On March 1, 2025, the obligation to report cyber-attacks and cybersecurity incidents of significant impact came into force, in accordance with Law No. 21,663, Cybersecurity Framework.

On the same day, Decree No. 295/2024, approving the Cybersecurity Incident Reporting Regulations (hereinafter “the Reporting Regulations”) and Exempt Resolution No. 7 approving the Cybersecurity Incident Taxonomy (“Incident Taxonomy Regulations”) were published.