Chile - Cybersecurity Framework Law (21.663)

Overview

Ley N° 21.663 (the "Framework Law on Cybersecurity and Critical Information Infrastructure") sets out Chile's basic legal architecture for national cybersecurity. Promulgated and published in the Diario Oficial (8 April 2024), the law establishes the Agencia Nacional de Ciberseguridad (ANCI) as the coordinating authority, creates a multisectoral council and an interministerial committee, and mandates the operation of national and sectoral CSIRTs. The legislation identifies "essential services" and empowers ANCI to designate Operators of Vital Importance (OIV). It sets minimum prevention, detection and response requirements, incident‑reporting obligations, and an administrative sanctions framework for noncompliance. Implementation was staged by subsequent regulatory acts and a DFL that fixed ANCI's organizational start-up; most provisions took effect on 1 January 2025, with specific OIV duties, mandatory reporting and the sanctioning title entering later on 1 March 2025. Key official references and implementing instruments are available from the national legislative archive and from ANCI's official site.

Definitions

The law supplies core definitions used throughout the framework: "cybersecurity" (measures and practices to protect networks, systems and information), "incident of cybersecurity" (any event that compromises confidentiality, integrity or availability), "activo informático" (IT asset), "red or system" (networks, hardware and software), "CSIRT" (computer security incident response team), "risk" and "vulnerability", "operator of vital importance" (OIV), and "essential service". These definitions anchor obligations, reporting triggers and classification procedures and are designed to be technology‑neutral while enabling sectoral specificity by regulation.

Governance and Institutional Framework

The law creates a multi‑layer governance architecture. The core institution is the Agencia Nacional de Ciberseguridad (ANCI), which has policy, coordination, supervisory and sanctioning powers over the national cybersecurity system. Complementing the agency, the law establishes a Council of Multisectoral Stakeholders (a consultative council bringing government, industry and civil society actors together) and a Committee of Interministerial Coordination to align public administration actions. ANCI is empowered to: (i) issue binding norm‑setting instruments and instructions to entities that provide essential services, (ii) operate or accredit a national CSIRT and sectoral CSIRTs, (iii) determine criteria for classifying OIVs, (iv) maintain a national incident reporting platform and registry, and (v) supervise compliance and impose administrative sanctions. The DFL and subsequent regulations set the agency's start of operations (1 January 2025) and detail temporary organizational measures for initial appointments and staffing.

Key Focus Areas

The law concentrates on several interlinked domains: governance and oversight (centralization of coordination in ANCI, council and committee mechanisms), risk management (minimum security requirements and the promotion of risk‑based security practices), incident detection and reporting (mandatory timelines and reporting channels to the CSIRT Nacional), resilience and continuity of essential services (preparation, business continuity planning and contractual obligations), and accountability (documentation, audits and compliance programs). The statute distinguishes baseline duties for all state bodies and private providers of essential services and enhanced duties for OIVs — including more rigorous controls, mandatory audits and reporting to the national CSIRT for incidents that have significant effects. It also includes provisions to protect sensitive information and fundamental rights when the ANCI or CSIRTs process incident data, balancing transparency and confidentiality.

Implementation Framework

Implementation relies on ANCI's regulatory instruments (regulations, general instructions and technical standards) and interagency collaboration. A Decreto con Fuerza de Ley (DFL) and subsequent regulatory acts published in late 2024/early 2025 fixed the agency's plant and start date and staged the law's entry into force: the agency began activities on 1 January 2025, with most general obligations effective then; articles concerning OIV classification, OIV‑specific duties and mandatory incident reporting (Articles 5, 8, 9 and Title VII) became effective on 1 March 2025. ANCI has been granted authority to require registration of essential service providers in a national portal and to publish technical guidance and minimum cybersecurity measures. Implementing rules also define reporting thresholds, timelines, authentication requirements for registry access and the administrative procedure for classification and sanctions.

Monitoring and Evaluation

The law requires ANCI to monitor compliance and to publish guidance on performance metrics, incident trends, and national risk assessments. Monitoring tools include mandatory reporting, sectoral CSIRTs' situation reports, periodic audits, and a centralized incident registry. The law anticipates an evidence‑based evaluation cycle: ANCI will analyze incidents and sectoral vulnerabilities, prepare national risk assessments, recommend updates to minimum measures, and report to the executive and legislative branches. The multisectoral council provides a forum to review outcomes and adjust policy priorities. Monitoring is designed to inform continuous improvement while protecting reserved or sensitive information.

Penalties, Liability, and Appeals

Title VII establishes an administrative regime of infringements and sanctions that can apply to public entities and private providers subject to the law. Sanctions are graduated according to the gravity of the breach and may include fines (ranges differ by size and category of entity, with notably higher maximum fines for Operators of Vital Importance), corrective orders, operational restrictions, and temporary measures to protect continuity of services. The law preserves procedural safeguards: administrative decisions are subject to due process, motivated resolutions, remedies and appeals under the administrative procedure rules; criminal liability for computer crimes remains governed by the penal code and related statutes where conduct constitutes an offence.

Relationship to Other Instruments

The law is intended to integrate with Chile's existing legal framework: it operates alongside sectoral regulatory regimes (energy, telecoms, finance, health), data protection rules, and criminal provisions for computer crimes. Implementing regulations and interagency agreements clarify overlaps and coordination mechanisms. Where sectoral regulators already have cybersecurity rules, ANCI's role is coordination and supervision of cross‑cutting obligations, with ANCI empowered to issue binding instructions when national cybersecurity interests require harmonization. The law also foresees cooperation with law enforcement and national intelligence under prescribed safeguards.

International Alignment

Although domestically focused, the law aligns Chile with international cyber resilience best practices by centralizing national coordination, adopting risk‑based obligations, and mandating incident reporting and CSIRT operation — measures consistent with widely recognized standards and frameworks (e.g., NIS‑style national coordination and CSIRT arrangements). The ANCI is empowered to enter into cooperation agreements with foreign counterparts, to participate in international incident exchange and capacity‑building efforts, and to incorporate international technical standards into its guidance and instructions.

Implementation Timeline

Sources and References