How is an OIV designation determined?

ANCI assesses objective criteria such as dependence on third parties, mass user base, sectoral impact and availability of substitutes. The qualification proceeds by resolution and is formally notified to the entity.

What obligations apply to OIVs?

Information security management system, operational continuity plan, reporting of cyber incidents within short deadlines, periodic risk assessment and appointment of a Cybersecurity Delegate. Compliance is supervised directly by ANCI.

Which resolutions have qualified OIVs to date?

Exempt Resolution 50 of September 2025 qualified the first list (Stage 1). Exempt Resolution 85 of April 2026 expanded the list in Stage 2, incorporating new sectors such as health, transport and sanitary services.

What happens if an organization does not comply with its OIV qualification?

ANCI can apply the sanctioning regime of Law 21.663, with fines and, for repeated very serious infringements, suspension of critical operations. The Agency may also issue specific binding instructions.

Operadores de Importancia Vital | Anguita Osorio

Primer Procedimiento de Calificación según Resolución ANCI N°024. El estudio analiza los sectores estratégicos que requieren el mayor nivel de protección de ciberseguridad en Chile.

Operators of Vital Importance (OVI)

Q: What is an Operator of Vital Importance (OIV)?

It is a public or private entity qualified by the National Cybersecurity Agency (ANCI) whose operation is essential to sustain critical social and economic activities. The qualification is made through a reasoned resolution and triggers reinforced obligations under Law 21.663.

First Qualification Procedure according to ANCI Resolution No. 024 - Analysis framework for strategic sectors that require the highest level of cybersecurity protection in Chile.

Active Process — Stage 2 Public Consultation

The first OIV qualification process is advancing into its Second Stage: Exempt Resolution N°85, dated 21 April 2026 (Official Gazette 24-04-2026), approved the preliminary Stage 2 list and opened its public consultation. Stage 1 remains in force under Exempt Resolution N°50/2025 (Official Gazette 16-09-2025).

OVI Registry: Check Qualification Status

Check the official status of any OVI company in the Operators of Vital Importance qualification registry

* Database updated according to official ANCI resolutions

First Qualification Procedure for Operators of Vital Importance (OVI)

An Operator of Vital Importance (OIV) is a public or private entity qualified by the National Cybersecurity Agency (ANCI) under Law 21.663, whose operation is essential to sustain critical social and economic activities, and to which reinforced cybersecurity obligations apply. Exempt Resolution N°024 of 30 May 2025 initiated the first official qualification procedure, fulfilling the mandate of the first transitory article of the DS N°285/2024 Regulation. Exempt Res. N°076/2025 amended its schedule, and Exempt Res. N°050/2025 and N°085/2026 approved, respectively, the Stage 1 and Stage 2 preliminary lists.

Ongoing Process - Active Evaluation

Both stages of the first qualification process are under way. The Stage 2 preliminary list (Res. N°085/2026) has been in public consultation since 24 April 2026 and may be commented on by the preliminarily qualified institutions.

Fundamental Requirements for OVI Qualification

To be qualified as an Operator of Vital Importance, an entity must simultaneously meet:

Provision of services dependent on computer networks and systems
Significant impact: The affectation, interception, interruption or destruction of its services must have significant consequences for the population or the functioning of the country

Regulatory Framework for OVI Companies: Laws, Decrees and Resolutions

The OIV qualification procedure is governed by a set of coordinated norms, including the resolutions that initiate and advance the first qualification process:

Law No. 21.663: Cybersecurity Framework (articles 5° and 6°)
Supreme Decree No. 285/2024: Regulation of the OVI qualification procedure
ANCI Resolution N°024/2025: Initiates the first procedure and approves its schedule (30-05-2025)
ANCI Resolution N°050/2025: Approves the Stage 1 preliminary list (Official Gazette 16-09-2025)
ANCI Resolution N°076/2025: Amends the schedule and incorporates entities not included in the first preliminary list into Stage 2 (14-11-2025)
ANCI Resolution N°085/2026: Approves the Stage 2 preliminary list and opens public consultation (Official Gazette 24-04-2026)
Decree with Force of Law No. 1-21.663: Gradual entry into force

Mandatory Periodic Review

According to Article 6° of the law, ANCI must review and update the qualification of operators of vital importance at least every 3 years, ensuring that the classification reflects the evolution of the threat landscape and the criticality of services.

