Operadores de Importancia Vital | Anguita Osorio
Primer Procedimiento de Calificación según Resolución ANCI N°024. El estudio analiza los sectores estratégicos que requieren el mayor nivel de protección de ciberseguridad en Chile.
Operators of Vital Importance (OVI)
First qualification process closed: 915 institutions in Stage 1 and 155 in Stage 2 (Exempt Resolution No. 187, Official Gazette of July 24, 2026) - Analysis framework for strategic sectors that require the highest level of cybersecurity protection in Chile.
Last updated:
This page brings together the essentials of the Operators of Vital Importance (OIV) under Law 21.663. It points you to the official ANCI roster, and then covers the qualification process and its legal framework, the first and second stage sectors, the impact criteria ANCI applies, the obligations the qualification triggers, the timeline and the administrative remedies available. At the close are the frequently asked questions and the official sources.
Is your entity on the OIV roster?
The official roster is published and kept up to date by ANCI. Consult the current list and the qualifying resolutions here:
Consult the OIV roster and official sources →
OIV qualification follows a regulated procedure. The sections below set out how it works and the obligations it triggers.
First Qualification Procedure for Operators of Vital Importance (OVI)
A Vital Importance Operator (OIV) is a public or private entity qualified by the National Cybersecurity Agency (ANCI) under Law 21.663, whose operation is indispensable for critical social and economic activities and which bears reinforced cybersecurity obligations. Exempt Resolution No. 024 of May 30, 2025 opened the first official qualification procedure under the transitory mandate of Regulation DS No. 285/2024. Resolution No. 076/2025 adjusted its schedule; Resolutions No. 050/2025 and No. 085/2026 approved the preliminary rosters of Stage 1 and Stage 2, and Resolutions No. 087/2025 and No. 187/2026 approved their definitive rosters.
First qualification process: both stages closed
Stage 1 closed with Exempt Resolution No. 087/2025 (Official Gazette of December 17, 2025), qualifying 915 institutions. Stage 2 closed with Exempt Resolution No. 187/2026 (Official Gazette of July 24, 2026), qualifying 155 institutions across six new sectors and adding first-stage operators missing from the preliminary roster. The next milestone is the three-year review expected in 2028.
Fundamental Requirements for OVI Qualification
To be qualified as an Operator of Vital Importance, an entity must simultaneously meet:
- Provision of services dependent on computer networks and systems
- Significant impact: The affectation, interception, interruption or destruction of its services must have significant consequences for the population or the functioning of the country
That procedure rests on a stack of laws, regulations and resolutions.
Regulatory Framework for OVI Companies: Laws, Decrees and Resolutions
The OIV qualification procedure is governed by a set of coordinated norms, including the resolutions that initiate and advance the first qualification process:
- Law No. 21.663: Cybersecurity Framework (articles 5° and 6°)
- Supreme Decree No. 285/2024: Regulation of the OVI qualification procedure
- ANCI Resolution N°024/2025: Initiates the first procedure and approves its schedule (30-05-2025)
- ANCI Resolution N°050/2025: Approves the Stage 1 preliminary list (Official Gazette 16-09-2025)
- ANCI Resolution N°076/2025: Amends the schedule and incorporates entities not included in the first preliminary list into Stage 2 (14-11-2025)
- ANCI Resolution N°085/2026: Approves the Stage 2 preliminary list and opens public consultation (Official Gazette 24-04-2026)
- ANCI Resolution No. 087/2025: Approves the definitive Stage 1 roster, 915 institutions (Gazette 12-17-2025)
- ANCI Resolution No. 187/2026: Approves the definitive Stage 2 roster, 155 institutions (Gazette 07-24-2026)
- Decree with Force of Law No. 1-21.663: Gradual entry into force
Mandatory Periodic Review
According to Article 6° of the law, ANCI must review and update the qualification of operators of vital importance at least every 3 years, ensuring that the classification reflects the evolution of the threat landscape and the criticality of services.
The first qualification stage covered the following sectors.
