Last updated: 2026-11-06
Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG), each as amended on 22 October 2026, Telecommunications Interception Ordinance (TKÜV) as amended on 22 October 2026, checked on 6 November 2026. This page provides general information, not legal advice. Which duties apply to your company in a specific case is a question for a lawyer admitted in Germany. Whether your network is public and whether you provide services can be checked first on the page am I a telecom provider?.
Which duties does a fibre ISP have, and in what order?
Start with the duties that carry deadlines or that everything else builds on. The deadlines in the table are set by the statute, the order is our recommendation. Details on each duty are on the linked page.
| Step | Duty | Provision | Timing under the statute |
|---|---|---|---|
| 1 | Notify the activity to the Bundesnetzagentur (BNetzA), the German Federal Network Agency, and later every change (notification under Section 5 TKG) | Section 5 TKG | without undue delay, already for the intended start of the activity |
| 2 | Appoint a security officer and designate an EU contact person (security officer under Section 166 TKG) | Section 166(1) nos. 1 and 2 TKG | no deadline of its own; the catalogue of security requirements expects the appointment when operation starts |
| 3 | Collect customer data (customer data under Sections 172-174 TKG) | Section 172(1) TKG | before the line is activated |
| 4 | Draw up the security concept and submit it with the implementation declaration (security concept under Section 166 TKG) | Section 166(1) no. 3, (2), (3) TKG | without undue delay after network operation starts |
| 5 | Reporting procedure for significant security incidents to the BNetzA and the Federal Office for Information Security (BSI) (reporting under Section 168 TKG), for personal data breaches under Section 169 TKG | Sections 168, 169 TKG | from the start of operation; early warning no later than 24 hours after becoming aware, notification after 72 hours, final report after one month |
| 6 | Register with the BSI (NIS2 for telecom providers) | Section 33(1) BSIG | no later than three months after the company first or again qualifies as an essential or important entity |
| 7 | Implement protective measures, including the ten minimum measures and safeguarding network operation (protective measures under Section 165 TKG) | Section 165(2), (2a), (5) TKG | ongoing; the concept describes what has been taken or is planned |
| 8 | Set up the information request procedure: manual requests, e-mail procedure, traffic data requests | Section 174(1), (7) TKG, Part 4 TKÜV | no deadline of its own in the statute; the BNetzA asks for a notification on the interface under Section 174(7) on its form |
| 9 | Clarify lawful interception duties under Section 170 TKG | Section 170 TKG, Section 3 TKÜV | notification without undue delay after operation starts, unless the TKÜV provides an exception (see below) |
| 10 | Involve the management body: implement the measures and oversee their implementation, training (duties of the management body) | Section 165(2b) to (2d) TKG | ongoing, the statute sets no interval |
Two duties usually do not affect small ISPs. Customer files for the automated information procedure under Section 173 are only needed by providers that assign telephone numbers, and under the related Customer Data Information Ordinance (KDAV) only above 10,000 subscribers. The duties to maintain services under emergency preparedness in Section 185(1) TKG apply to service providers with more than 100,000 contractual partners, and to network operators only insofar as their network is needed for those services. In our reading, an ISP that leases its network on open access terms to such a provider should check this.
Lawful interception and information requests in brief
Under Section 3(2) sentence 1 no. 5 TKÜV an operator does not have to keep interception equipment as long as no more than 10,000 users are connected to its system. Information on traffic data under Part 4 TKÜV and on customer data under Section 174 TKG is required regardless. Whether the notification under Section 170(1) no. 3 TKG is also dropped below the threshold is an open question, and we recommend clarifying it in writing with unit 218 of the BNetzA. Thresholds, organisation and a checklist are on the page Section 170 TKG and TKÜV.
How can the network of a regional fibre ISP be built?