First Stage - Priority Sectors (May 30, 2025)

Stage 1 began on 30 May 2025 and its preliminary list was published via Exempt Res. N°050/2025 (Official Gazette 16-09-2025). The priority sectors are:

Electric Sector

Electricity generation, transmission or distribution, including the Independent Coordinator of the National Electric System

Telecommunications

Providers of telecommunications services critical to national connectivity

Digital Infrastructure

Digital services and information technology managed by third parties

Financial Services

Banking, financial services and payment methods

Institutional Health

Hospitals, clinics, medical offices and medical centers

Public Sector

Public companies created by law and State Administration bodies

Stage 2 — Complementary Sectors (started 30 November 2025)

Stage 2, initiated on 30 November 2025, covers the following sectors. The preliminary list was approved by Exempt Res. N°085/2026 (Official Gazette 24-04-2026) and is currently under public consultation:

Fuels

Transportation, storage or distribution of fuel

Water and Sanitation

Drinking water supply or sanitation

Transport

Land, air, rail or maritime, as well as infrastructure operation

Concessionaires

Other public service concessionaires

Social Security

Administration of social security benefits

Postal Services

Postal and courier services

Pharmaceutical

Production and/or research of pharmaceutical products

Criteria for Significant Impact Assessment

The significant impact assessment considers multiple dimensions to determine national criticality:

Number of Affected

Amount of population potentially affected by service interruption

Service Redundancy

Existence of alternative providers and their substitution capacity

Alternative Technical Capacity

Technical and operational capacity of alternative providers to cover demand

Response Time

Time required for an alternative provider to begin operating

Substitution Costs

Costs associated with switching to an alternative provider

Monopoly

Analysis of services where there is a single provider or natural monopoly

Interdependence

Dependence of services provided among themselves or with other essential services

Dynamic and Contextual Evaluation

The criteria are evaluated in an integral manner, considering the specific context of each service and its role in the national ecosystem. There is no single threshold, but a qualitative and quantitative evaluation that considers the joint impact of all factors.

Obligations of OVI Companies (Operators of Vital Importance)

OVI companies qualified as Operators of Vital Importance are subject to specific obligations under Article 8°:

Information Security Management System (ISMS)

Implementation of a formal and documented ISMS
Reference frameworks such as ISO 27001 can serve as a guide
Periodic review and updating

Certified Plans

Operational Continuity Plan: Procedures to maintain critical operations
Cybersecurity Plan: Specific protection and response strategies
Mandatory certification: Evaluation by independent third parties

Cybersecurity Delegate

Appointment of specialized technical manager
Coordination functions with ANCI
Supervision of implementation of measures

Evaluations and Simulations

Periodic cybersecurity audits
Incident response simulations
Operational continuity evaluations

Corporate Governance Implications

OVI qualification significantly elevates the responsibilities of the board and senior management in cybersecurity matters, requiring resource allocation, active supervision and regular reporting on compliance status.

Qualification Process Schedule

May 30, 2025

First Stage Start

The first OIV qualification process begins (Exempt Res. N°024). Priority sectors: Electric, Telecommunications, Digital, Financial, Health and Public Sector.

16 September 2025

Stage 1 Preliminary List

Publication in the Official Gazette of Exempt Res. N°050/2025, which approves the Stage 1 preliminary list and opens its public consultation.

14 November 2025

Exempt Res. N°076/2025

Amends the schedule and expressly incorporates into Stage 2 the entities providing essential services scheduled for Stage 1 that were not included in the first preliminary list.

November 30, 2025

Second Stage Start

Start of Stage 2 (Exempt Res. N°024 as amended by N°076). Sectors: Fuel, Water, Transport, Concessionaires, Social Security, Postal, Pharmaceutical and Stage 1 expansion.

24 April 2026

Stage 2 Preliminary List

Publication in the Official Gazette of Exempt Res. N°085/2026, which approves the Stage 2 preliminary list and opens its public consultation.

2028

First Review

Mandatory review every 3 years according to Article 6° of the law

Administrative Recourse against OVI Resolutions

Qualification resolutions as Operators of Vital Importance are administrative acts that can be challenged according to the general regulations on administrative procedure.

Available Recourses

Recourse for Reconsideration: Before ANCI itself, within 30 days from notification of the resolution
Hierarchical Recourse: Before the Ministry of Interior and Public Security, in lieu of the recourse for reconsideration
Protection Recourse: Before the respective Court of Appeals, when constitutional guarantees are violated
Illegality Claim: Before the Public Procurement Tribunal, as appropriate

Grounds for Challenge

Procedural defects: Non-compliance with the stages of the qualification procedure
Error in facts: Incorrect evaluation of significant impact criteria
Lack of foundation: Resolution lacking sufficient motivation
Disproportion: Qualification that exceeds legal or regulatory standards

Procedural Strategy

Successful challenge requires specialized technical analysis of classification criteria, evaluation of evidence presented by ANCI and construction of legal arguments that demonstrate incorrect application of regulatory standards of DS No. 285/2024.

Official sources

Transform Your Legal Challenges into Competitive Advantages

Discover how our innovative approach can drive your business

Schedule ConsultationMeet the Team→