For providers registered with the Bundesnetzagentur
German security obligations for your telecom services
Under NIS2, telecom providers fall under the jurisdiction of each Member State in which they provide services (Art. 26(1)(a) NIS2). For your German activities the Telecommunications Act (TKG) applies. Check in ten questions what is still open for you.
What applies to your German activities
The Telecommunications Act applies to everyone who operates telecommunications networks or provides telecommunications services in Germany, regardless of where the company is headquartered (Section 1(2) TKG). Three points matter most:
Significant incidents
go to the Bundesnetzagentur (Federal Network Agency) and the Federal Office for Information Security (BSI): early warning without undue delay, at the latest 24 hours after becoming aware; notification with initial assessment at the latest 72 hours after becoming aware; final report at the latest one month after the second notification (Section 168 TKG).
Security officer and security concept
You need a security officer, a contact person established in the EU and a security concept; network operators submit it to the Bundesnetzagentur (Section 166 TKG), whose official language is German.
Management duties
Management must implement and oversee the security measures and attend regular training (Section 165(2b) and (2d) TKG).
If you have an establishment in Germany, such as a branch or subsidiary, BSI registration is usually also required (Section 33 BSIG); it is possible without a German tax number. The Bundesnetzagentur is also revising its catalogue of security requirements: the published draft provides for three levels (normal, elevated and increased risk potential) and is not yet binding.
Self-check: ten questions, five minutes
Answer the questions for your company. Your answers stay in your browser and are not transmitted.
1.If you have an establishment in Germany: is your company registered with the BSI?
2.Have you appointed a security officer for your German activities?
3.Have you named a contact person established in the EU?
4.Do you have a security concept that describes your current network and services in Germany?
5.Does your security concept cover the ten minimum measures?
6.Could you report a significant incident affecting your German services to both the Bundesnetzagentur and the BSI within 24 hours?
7.Is it clear who decides on a report at night and at weekends?
8.Does management attend regular cybersecurity training?
9.Does management oversee the measures in a traceable way, for example through a regular report?
10.Do you know your likely level under the Bundesnetzagentur's draft catalogue of security requirements?
Your fixed-fee starter package, in English
NIS2 obligations status (telecom)
- classification of your company under the German rules and, where needed, support with BSI registration
- review of your security concept against the minimum measures (Section 165(2a) TKG)
- reporting template and a German cover text for the authorities
- a prioritised list of open items, delivered in English
Fixed fee per legal entity: EUR 4,900 net for up to 49 employees, EUR 5,900 net for 50 or more employees. Does not include revising the concept.
The fee depends on the headcount of the contracting legal entity on the day of the order. Per legal entity, remote, plus VAT where due; EU businesses: reverse charge as a rule. If you order a revision of your security concept within 60 days of receiving the results, we credit this fee once in full against it. Not included: multiple legal entities, on-site or technical audits, revising the security concept (fixed fees below) or drafting a new one (on request), ongoing correspondence with authorities, legal advice, certified translations.
The first 30-minute call is free of charge.
Since 2019 we have written security concepts under Sections 109 and 166 TKG for telecom providers, aligned them with the Bundesnetzagentur and acted as security officers under Section 166 TKG. We bring existing concepts up to the law in force at a fixed fee. More on the security concept itself: TKG security concept.
Your security concept at a fixed fee
Fees for work in English, per legal entity and concept, remote, net of VAT where due; EU businesses: reverse charge as a rule. New concepts, companies with 250 or more employees and 5G networks on request.
- Revision under Section 166 TKG to the law in force (including Section 165(2a), (2b) and (2d) and Section 168 TKG), with a prepared implementation declaration for your signature and one round of questions from the Bundesnetzagentur
- up to 49 employeesEUR 9,900
- 50 to 249 employeesEUR 15,900
- NIS2 implementation package, optional: incident reporting procedure, evidence and training for management, support with BSI registration; can be added to a revision
- up to 49 employees+ EUR 4,900
- 50 to 249 employees+ EUR 5,900
- NIS2 implementation package on its own for a concept that already reflects the law in force
- up to 49 employeesEUR 5,900
- 50 to 249 employeesEUR 6,900
The fee depends on the headcount of the contracting legal entity on the day of the order. Before you place an order, we check free of charge whether your existing concept can be revised.
The revision always reflects the law in force, because the concept has to describe the measures taken to meet Section 165(1) to (7) TKG (Section 166(1) no. 3 TKG). The NIS2 implementation package works out the procedures for this if you do not have them yet. The basis is the statute and the catalogue of security requirements on an agreed reference date; adapting the concept to a catalogue adopted later is a separate order. Work is done in English, with a German text for submission to the Bundesnetzagentur; support with BSI registration only where you have an establishment in Germany.
The round of questions covers our answer to one set of questions from the Bundesnetzagentur on this version, received within six months of delivery. Not included: on-site visits, technical audits, implementing the measures, further correspondence with authorities, the role of security officer, legal advice, certified translations.
Compliance card: telecom security in Germany
For providers of public telecommunications networks and publicly available services in Germany. As of October 2026. BNetzA: Bundesnetzagentur (Federal Network Agency); BSI: Federal Office for Information Security.
| Obligation | What should be in place | Deadline | Legal basis |
|---|---|---|---|
| Notification to BNetzA | Intended start, changes and end of activity; new name, legal form, address. | without delay | Section 5 TKG |
| BSI registration | Usually required with an establishment in Germany (branch or subsidiary); possible without a German tax number. | 3 months; changes without undue delay, at the latest within 2 weeks | Section 33 BSIG |
| Security officer, EU contact, security concept | Appoint a security officer, name an EU contact person, prepare the concept. Submission with implementation declaration: network operators, service providers on request. Update it when the underlying circumstances change; those obliged to submit resubmit it. | network operators: first submission without undue delay after starting operations; update and resubmission each without undue delay | Section 166 TKG |
| Minimum measures | Including risk analysis, incident handling, backup and continuity, supply chain, vulnerabilities, effectiveness, training, encryption, access control, MFA or continuous authentication. | ongoing | Section 165(2a) TKG |
| Management | Implement and oversee the measures, attend regular training; breach of the implementation or oversight duty: liability to the entity for culpably caused damage. | ongoing | Section 165(2b)-(2d) TKG |
| Incident reporting | Significant incidents, to BNetzA and BSI: early warning, notification with initial assessment, final report (progress report if still ongoing). | early warning without undue delay, at the latest 24 h after awareness; notification with initial assessment at the latest 72 h after awareness; final report at the latest 1 month after the second notification | Section 168 TKG |
| Language | German is the official language; for documents in other languages the authority is, as a rule, to request a translation without delay. | on submission | Section 23 VwVfG |
| Draft catalogue (outlook) | Three risk levels planned, not yet binding; check your likely level and what needs adapting. | as a rule at the latest 1 year after entry into force | Section 167 TKG |
Summary of German statutory obligations, not legal advice; there is no official English version of TKG or BSIG. German version: NIS2 für TK-Anbieter.