The National Cybersecurity Agency (ANCI) has officially opened a public consultation process to define basic mandatory cybersecurity standards for organizations subject to Chile's Framework Cybersecurity Law (Law 21.663).

This initiative, approved by Exempt Resolution No. 140 and published in the Official Gazette on May 30, 2026, aims to gather input from companies, public bodies, specialists, industry groups, and citizens regarding the minimum measures institutions must adopt to strengthen their prevention, detection, response, and recovery capabilities against cybersecurity incidents.

The consultation will remain open for 30 consecutive days, during which stakeholders can review the proposed regulation and submit comments via the ANCI Portal until June 29, 2026. The Framework Cybersecurity Law mandates that ANCI define protocols and standards enabling essential service providers—both public and private—to implement protection measures aligned with their risk profiles. These provisions must be subject to public consultation before entering into force.

The new regulation seeks to establish a common baseline for cybersecurity across affected entities, promoting uniform protection practices and greater maturity in digital risk management. Clear criteria for supervision, oversight, and continuous improvement of security capabilities in strategic sectors are expected to result from this process.

Experts agree that effective implementation will be a major challenge for the ecosystem, as many organizations will need to strengthen processes, governance, and operational capabilities to comply with new regulatory demands. The public consultation is designed to incorporate technical and operational experience from diverse stakeholders, enriching the regulation prior to its final approval.

This measure is classified as Medium Impact, as it is a public consultation for a proposed regulation that is expected to introduce mandatory cybersecurity standards for a broad range of organizations but is not yet finalized.

Key reasons for medium impact:

• The regulation will affect essential service providers across multiple sectors.
• It will require organizations to adopt minimum cybersecurity measures, impacting operational processes and risk management.
• The consultation phase allows for stakeholder input, meaning requirements may change before finalization.

Who is affected?

Essential service providers, public and private organizations, IT and cybersecurity teams, and industry stakeholders.

Conclusion:

Stakeholders should closely monitor the consultation process and prepare for potential new compliance obligations once the regulation is finalized.