Chile - Essential Services Registration (N°1/2025)

Overview

Instrucción General N°1 (ANCI), published in the Diario Oficial on 4 June 2025 and effective from 11 June 2025, establishes mandatory registration procedures for all institutions qualified as Providers of Essential Services under Law No. 21.663 (Framework Law on Cybersecurity). The instruction operationalizes the platform-based reporting obligations already provided by the law and by the reporting regulation (Decreto Supremo N°295/2024) by specifying the identity, authentication and documentary requirements for the person or persons who will act as the institution's technical counterpart to ANCI on incident reporting via the ANCI incident-reporting portal (ANCI Incident Reporting Portal).

Definitions

For purposes of the Instruction, key defined concepts include: (a) "Prestador de Servicios Esenciales (PSE)": an institution identified under Article 4 of Law 21.663 (including specific public bodies, concessioned public services and private entities delivering electricity, water, telecommunications, banking, transport, health services, pharmaceuticals, digital infrastructure, etc.); (b) "Encargado/a de Reportar": the designated incident-reporting officer who registers in the platform and serves as the institution’s technical contact; (c) "Plataforma de Reporte de Incidentes": the 24/7 incident-reporting portal maintained by ANCI; and (d) "Documentación acreditatoria": the supporting documents (signed designation, evidence of legal representation and powers) required to validate the registration.

Governance and Institutional Framework

The Instruction is issued by the ANCI under the powers and responsibilities conferred by Law 21.663 and published by the Ministry of the Interior in the Diario Oficial. It aligns the agency's operational role as platform operator and national CSIRT coordinator with the supervisory and sanctioning framework of the law. The Instruction sets out the administrative interface between PSEs and the ANCI: the designated Encargado acts as the institution's technical liaison for incident reporting, enabling ANCI to centralize and authenticate incoming reports and to maintain a verified roster of accountable contacts. For background on the law and the ANCI's legal mandate see the official legislative history and agency references at the Biblioteca del Congreso Nacional and ANCI's public communications (see ANCI).

Key Focus Areas

The Instruction concentrates on: registration mechanics (who registers and how), identity and authentication (Clave Única and a second factor such as TOTP or passkeys), mandatory documentation (advanced electronic signature by the legal representative and proof of representation), data fields to be provided (institutional contact email and institutional identifiers), operational reliability (platform availability 24/7 as required by DS N°295/2024), role continuity (designation of titular and subrogantes or deputies), change management (notice obligations upon resignation or replacement), and auditability (ANCI access to registration records and history of submitted reports). Its purpose is to ensure that incident reports are attributable, timely and sent through an authenticated, auditable national channel, improving response coordination across sectors critical to national security and public welfare.

Implementation Framework

The Instruction directs PSEs to register via the ANCI portal (portal.anci.gob.cl) through a two-step process: identity authentication using Chile’s Clave Única for the Encargado, and activation of a second authentication factor (TOTP or passkeys). The registration packet must include (i) an instrument evidencing the designation of the Encargado signed by the legal representative with an advanced electronic signature, and (ii) supporting documentation proving the legal representative’s status and signing authority. Where submitted documents are incomplete or insufficient to identify the parties, ANCI will notify the institution and give a cure period (five business days) to remedy deficiencies; failing which, registration will be considered not completed. ANCI may permit multiple registered Encargados per institution and the same person may register for multiple institutions provided a distinct registration is made for each institution.

Monitoring and Evaluation

ANCI will maintain the registry of registered Encargados and the platform will log and retain the history of incident reports submitted by each registered account. The Instruction requires institutions to update their registration promptly upon personnel changes; ANCI will use the registry to verify the origin and authenticity of incident notifications and to coordinate with the CSIRT Nacional. The agency will also use registration data for outreach, guidance, and compliance monitoring. These mechanisms enable both operational incident response and policy-level evaluation of sectoral reporting compliance rates.

Penalties, Liability, and Appeals

Non-compliance with the Instruction's registration duties is treated under Law 21.663 as an administrative infraction. The Instruction clarifies that omission to register is a minor infraction (infracción leve) under Article 38 No. 2 of the law; administrative sanctions may include monetary fines following the statutory UTM-based scale (the Instruction and commentary commonly reference penalties up to 5,000 UTM for the specified category of infraction). Affected institutions retain procedural rights under Chilean administrative law, including notification, cure periods and administrative remedies; specific appeal routes for contested sanctions are governed by general administrative procedure and the enforcement provisions of Law 21.663.

Relationship to Other Instruments

The Instruction implements and operates in close relation to: (1) Law No. 21.663 (the Framework Law on Cybersecurity) which establishes who is covered and the obligation to report significant incidents; (2) Decreto Supremo N°295 (2024) which sets the reporting regulation and requires use of an ANCI platform; and (3) ANCI technical resolutions (e.g., taxonomy and operational guidance) that determine incident classification and reporting thresholds. The Instruction does not alter substantive obligations in the law but provides the procedural, identity and authentication rules necessary to exercise the statutory reporting duty effectively.

International Alignment

The registration and authenticated-reporting approach follows international best practices by ensuring identified points of contact, secure authentication, and centralized CSIRT coordination—elements consistent with OECD and CERT community recommendations and comparable to EU NIS2/CSIRT arrangements. The Instruction supports interoperability and information exchange by producing a verified national roster that can feed bilateral or multilateral incident coordination channels when appropriate.

Implementation Timeline

Sources and References

Primary official sources include the full text published by Biblioteca del Congreso Nacional (Ley Chile) and official communications from Agencia Nacional de Ciberseguridad (ANCI).