Critical components in telecom networks under Section 165(4) TKG and Section 41 BSIG

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG) as amended on 22 October 2026, catalogue of security requirements version 2.0 of 29 April 2020 with the list of critical functions of 18 August 2021 (in force), draft catalogue version 2025-10 (not adopted), draft TKG Amendment Act 2026 (not passed), checked on 6 November 2026. This is general information, not legal advice. Whether a duty applies to your company is a question for a lawyer admitted in Germany.

Who is subject to the certification duty under Section 165(4) TKG?

Today, only operators of public 5G mobile networks with a frequency assignment. Section 165(4) TKG provides that critical components “may only be used by an operator of public telecommunications networks with increased threat potential if they have been tested and certified by a recognised certification body before first use” (unofficial translation). Who has increased threat potential is set by the general ruling of the Bundesnetzagentur (BNetzA), the German Federal Network Agency, on the catalogue of security requirements, and at present it lists only 5G network operators with a frequency assignment. Catalogue 2.0 says the same.

Two limits follow from this. The duty applies only to network operators, so a VoIP provider without its own network is not covered by the wording. And a regional fibre ISP, the telecoms arm of a municipal utility or a cable network operator without 5G mobile services has no increased threat potential today. For them, the other protective measures under Section 165 TKG apply. The page protective measures under Section 165 TKG gives the overview.

What is a critical component in a telecom network?

A component that implements a critical function in whole or in part. Which functions are critical is set by the Bundesnetzagentur (BNetzA) in the catalogue of security requirements under Section 167(1) no. 2 TKG. The list of critical functions as of 18 August 2021 is in force. It applies to networks and services with increased threat potential and lists functions of the 5G network in six categories:

For categories c) to f), the network operator may depart from the classification in an individual case if it shows, plausibly and with reasons, that the function involves no criticality. According to the list, the justification belongs in the security concept. A component remains critical as soon as it also performs a function under a) or b) or another function under c) to f) that is not exempted.

The cross-references in this area are fragile. Section 167(1) no. 2 TKG refers to a provision of the BSI Act (“Section 2 no. 23 letter c double letter bb”) that no longer exists in the BSI Act of 2025, and the list itself still relies on Section 109 TKG and Section 2(13) BSIG in their old versions. In our reading, you should therefore rely on Section 165(4) TKG and on the list, not on the chain of references.

What do the catalogue and the list require of network operators that are covered?

A fixed procedure in three steps. The list describes it in chapter 4, and annex 2 of the catalogue adds the notification:

1. Identify all components. The network operator prepares a detailed description of all identified components of its network and attaches it to the security concept, whether or not they implement critical functions.
2. Determine the critical components. Every component that implements a function of the list in whole or in part is critical in principle. Exceptions under c) to f) are justified in the security concept.
3. Document, notify, certify. Critical components are identified and documented, and the network operator notifies the Federal Office for Information Security (BSI) and the BNetzA of the planned installation (annex 2 of the catalogue, chapter 2.3). From the cut-off date, they may only be used with a certificate.

According to annex 2, a certificate says nothing directly about the trustworthiness of the supplier. The source of supply therefore needs a separate assessment, as the page supply chain in telecom networks describes for all telecom providers.

When does certification apply, and why do the deadlines contradict each other?

Under the general ruling on implementation deadlines, each component has its own cut-off date: at the latest the last day of the 24th month after certification of the product under BSI TR-03163 first becomes possible, and at the earliest 1 January 2026. Until the cut-off date, components that are not certified may be used for the first time, but the operator must then take appropriate precautions to avert risks. Existing components that are already in use do not have to be certified retrospectively. The duty applies to every first use of an individual component after the cut-off date, even if it is identical in construction to an existing component.

Annex 2 of the catalogue of security requirements in its published version gives a different date: for critical components put into operation after 31 December 2025, the requirements for certified components apply. The general ruling is the later rule and, by its own wording, replaces chapter 2.4 of annex 2. Even so, the two texts stand side by side on the BNetzA website. We show both dates. By its wording, the general ruling takes the place of chapter 2.4, and the assessment in an individual case remains to be checked. Under the general ruling, the BSI publishes the cut-off date for a product type on its website.