For example from one or two central network nodes, a passive fibre network up to the building and a number of service providers. The table describes one possible set-up as a technical example. It is not a legal statement, and your network may be built differently. The right-hand column shows where each part appears in the security concept and in the protective measures (our assignment).
| Part of the network | Possible set-up | Relevance for the concept and the measures |
|---|---|---|
| Central network node (PoP) | Routers, access servers for customer log-in, OLT in PON networks or aggregation switches in point-to-point networks, servers for DHCP, DNS and authentication | Network structure plan; power, cooling and physical access (Section 165(2a) no. 3, business continuity: emergency operation) |
| Internet uplink | Transit via one or two carriers, sometimes peering at an internet exchange | Redundancy and outage scenarios; upstream providers in supplier management (no. 4: supply chain) |
| Passive network | Routes and ducts, street cabinets, splice closures, building entry point, fibre wall outlet | Threats from civil works and access to cabinets; as-built documentation |
| At the customer | ONT and router, often supplied by the ISP and configured remotely | Configuration, updates and remote access to customer equipment (no. 5, nos. 9 and 10) |
| Operational systems | Network management, provisioning, customer management and billing | Access control and strong authentication (nos. 9 and 10: access to network elements); customer data under Section 172 |
| Telephony | For example via an upstream provider's platform with the ISP's own numbers | Contract and reporting channels with the upstream provider; emergency calls under Section 164 TKG |
| Service providers | Civil works and installation, maintenance, remote maintenance by manufacturers or IT service companies | Assessment of service providers, contractual security requirements (supply chain), secured remote maintenance (access to network elements) |
If the ISP works with other companies at shared sites, such as a network node in a partner's building, Section 165(7) places the duties on each party insofar as particular obligations cannot be assigned to a particular party. In our reading, the assignment should therefore be set out in the contract. The certification duty for critical components under Section 165(4) currently applies only to network operators with increased threat potential, which means 5G mobile networks.
Is there a lighter route for small networks?
For the duty itself, no. For the effort, yes. Section 166 has no size threshold, so a small network also needs a security concept. The statute does, however, require appropriate measures: the size of the provider and its risk exposure count towards appropriateness (Section 165(2)), and the effort must not be out of proportion to the importance of the networks and services (Section 165(6)). The draft of a new catalogue of security requirements (version 2025-10, not adopted) would grade measures by threat potential, with the basic measures of category a) for the smallest companies. What else the draft would change is set out on the page catalogue of security requirements.
How an existing concept is brought up to the law in force is explained on the page security concept under Section 166 TKG.
Example: plan for the first 90 days
Fictitious example, not a client. A fibre ISP with 8 employees has run a network in a small town and two outlying districts since 2021, with around 2,400 connections. It sells internet access as its own product and telephony with its own numbers via an upstream provider. The security concept dates from 2021 and is still written to Section 109 of the former TKG. The BNetzA has raised no objections. The new managing director wants to put the duties in order within one quarter.
The plan is our recommendation for this example. The column “Duty” gives the provision, the column “Result” the document that should exist at the end. For your company, replace the weeks with dates and fill in who is responsible.
