Skip to content
AI Policy Generator

ESWhat applies

Chile · Law

Cybersecurity Framework Law

In forceLaw 21,663 (cybersecurity)

Summary

It requires providers of essential services (energy, water, telecom, digital infrastructure and services, transport, banking, health and others) to report incidents to the National CSIRT on very short deadlines. Operators of vital importance also have security management duties. It matters for AI when an incident compromises these services' systems or data.

Who it applies to

Public and private institutions that provide essential services and those designated as operators of vital importance (OIV).

Penalties

Minor up to 5,000 UTM, serious up to 10,000 UTM and very serious up to 20,000 UTM; double for operators of vital importance (art. 40).

Official name
Ley N° 21.663, Ley Marco de Ciberseguridad
Official reference
Diario Oficial 8-abr-2024; vigencia escalonada por DFL 1-21.663 (ANCI desde 1-ene-2025; reporte de incidentes desde 1-mar-2025)
Regulator
National Cybersecurity Agency (ANCI) and National CSIRT
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Incident reporting to the National CSIRTLey 21.663, art. 9In forceMarch 1, 2025If your organization provides an essential service under art. 4 (including third-party managed digital and IT services) or is an operator of vital importance.Verified in the official source on November 2, 2026
Security management system for operators of vital importanceLey 21.663, art. 8In forceMarch 1, 2025Only if ANCI has designated your organization as an operator of vital importance (OIV).Verified in the official source on November 2, 2026

Incident reporting to the National CSIRT

Ley 21.663, art. 9In force

Applies from March 1, 2025

When it relates
If your organization provides an essential service under art. 4 (including third-party managed digital and IT services) or is an operator of vital importance.
What the rule provides
  • Send an early alert within 3 hours of learning of an incident with significant effects.
  • Update within 72 hours with an initial assessment, severity and indicators of compromise (24 hours for OIVs whose essential service is affected).
  • Submit a final report within 15 calendar days.
  • Include incidents affecting AI systems or their data in the plan.
Typical evidence
  • Procedure with 3-hour, 72-hour and 15-day deadlines.
  • Log of reports sent.
Verification
Verified in the official source on November 2, 2026Arts. 4, 8, 9 and 40 checked in BCN LeyChile (Law 21,663, Official Gazette Apr 8, 2024). Enforceability of reporting from Mar 1, 2025 (DFL 1-21.663) comes from secondary sources (Carey, Cuatrecasas).

Security management system for operators of vital importance

Ley 21.663, art. 8In force

Applies from March 1, 2025

When it relates
Only if ANCI has designated your organization as an operator of vital importance (OIV).
What the rule provides
  • Implement an ongoing information security management system and keep a record of its actions.
  • Maintain certified business continuity and cybersecurity plans reviewed at least every two years.
Typical evidence
  • Certified plans and management system records.
Verification
Verified in the official source on November 2, 2026Arts. 4, 8, 9 and 40 checked in BCN LeyChile (Law 21,663, Official Gazette Apr 8, 2024). Enforceability of reporting from Mar 1, 2025 (DFL 1-21.663) comes from secondary sources (Carey, Cuatrecasas).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)