Review by the Bundesnetzagentur: procedure, deficiencies, evidence file

This page covers the review after the concept has been submitted: what the Bundesnetzagentur may review, what is known about the procedure, what happens when deficiencies are found and how to organise your evidence. How to draw up and submit the concept itself is explained on security concept under Section 166 TKG, and the protective measures in detail on protective measures under Section 165 TKG.

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026. Catalogue of security requirements under Section 167 TKG: version 2.0 of 29 April 2020 is in force, the draft version 2025-10 has not been adopted. Checked on 6 November 2026. This page provides general information, not legal advice. How to respond legally to a letter from the Bundesnetzagentur in your case is a question for a lawyer admitted in Germany. Quotations from German statutes and from the catalogue of security requirements on this page are our own unofficial translations. Only the German text is legally binding.

What do Section 166(4) and (5) TKG provide?

Three sentences govern the review:

• Subsection 5: The Bundesnetzagentur regularly reviews the implementation of the security concept. The review is intended to take place at least every two years. This is a task of the authority. In our reading, it creates no separate audit duty for the company.
• Subsection 4 sentence 1: If the Bundesnetzagentur finds security deficiencies in the concept or in its implementation, it can demand that they be remedied without delay.
• Subsection 4 sentence 2: If the circumstances on which the concept is based change, the party obliged under subsection 2 adapts it without delay and resubmits it, pointing out the changes. These are network operators, and service providers from which the Bundesnetzagentur has required submission.

The yardstick for the review is the catalogue of security requirements. Under catalogue 2.0 the Bundesnetzagentur reviews the submission and, regularly, the implementation of the concept, as well as compliance with the requirements of the catalogue. The catalogue therefore describes itself as a basis "both for action and for review". What the catalogue requires chapter by chapter is explained on catalogue of security requirements under Section 167 TKG.

For the review the Bundesnetzagentur has the powers under Section 183 TKG: it can issue orders, request information and enter and inspect business and operating premises during normal business or operating hours. In addition, it has the general rights to information and inspection under Sections 203 and 204 TKG.

Two reviews that should not be confused

Besides the review under Section 166(5), the TKG provides for an audit by a qualified independent body or a competent national authority under Section 165(9). Catalogue 2.0 keeps the two expressly apart: the independent audit concerns compliance with the security duties themselves, and the security concept and its implementation are not its focus.

The draft TKG Amendment Act 2026 would change Section 165(9), but not Section 166. It has not been passed. Details on the mandatory audit are on protective measures under Section 165 TKG.

How does a review work?

We have not found a current description of the procedure on the Bundesnetzagentur's pages on public safety and on the catalogue (as of 6 November 2026). Only two documents from 2017 on the legal situation at the time are on record, both from the authority's Division 217:

• According to the 2017 FAQ on data retention (there on the security concept for the retention duty of the time), the review of implementation usually took place on site, with date and scope agreed with the company in advance. Deficiencies found had to be remedied without delay on request. After that, the authority could impose a fine or set a periodic penalty payment and, as a last resort, prohibit the activity.
• According to the 2017 guidance on drawing up and submitting the security concept, a third party may draw up the concept, while responsibility stays with the company. If the third party submits it, it needs a power of attorney. A model concept submitted once and referred to by many companies is not permitted.

No current source says whether the Bundesnetzagentur still proceeds this way today. We read both documents as an indication of the practice at the time. Division 217 in Saarbrücken is responsible for the catalogue and the security concept, and it accepts confidential documents by PGP-encrypted e-mail. The Bundesnetzagentur publishes the key on its page on the catalogue.

What applies when the Bundesnetzagentur finds deficiencies?

The Bundesnetzagentur can demand that they be remedied without delay (Section 166(4) sentence 1). If it issues an enforceable order to that effect and the company acts contrary to it, this is an administrative offence with a fine of up to EUR 100,000 (Section 228(2) no. 3(c) TKG). Failing to submit an adapted concept under subsection 4 sentence 2, or submitting it incorrectly, incompletely or late, is also an administrative offence, here up to EUR 300,000 (no. 38). Failing to provide information under Section 183(1) sentence 2, or providing it incorrectly, incompletely or late, is an administrative offence up to EUR 100,000 (no. 61). All offences require intent or negligence, and for negligence the maximum amount is halved in our reading (Section 17(2) of the Administrative Offences Act, OWiG). In addition, the Bundesnetzagentur can enforce orders under Section 183 with periodic penalty payments of up to EUR 1 million. The other fines are set out on fines under the TKG.

For a list of deficiencies we recommend this approach:

1. Record each deficiency separately, with its reference in the letter and in the concept.
2. For each deficiency, set a measure, a responsible person and a date, and present them to management.
3. If a measure takes longer than the deadline set by the authority, ask early and give documented reasons.
4. Adapt the concept and the evidence file. If this changes the circumstances on which the concept is based, submit the new version pointing out the changes (subsection 4 sentence 2).
5. Report the remedy in writing with evidence and file the status in the evidence file.

The evidence file: structure based on catalogue 2.0

Catalogue 2.0 requires in many places that something be documented. Sorting these places gives the structure of an evidence file with which you can prepare for a review. Tabs 1, 2 and 9 are our addition, the others follow the documentation requirements of the catalogue.

Fictitious example, not a client. The telecoms arm of a municipal utility runs an FTTH network in the town with two network nodes and offers internet access and telephony. The concept was last submitted in spring 2026. A letter from the Bundesnetzagentur announces a review of its implementation. This is what the file looks like, with all details invented:

In the example, the "Status" column shows three gaps to close before the appointment. In our assessment it pays to cross-reference the file to the chapters of your own concept, so that there is evidence for every measure in the concept. This structure is a working aid. The Bundesnetzagentur does not prescribe a form.

Three typical gaps before a review

We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. The status review (stage 1) shows where your concept and evidence stand today. Our fixed-fee revision of the concept includes one round of questions from the Bundesnetzagentur, details on security concept under Section 166 TKG.