not just user logins. See the Detection Engineering for Non-Human Identities Guide.
- Indicators of compromise in the 72-hour update: include compromised credential identifiers (key IDs, certificate serials, service account names) so the CSIRT Nacional can share them, without disclosing secret values.
- ISMS scope: an OIV's information security management system should inventory machine identities, owners and rotation, since these carry most privileged access in OT and cloud estates. The Critical Infrastructure Identity Security Guide covers the controls.
- AI agents: agents with access to essential service systems are both an access path and a potential incident source. Register them, give them scoped and short-lived credentials, keep a kill switch and log their actions so an early alert can say what the agent did. See the AI Agent Kill Switch and Containment Guide.
Compliance steps
- Confirm status: check whether your services fall in Article 4 and whether you appear on an ANCI OIV list; identify your sector authority.
- Register with ANCI's platform: set up access to portal.anci.gob.cl for named reporters with a 24/7 rota; OIV register the cybersecurity delegate.
- Build the Article 9 runbook: map the ANCI taxonomy to your severity scale, define who decides "significant effects", and prepare templates for the 3-hour alert, 72 or 24-hour update, 7-day action plan and 15-day final report.
- Run a timed exercise: test whether you can reach the early alert in 3 hours from detection, including weekends. Our recommendation: run it twice a year and report OIV exercise findings to the CSIRT Nacional as Article 8 requires.
- OIV: stand up the ISMS and plans: ISMS with an action record, continuity and cybersecurity plans certified under Article 28, and a review cycle of no more than two years.
- Prepare containment: pre-approved access restriction and credential revocation playbooks for each essential service.
- Align disclosure and notification: vulnerability disclosure policy consistent with Articles 19 and 55, and a procedure to inform affected parties, coordinated with personal data duties.
- Track ANCI instructions: assign an owner to monitor new instructions and OIV lists.
| Ley 21.663 requirement | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| ISMS and risk assessment (Article 8) | GV.OC-03, ID.RA-01 | RA-3, PM-18 |
| Incident reporting (Article 9) | RS.CO-02, RS.MA-02 | IR-6 |
| Containment and access restriction | RS.MA-01, PR.AA-05 | IR-4, AC-2 |
| Continuity plans and exercises | RC.RP-01, ID.IM-02 | CP-2, CP-4 |
| Detection to support the 3-hour alert | DE.CM-01, DE.CM-03 | AU-6 |
Common failure patterns
- Assuming only OIV must report: every essential service provider under Article 4 has the Article 9 duty.
- Clock starts late: teams start the 3-hour window at confirmation rather than awareness; define awareness in the runbook and record the timestamp.
- Single reporter, no cover: only one person can file on the ANCI platform, and the alert misses the window at night.
- Plans not certified: OIV continuity and cybersecurity plans exist but lack the Article 28 certification and two-year review.
- No machine identity map: containment stalls because nobody knows which service accounts and keys reach the affected system.
Practitioner checklist
- Confirm Article 4 scope and OIV status in writing, and identify your sector authority.
- Register named reporters on portal.anci.gob.cl with 24/7 cover.
- Keep templates for the 3-hour, 72 or 24-hour, 7-day and 15-day reports.
- Map ANCI's incident taxonomy to your internal severity levels.
- OIV: appoint and register the cybersecurity delegate.
- OIV: maintain the ISMS action record and certified continuity and cybersecurity plans.
- Inventory service accounts, API keys and AI agents that reach essential service systems, with owners.
- Exercise the reporting and containment runbook at least twice a year (our recommendation).
Standards and references
- Biblioteca del Congreso Nacional (Ley Chile): Ley 21.663, Ley Marco de Ciberseguridad
- Agencia Nacional de Ciberseguridad: Ley Marco de Ciberseguridad presentation
- Diario Oficial: ANCI Exempt Resolution No. 187 of 2026, final OIV list (second stage)
- Carey: Entry into force of key provisions of the Cybersecurity Framework Law
- Cariola: Alerta Legal, incident reporting obligation in force (4 March 2025)
- NIST: Cybersecurity Framework 2.0
This guide summarises Chile's Ley 21.663 (Ley Marco de Ciberseguridad) and is not legal advice. Related NHI Mgmt Group resources: Chile Data Protection Law Guide · Critical Infrastructure Regulation Map · Incident Response Plan Template · NHI Discovery Guide