--- title: "Chile ISP - Cybersecurity Submission Playbook" description: "How to submit a medical device to ISP / ANID in Chile: step-by-step route, evidence checklist, common rejections, and typical review timeline. Compared with F" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "Article", "headline": "Chile - Decreto 825 framework + new Medical Device Law (Ley 21.541)", "description": "How to submit a medical device to ISP / ANID in Chile: step-by-step route, evidence checklist, common rejections, and typical review timeline. Compared with F", "author": { "@type": "Organization", "name": "MDC Crosswalk" }, "publisher": { "@type": "Organization", "name": "MDC Crosswalk" }, "image": "https://mdccrosswalk.lovable.app/favicon.png", "datePublished": "Mar 2026 (MINSAL Exempt Decree No. 25 published Mar 19 2026; expands medical device & IVD oversight under the Public Health Code)", "about": "Instituto de Salud Pública de Chile", "dateModified": "2026-07-16", "mainEntityOfPage": "https://mdccrosswalk.lovable.app/standards/cl" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is SBOM required for medical devices in Chile?", "acceptedAnswer": { "@type": "Answer", "text": "Recommended. Encouraged via FDA / EU alignment." } }, { "@type": "Question", "name": "What does ISP / ANID require for pre-market cybersecurity?", "acceptedAnswer": { "@type": "Answer", "text": "Reference-jurisdiction route during transition; risk-based dossier expected once implementing decrees publish." } }, { "@type": "Question", "name": "What are the post-market cybersecurity obligations under ISP / ANID?", "acceptedAnswer": { "@type": "Answer", "text": "Tecnovigilancia reporting via ISP; CSIRT.gob.cl coordination for incidents." } }, { "@type": "Question", "name": "What is the penalty for non-compliance with ISP / ANID cybersecurity rules?", "acceptedAnswer": { "@type": "Answer", "text": "Registration suspension, sanitary fines under Health Code." } }, { "@type": "Question", "name": "How much of my FDA cybersecurity package is reusable in Chile?", "acceptedAnswer": { "@type": "Answer", "text": "Roughly 80% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report)." } }, { "@type": "Question", "name": "Why do ISP submissions get rejected for \"reference approval documentation missing\"?", "acceptedAnswer": { "@type": "Answer", "text": "Attach FDA/CE evidence to shortcut the review." } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "How to submit a medical device to ISP / ANID", "description": "Chile operates a light-touch notification regime for most devices, with registration required for higher-risk categories.", "totalTime": "2-6 months", "step": [ { "@type": "HowToStep", "position": 1, "name": "Appoint local representation", "text": "Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission." }, { "@type": "HowToStep", "position": 2, "name": "Reuse FDA or CE package as baseline", "text": "Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions." }, { "@type": "HowToStep", "position": 3, "name": "Translate and localise", "text": "Local-language technical summary and labeling are usually mandatory; certified translation is safest." }, { "@type": "HowToStep", "position": 4, "name": "Submit + track queries", "text": "Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock." } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Standards" }, { "@type": "ListItem", "position": 3, "name": "Chile" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. Standards 3. Chile ISP / ANID # ![Flag of Chile](/flags/cl.svg)Chile - ISP / ANID Emerging Last updated · Mar 2026 (MINSAL Exempt Decree No. 25 published Mar 19 2026; expands medical device & IVD oversight under the Public Health Code) Verified · 2026-07-16 Decreto 825 framework + new Medical Device Law (Ley 21.541) Share Copy link X LinkedIn Email Sources verified · 2026-07-16 Ley 21.541 (2023) is the new device law; MINSAL Exempt Decree No. 25 (Mar 19 2026) begins implementing device & IVD oversight. Cybersecurity-specific rules still emerging. Authority Instituto de Salud Pública de Chile Enforced 2024 (Ley 21.541 in implementation); Exempt Decree No. 25/2026 published Mar 19 2026 Legal framework Ley 21.541 (2023) + ISP regulations + Ley 19.628 data protection FDA package reuse ~80% [Editorial estimate · how →](/methodology#fda-reuse) ## Scope Medical devices marketed in Chile; risk-class based registration phasing in under Ley 21.541. Pre-market Reference-jurisdiction route during transition; risk-based dossier expected once implementing decrees publish. Post-market Tecnovigilancia reporting via ISP; CSIRT.gob.cl coordination for incidents. SBOM Recommended Encouraged via FDA / EU alignment. Vulnerability disclosure CSIRT.gob.cl coordinated disclosure recommended. Penalty Registration suspension, sanitary fines under Health Code. ## Unique requirements - 01 Chilean Registration Holder - 02 Spanish-language IFU and labelling - 03 ISP authorisation for importers ## Highlights - New MD Law transitioning into force - Reference jurisdiction route during transition - Modernised data-protection law incoming ## Aligns with IMDRF N60 ISO 13485 FDA 2023 Guidance ## Timeline 1. Mar 2023 Ley 21.541 enacted 2. 2024 Implementing regulations under consultation 3. Mar 19 2026 MINSAL publishes Exempt Decree No. 25 incorporating medical devices & IVDs into the Public Health Code ## Key documents [ Ley 21.541 (Medical Devices) https://www.bcn.cl/leychile/ ](https://www.bcn.cl/leychile/)[ ISP https://www.ispch.cl/ ](https://www.ispch.cl/) ## How to submit in Chile Playbook reviewed · 2026-07-16 Submission route ISP notification / registration Chile operates a light-touch notification regime for most devices, with registration required for higher-risk categories. [Authority portal](https://www.ispch.cl/) ### Step-by-step 1. Step 01 Appoint local representation Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission. 2. Step 02 Reuse FDA or CE package as baseline Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions. 3. Step 03 Translate and localise Local-language technical summary and labeling are usually mandatory; certified translation is safest. 4. Step 04 Submit + track queries Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock. ### Evidence checklist Item Level FDA equivalent Notes Cybersecurity documentation (baseline FDA or CE) Required SPDF Local authorised representative agreement Required — Local-language labeling and IFU Required — SBOM Recommended — Not mandatory but reduces clarification rounds. ### Common ISP rejections Reference approval documentation missing Occasional Fix · Attach FDA/CE evidence to shortcut the review. ### Typical timeline End-to-end window: 2-6 months Phase 01 Local rep + dossier prep 2-4 months Phase 02 Regulatory review 2-6 months Phase 03 Approval + market entry 1-3 months [Previous ![Flag of Colombia](/flags/co.svg)Colombia ](/standards/co)[Next ![Flag of Vietnam](/flags/vn.svg)Vietnam ](/standards/vn) ## Frequently asked about Chile ### Is SBOM required for medical devices in Chile? Recommended. Encouraged via FDA / EU alignment. ### What does ISP / ANID require for pre-market cybersecurity? Reference-jurisdiction route during transition; risk-based dossier expected once implementing decrees publish. ### What are the post-market cybersecurity obligations under ISP / ANID? Tecnovigilancia reporting via ISP; CSIRT.gob.cl coordination for incidents. ### What is the penalty for non-compliance with ISP / ANID cybersecurity rules? Registration suspension, sanitary fines under Health Code. ### How much of my FDA cybersecurity package is reusable in Chile? Roughly 80% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report). Sponsored note · Blue Goat Cyber Submitting to ISP / ANID? Get a second pair of eyes before you file. Blue Goat Cyber has packaged cybersecurity evidence for Chile alongside 37 other markets. We'll tell you what to keep, what to rework, and what's missing, in 30 minutes. [Talk through your ISP submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.