First Stage - Priority Sectors (May 30, 2025)
Stage 1 opened on May 30, 2025; its preliminary roster was published by Resolution No. 050/2025 (Gazette 09-16-2025) and its definitive roster by Resolution No. 087/2025 (Gazette 12-17-2025), with 915 qualified institutions. The priority sectors are:
Electric Sector
Electricity generation, transmission or distribution, including the Independent Coordinator of the National Electric System
Telecommunications
Providers of telecommunications services critical to national connectivity
Digital Infrastructure
Digital services and information technology managed by third parties
Financial Services
Banking, financial services and payment methods
Institutional Health
Hospitals, clinics, medical offices and medical centers
Public Sector
Public companies created by law and State Administration bodies
The second stage expanded the list with new sectors.
Second Stage - Complementary Sectors (definitive roster: July 2026)
The Second Stage, opened on November 30, 2025, covered the following sectors. The preliminary roster was approved by Resolution No. 085/2026 (Gazette 04-24-2026) and, after public consultation, Resolution No. 187/2026 (Gazette 07-24-2026) approved the definitive roster with 155 institutions:
Fuels
Fuel transport, storage or distribution: 25 qualified institutions
Water and Sanitation
Drinking water supply or sanitation: 18 qualified institutions
Transport
Land, air, rail or maritime transport and the operation of its infrastructure: 40 qualified institutions
Concessionaires
Other public-service concessionaires: 32 qualified institutions
Social Security
Social-security benefit administration: 25 qualified institutions
Postal Services
Postal and courier services: the sector ended with no qualified entities in the definitive roster; the recitals invoke the Supreme Court's free-competition doctrine (case 47.555-2016)
Pharmaceutical
Pharmaceutical production and/or research: 15 qualified institutions
Behind those sector lists are the impact criteria ANCI weighs to qualify an entity.
Criteria for Significant Impact Assessment
The significant impact assessment considers multiple dimensions to determine national criticality:
Number of Affected
Amount of population potentially affected by service interruption
Service Redundancy
Existence of alternative providers and their substitution capacity
Alternative Technical Capacity
Technical and operational capacity of alternative providers to cover demand
Response Time
Time required for an alternative provider to begin operating
Substitution Costs
Costs associated with switching to an alternative provider
Monopoly
Analysis of services where there is a single provider or natural monopoly
Interdependence
Dependence of services provided among themselves or with other essential services
Dynamic and Contextual Evaluation
The criteria are evaluated in an integral manner, considering the specific context of each service and its role in the national ecosystem. There is no single threshold, but a qualitative and quantitative evaluation that considers the joint impact of all factors.
Once qualified, an entity takes on a defined set of obligations.
Obligations of OVI Companies (Operators of Vital Importance)
OVI companies qualified as Operators of Vital Importance are subject to specific obligations under Article 8°:
Information Security Management System (ISMS)
- Implementation of a formal and documented ISMS
- Reference frameworks such as ISO 27001 can serve as a guide
- Periodic review and updating
Certified Plans
- Operational Continuity Plan: Procedures to maintain critical operations
- Cybersecurity Plan: Specific protection and response strategies
- Mandatory certification: Evaluation by independent third parties
Cybersecurity Delegate
- Appointment of specialized technical manager
- Coordination functions with ANCI
- Supervision of implementation of measures
Evaluations and Simulations
- Periodic cybersecurity audits
- Incident response simulations
- Operational continuity evaluations
Corporate Governance Implications
OVI qualification significantly elevates the responsibilities of the board and senior management in cybersecurity matters, requiring resource allocation, active supervision and regular reporting on compliance status.
These obligations are phased in along a published timeline.
Qualification Process Schedule
- May 30, 2025First Stage Start
The first OIV qualification process begins (Exempt Res. N°024). Priority sectors: Electric, Telecommunications, Digital, Financial, Health and Public Sector.
- 16 September 2025Stage 1 Preliminary List
Publication in the Official Gazette of Exempt Res. N°050/2025, which approves the Stage 1 preliminary list and opens its public consultation.
- 14 November 2025Exempt Res. N°076/2025
Amends the schedule and expressly incorporates into Stage 2 the entities providing essential services scheduled for Stage 1 that were not included in the first preliminary list.