| Period | Task | Duty | Responsible | Result |
|---|---|---|---|---|
| Week 1 | Compare the notification under Section 5 with the BNetzA register: are telephony and the new districts included? | Section 5 TKG | Management | Change notification or note “up to date” |
| Week 1 | Check registration with the BSI; by our calculation the deadline for providers already active ended on 6 March 2026, so register immediately if still open | Section 33 BSIG | Management | Registration confirmation |
| Weeks 1-2 | Appoint the security officer and designate the EU contact person in writing, arrange deputies | Section 166(1) nos. 1 and 2 TKG | Management | Letter of appointment |
| Week 2 | Set the reporting procedure: who detects, who assesses, who reports to the BNetzA and the BSI, weekend cover; oblige the upstream provider to pass on incidents immediately | Sections 168, 169 TKG | Security officer | Reporting procedure, one page, with contact list |
| Weeks 2-8 | Revise the concept to Section 166(1) no. 3, add the ten areas under Section 165(2a) to the measures section, update the network structure plan | Sections 165, 166 TKG | Security officer with external support | Revised concept, implementation declaration |
| Weeks 4-6 | Check the information request procedure: customer data complete, e-mail procedure set up and notified to the BNetzA, staff responsible for requests named | Sections 172, 174 TKG, Section 31 TKÜV | Head of customer service | Process description, notification to the BNetzA |
| Week 6 | With 2,400 connections below the 10,000 threshold of the TKÜV; put the question on the notification under Section 170(1) no. 3 in writing to unit 218 of the BNetzA | Section 170 TKG, Section 3 TKÜV | Security officer | Query and reply on file |
| Weeks 8-10 | List remote maintenance by manufacturers and IT service companies, switch access to case-by-case approval, strong authentication for admin access | Section 165(2a) nos. 4, 9, 10 TKG | Head of technology | Access list, service provider assessment |
| Week 10 | Clarify whether the revised concept has to be submitted again under Section 166(4) sentence 2 (changed circumstances), and submit it | Section 166(2), (4) TKG | Management | Cover letter pointing out the changes |
| Week 12 | Report to management with status per measure, decision on open points, schedule training for the management body | Section 165(2b), (2d) TKG | Security officer | Report with decision, training date |
| Week 13 | Run through the reporting procedure in a short exercise with a made-up incident | Section 168 TKG | Security officer | Exercise record with improvements |
An ISP that is just starting proceeds in a similar way, only earlier: notification under Section 5 and customer data before the first connection, and the concept finished before the network goes live so that it can be submitted without undue delay.
Three typical gaps
| Gap | Cause | Effect | Remedy |
|---|---|---|---|
| Concept from the start-up phase never updated | Concept seen as a one-off formality at network launch | Telephony, new areas and the minimum measures under Section 165(2a) are missing; the duty to adapt under Section 166(4) sentence 2 is not met | Link concept maintenance to product release and network expansion, review at least once a year |
| Service providers out of view | Maintenance and remote access sit with the manufacturer or IT service company, “they handle that” | No assessment, no contract clauses, permanent remote access; responsibility stays with the ISP | Assess service providers, set security requirements in the contract, limit access in time and log it |
| Small size read as an exemption | Thresholds from the TKÜV or KDAV applied to all duties | Security concept, reporting procedure or e-mail procedure for information requests are missing, although they apply without a threshold | Check each duty against its own threshold and record the result with the provision |
How we can help
We bring security concepts of small and medium-sized networks up to the law in force and help with reporting procedures and evidence. Where you stand today is shown by the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.
Frequently asked questions
Are small fibre networks exempt from the security concept?+
Does an ISP with no more than 10,000 connected users have to keep interception equipment?+
Our network is maintained by a service provider. Who is responsible?+
Does the certification duty for critical components apply to our network?+
Do we have to register with the BSI although we have already notified the Bundesnetzagentur?+
Read more
- Section 166 TKG Security Concept: German Telecommunications Act
- Section 5 TKG: Am I a Telecom Provider? Roles, Notification
- Section 165 TKG: Protective Measures, Ten Minimum Measures
- Section 168 TKG: Reporting Security Incidents to BNetzA and BSI
- Customer Data, Sections 172-174 TKG (German Telecommunications Act)
- Municipal Utilities and the TKG: Duties of the Telecoms Arm
- German Telecommunications Act (TKG): Telecom Security Services
Sources
- Section 5 TKG: notification duty (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 165 TKG: technical and organisational safeguards (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 166 TKG: security officer and security concept (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 168 TKG: reporting security incidents (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 170 TKG: implementing interception measures and providing information (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 174 TKG: manual information procedure (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Telecommunications Interception Ordinance (TKÜV) (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 33 BSI Act: registration duty (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Bundesnetzagentur: interception measures and provision of information (German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).