ANCI publishes final list of Operators of Vital Importance under the Cybersecurity Act

On Wednesday, 17 December, the National Cybersecurity Agency (ANCI) published the final list of Operators of Vital Importance (OIV) corresponding to the first qualification process established by Cybersecurity Framework Law No. 21,663.

After technical and legal analysis of the background information and comments received during the process, the initially reported universe of 1,712 entities was reduced to a total of 915 entities qualified as OIVs. The final list was as follows:

• 147 companies in the electricity sector.
• 29 telecommunications companies, mainly large mobile and internet operators.
• 413 digital services, digital infrastructure and IT services companies.
• 34 institutions in the banking, financial and payment methods sector.
• 114 public and private healthcare providers, including hospitals and clinics.
• 20 public companies.
• 158 central and national government agencies.

Following the publication of this final list, entities classified as OIVs may challenge ANCI's decision through the administrative or judicial channels provided for in current regulations.

At the same time, the second qualification process, which began on 30 November, is already underway. It will expand the scope to new essential services, such as transport, water and sanitation, and fuel, and the preliminary list is expected to be published in January 2026.

Read the official document published in the Official Gazette here.