The National Cybersecurity Agency (ANCI) has published the results of the public consultation corresponding to the second stage of the first qualification procedure for Operators of Vital Importance (OIV), in accordance with Law No. 21,663, Cybersecurity Framework, and its Qualification Procedure Regulation (Supreme Decree No. 285, 2024). The next milestone is the publication of the final OIV list, which is expected in approximately 30 days.

Background

On April 24, 2026, through Exempt Resolution No. 85 published in the Official Gazette, ANCI approved the preliminary list of 372 institutions qualified as OIV in this second stage. The sectors covered in this phase include:

• Transportation, storage, or distribution of fuels.
• Drinking water supply or sanitation.
• Land, air, rail, or maritime transport, as well as the operation of related infrastructure.
• Social security benefits administration.
• Postal and courier services.
• Production and/or research of pharmaceutical products.
• Services provided under public service concessions.

Public Consultation

The public consultation was open for 30 calendar days, from April 24 to May 25, 2026, during which individuals and legal entities were able to submit observations regarding the preliminarily qualified institutions, as well as recommend the inclusion of entities not listed. Preliminarily qualified institutions were also entitled to submit observations and responses.

In accordance with Article 15 of the Regulation, ANCI has made available to the public an executive summary addressing the observations received that are directly related to the qualification process.

Key Findings of the Report

The public consultation received a total of 439 comments, reflecting broad interest from the sectors involved.

The comments received through this instrument can be grouped into 3 categories:

(i) Observations from entities preliminarily qualified as OIV (Resolution No. 85)

• Non-inclusion of other entities and recommendations: proposals were made to incorporate institutions not included in the preliminary list, such as companies managing vehicle inspection plants, telecommunications entities linked to emergency and public safety services. However, some of these entities were already included in the first OIV list (Exempt Resolution No. 24, 2025). Periodic reviews of the OIV classification were also recommended.
• Opposition or challenges to the qualification: certain sectors —transportation, fuel distribution, water supply, pharmaceutical production, and social security providers— challenged their inclusion, mainly arguing that they do not depend exclusively on computer networks and systems for service delivery, or that their activity does not qualify as an essential service under Article 5 of the Framework Law.
• Observations on criteria and scope: requests were made to clarify the timelines expected by ANCI for compliance with OIV obligations, and the need to consider pre-existing sectoral regulatory frameworks (such as the health sector under the Ministry of Health and ISP) was raised.

(ii) Observations from institutions not pre-qualified as OIV

Comments in this category proposed the incorporation of entities from various sectors, notably:

• Electronic certification and advanced electronic signature providers, whose disruption could impact electronic invoicing and tax collection processes.
• RIS/PACS platforms (Radiology Information System and Picture Archiving and Communication System), given their relevance in medical imaging processes.
• Digital services companies with no alternative providers for key services.
• Banking sector entities, considering the increase in fraud and scams and the vulnerability of their clients.

(iii) Conclusions

The highest concentration of observations related to the digital infrastructure, digital services, and third-party managed IT services sector, highlighting the systemic effects that an interruption of these services could have on administrative, tax, and operational processes.

While there is broad recognition of the importance of the OIV qualification, doubts remain regarding the practical implementation of the associated obligations. ANCI indicated that it will consider those observations falling within the legal framework of Law No. 21,663, to ensure that the final list adequately reflects the criteria of dependency, impact, and scope that define OIVs.

Next Steps

The next step is the publication of the final OIV list for the second stage, through a resolution issued by the National Director, to be published in the Official Gazette. Entities included in the final list will be subject to reinforced cybersecurity obligations, including the appointment of a cybersecurity delegate, the implementation of an information security management system, operational continuity plans, and ongoing training programs, under a sanctions regime that may reach up to 40,000 UTM (approx. USD 3,000,000).

Qualified institutions may challenge their inclusion through administrative appeals under Law No. 19,880, or through the judicial claim provided for in Article 46 of the Cybersecurity Framework Law.

ANCI 2026 Public Accounts Report 2