- November 30, 2025Second Stage Start
Start of Stage 2 (Exempt Res. N°024 as amended by N°076). Sectors: Fuel, Water, Transport, Concessionaires, Social Security, Postal, Pharmaceutical and Stage 1 expansion.
- December 17, 2025Definitive Stage 1 Roster
Publication of Exempt Resolution No. 087/2025 approving the definitive Stage 1 roster with 915 qualified institutions.
- 24 April 2026Stage 2 Preliminary List
Publication in the Official Gazette of Exempt Res. N°085/2026, which approves the Stage 2 preliminary list and opens its public consultation.
- July 24, 2026Definitive Stage 2 Roster
Official Gazette publication of Exempt Resolution No. 187/2026 approving the definitive Stage 2 roster: 155 institutions across six sectors, plus first-stage operators missing from the preliminary roster.
- 2028First Review
Mandatory review every 3 years according to Article 6° of the law
An entity that disputes its qualification has administrative remedies available.
Administrative Recourse against OVI Resolutions
Qualification resolutions as Operators of Vital Importance are administrative acts that can be challenged according to the general regulations on administrative procedure.
Available Recourses
- Reconsideration: Before ANCI itself, within 5 business days of notification (Article 59, Law 19.880)
- Hierarchical Recourse: Before the Ministry of Interior and Public Security, in lieu of the recourse for reconsideration
- Protection Recourse: Before the respective Court of Appeals, when constitutional guarantees are violated
- Illegality claim: Before the Santiago Court of Appeals or that of the claimant's domicile, within 15 business days of notification (Article 46, Law 21.663)
Grounds for Challenge
- Procedural defects: Non-compliance with the stages of the qualification procedure
- Error in facts: Incorrect evaluation of significant impact criteria
- Lack of foundation: Resolution lacking sufficient motivation
- Disproportion: Qualification that exceeds legal or regulatory standards
Procedural Strategy
Successful challenge requires specialized technical analysis of classification criteria, evaluation of evidence presented by ANCI and construction of legal arguments that demonstrate incorrect application of regulatory standards of DS No. 285/2024.
Frequently asked questions
The most common questions about OIV qualification and its obligations.
What is an Operator of Vital Importance (OIV)?
It is a public or private entity qualified by the National Cybersecurity Agency (ANCI) whose operation is essential to sustain critical social and economic activities. The qualification is made through a reasoned resolution and triggers reinforced obligations under Law 21.663.
How is an OIV designation determined?
ANCI assesses objective criteria such as dependence on third parties, mass user base, sectoral impact and availability of substitutes. The qualification proceeds by resolution and is formally notified to the entity.
What obligations apply to OIVs?
Information security management system, operational continuity plan, reporting of cyber incidents within short deadlines, periodic risk assessment and appointment of a Cybersecurity Delegate. Compliance is supervised directly by ANCI.
Which resolutions have qualified OIVs to date?
Exempt Resolution 50 (September 2025) approved the Stage 1 preliminary roster and Exempt Resolution 87 (December 2025) its definitive roster, with 915 institutions. Exempt Resolution 85 (April 2026) approved the Stage 2 preliminary roster and Exempt Resolution 187 (July 2026) the definitive one, with 155 institutions across six new sectors plus first-stage operators missing from the preliminary roster.
What happens if an organization does not comply with its OIV qualification?
ANCI can apply the sanctioning regime of Law 21.663, with fines and, for repeated very serious infringements, suspension of critical operations. The Agency may also issue specific binding instructions.
Official sources
- Law 21.663: full text on BCN/LeyChile
- National Cybersecurity Agency (ANCI)
- ANCI Exempt Resolution N° 50/2025 (Stage 1 preliminary list)
- ANCI Exempt Resolution N° 85/2026 (Stage 2 preliminary list)
- ANCI Exempt Resolution N° 187/2026 (definitive Stage 2 roster, PDF)
- Diario Oficial: Resolution N° 50/2025 (PDF)
Transform Your Legal Challenges into Competitive Advantages
Discover how our innovative approach can drive your business
