CMF: information security, cybersecurity and outsourcing
For banks, card issuers and other supervised entities, chapter 20-10 of the CMF’s Updated Compilation of Rules requires managing information security and cybersecurity with a board-approved strategy, risk and incident management, and security testing. Chapter 20-7 governs outsourcing, including cloud, and requires managing each vendor’s risk.
| What the CMF requires | How Harkaq responds |
|---|---|
| Manage information security risk | One policy for every agent, with per-operation control |
| Manage incidents | Every blocked attempt is logged and Security is alerted |
| Manage vendor and cloud risk | The AI model is contracted in the company’s own account and chosen region |
| Evidence for supervision | Hash-chained log and a verifiable evidence report |
Law 21.663, the Cybersecurity Framework Law
The Cybersecurity Framework Law created the National Cybersecurity Agency (ANCI) and requires operators of vital importance, including banks already designated by the agency, to maintain an information security management system with a record of its actions and to report incidents to the national CSIRT within short deadlines. With Harkaq, every AI agent action is logged and traceable to a person, ready to feed that record.
Law 21.719: personal data protection
Law 21.719 creates the Personal Data Protection Agency and takes effect on December 1, 2026. Its article 14 quinquies requires security measures proportional to risk and, above all, that the controller be able to prove they existed and worked. It also requires reporting breaches and keeping a record of them.
For a company that lets AI agents work on systems with personal data, proving it means having evidence: what the agent touched, what it tried to send, what was blocked and who approved each exception. That is what Harkaq’s evidence report delivers.
Artificial intelligence
Chile doesn’t have an AI law yet: the bill is in its second reading in the Senate. Companies that adopt agents now, with control and evidence, will be better prepared when it passes.
What an auditor will ask to see
- The agent and the model registered as vendors, including where data is processed.
- That the agent holds no standing credentials and that new access is approved by someone else.
- Complete logs of every agent action, traceable to a person.
- That the agent’s code is identified and reviewed before production.
- Evidence that the controls worked, not just written policies.