What does BSI TR-03163 cover?

It names the permitted certification schemes for critical components in networks with increased threat potential and, according to the BSI, is aimed mainly at manufacturers. The current versions are 1.4 of the guideline and 1.6 of its annex A, which lists the permitted requirement documents and is updated on an ongoing basis. For Section 165(4), only a certificate based on one of these requirement documents counts. The BSI names, among others, NESAS, Accelerated Security Certification (Beschleunigte Sicherheitszertifizierung), Common Criteria and European cyber security certificates. Whether an existing certificate fits is stated in the certificate or in the certification report, or you ask the manufacturer. We do not reproduce the text of the guideline itself here. The contact at the BSI is unit S 32, tr-5g@bsi.bund.de.

What the draft would change in Section 165(4)

The government draft (Bundestag printed paper 21/8277) rewrites Section 165(4). Instead of increased threat potential, the duty would then depend on two features: the network operator is an essential entity under Section 28(1) sentence 1 no. 3 BSIG, and the critical component is used in the core network. Urgent security updates could be certified afterwards, and the BNetzA, in agreement with the BSI, could designate further components subject to certification by general ruling. Based on our review, the draft does not define what belongs to the core network. The draft has not been passed, and the Bundestag hearing took place on 4 November 2026 (as of 6 November 2026). The page TKG Amendment Act 2026 follows the progress of the procedure.

For a regional network operator with at least 50 employees, or with annual turnover and annual balance sheet total each above EUR 10 million, this means in our reading: the duty does not apply today, and with the act as drafted it would apply to its core network components. An inventory like the example below is the preparation for this.

When does Section 41 BSIG apply to telecom providers?

Only if the telecom provider is an operator of a critical facility. Section 41 BSIG allows the Federal Ministry of the Interior, in consultation with the Federal Ministry for Digital Transformation and Government Modernisation, to prohibit an operator of critical facilities from using a manufacturer's critical components, or to issue orders on their use, if the use is likely to impair public order or security. Among other things, it may take into account whether a third country controls the manufacturer. The prohibition can be extended to further components of the same manufacturer and, by general ruling, to all operators of critical facilities. An objection or legal action has no suspensive effect. The operator must cooperate in the investigation, and a breach of this duty to cooperate can be fined up to EUR 5 million under Section 65 BSIG.

Section 41 BSIG in the version in force contains no general duty to notify or to give a guarantee before use, even though older descriptions still mention one. For telecom providers, Section 41 applies alongside the TKG, because Section 28(5) BSIG does not exempt them from it (our inference from the exhaustive list). Whether a provider operates a critical facility depends on Section 2 no. 22 BSIG in conjunction with the KRITIS umbrella act (KRITIS-Dachgesetz). We do not cover the thresholds for this on this page.

In our reading, one restriction applies: critical components within the meaning of the BSI Act are only ICT products designated as such by an ordinance under Section 56(6) BSIG. We have not found such an ordinance for the telecom sector (as of 6 November 2026). Which components Section 41 BSIG covers in telecom networks today is therefore open.

Example: inventory of critical functions and components

Fictitious example, not a client. A regional network operator with 70 employees runs an FTTH and business customer network with its own IP core network and a voice platform, without mobile services. As an essential entity, it would be covered by the draft TKG Amendment Act. Today it has no increased threat potential and does not have to certify anything. It keeps the inventory anyway, so that after a change in the law or an order under Section 41 BSIG it knows quickly which manufacturers and types would be affected. All details are invented.

The list of critical functions applies to 5G networks. The column “nearest category of the list” is therefore our orientation for a fixed network, not a classification. The column “core network under the draft” is our assessment, because the draft does not define the term.

For each row, the company records the exact type, the software version and the location. The inventory is at the same time the component description that the list would require for the security concept once the company is covered, and it complements the supplier assessment. How a security concept is structured is described on the page security concept under Section 166 TKG.

Three typical gaps

If you want to know where your company stands on its TKG duties overall, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.