Management duties under the German Telecommunications Act (TKG): implement, oversee, train

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSIG), each as amended on 22 October 2026, checked on 6 November 2026. This page provides general information, not legal advice. Questions of liability in a specific case, which depend on the company law of your legal form, are a matter for a lawyer admitted in Germany. Quotations from German statutes on this page are our own unofficial translations. Only the German text is legally binding.

Who do the management duties apply to?

To the management body of every operator of a public telecommunications network and every provider of publicly available telecommunications services. Section 165(2b) only names providers that are essential or important entities under Section 28 BSIG. Section 28 BSIG, however, classifies these providers as at least important entities without a lower size threshold, so the duties also apply to a fibre ISP with five employees. How the classification works in detail is explained on NIS2 for telecom providers in Germany, and whether you are a telecom provider at all on Am I a telecom provider?.

The TKG does not define who exactly the “management body” (Geschäftsleitung) is. The BSI Act defines it as the natural person who, by law, statutes or articles of association, is appointed to manage the business and represent the entity (Section 2 no. 13 BSIG). None of the sources we have reviewed says whether this definition applies to Section 165 TKG. In our reading, it makes sense to follow it, which in a GmbH means the managing directors.

In substance, the duties correspond to Section 38 BSIG, which does not apply to telecom providers under Section 28(5) BSIG. The difference lies in the point of reference: Section 38 BSIG refers to the risk management measures under Section 30 BSIG, Section 165(2b) TKG to the measures under Section 165(2) TKG. If a company also carries out activities that fall under an entity type in Annex 1 or 2 of the BSI Act, such as a drinking water supply, Section 38 BSIG applies again to those activities (Section 28(5) sentence 2 BSIG). The duties under Section 38 BSIG are explained on our NIS2 site nis2-readiness.de (German).

What does “implement and oversee” mean under subsection 2b?

The management body is obliged to implement the measures the company must take under Section 165(2) and to oversee their implementation. These include the ten minimum measures under subsection 2a, from risk analysis through incident handling and the supply chain to multi-factor authentication. What each measure requires is set out on protective measures under Section 165 TKG.

Section 165 does not say how the management body organises this. The statute names implementation and oversight as duties of the management body, but does not say who does the work in detail or in what form oversight is to be documented. The catalogue of security requirements in force (version 2.0 of 29 April 2020) requires the management of a company with divided responsibilities to see to a clear and defined organisational structure and set of procedures. According to the catalogue, the security officer should have direct contact with management; more on this on security officer under Section 166 TKG.

In practice, in our assessment, this means:

• Assign responsibilities: who is responsible for which of the ten minimum measures, in writing and with a deputy.
• Provide resources: budget, staff and service providers for the measures still outstanding, with a deadline.
• Require regular reports: a fixed report from the security officer on which the management body takes dated decisions (example below).
• Accept residual risks expressly: the management body expressly acknowledges what has not been implemented, or not yet. The draft of the new catalogue (version 2025-10, not adopted) would expressly require the management body to accept residual risks.
• Take the implementation declaration seriously: together with the security concept under Section 166 TKG, the provider must declare in writing that the measures have been implemented or will be implemented without undue delay (Section 166(3)). Whoever signs should know the current status.

The draft TKG Amendment Act 2026 (not adopted) changes Section 165 in other places; subsections 2b to 2d would remain unchanged (our conclusion from the Bundestag printed paper).

How is the management body liable under subsection 2c?

To its own entity, under company law. If the management body breaches its duties under subsection 2b, it is liable to the entity for damage caused through its fault under the rules of company law that apply to the legal form. Liability under the TKG itself only applies where company law contains no such rule.

Subsection 2c therefore governs liability towards the company itself, meaning internal liability. The TKG does not say which provision of company law applies in an individual case. This page only places the reference in context; the question of liability for your company is a legal question.

Section 228 TKG contains no fine for the duties under subsections 2b to 2d. In our reading, the Bundesnetzagentur (BNetzA), the German Federal Network Agency, can still enforce the duties under Section 165 through orders under Section 183 TKG, which applies to all duties in this part of the TKG. Which fines exist for the security duties, and which do not, is set out on fines under Section 228 TKG.

What does the training duty under subsection 2d require?

The members of the management body must regularly attend training. According to the statute, the aim is to gain sufficient knowledge and skills to identify and assess risks and risk management practices in information security and to assess their impact on the services of their own company.

The statute does not set frequency, duration, detailed content or the form of evidence. We are not aware of any statement by an authority on management training in the telecoms sector. For staff training, catalogue 2.0 requires attendance to be documented. In our assessment, the same makes sense for the management body: participants, date, duration, content and the chosen frequency belong in the records.

We offer a briefing for the management body whose content is aligned with the training duty under Section 165(2d) TKG. You set the frequency yourself. It is booked through our NIS2 site nis2-readiness.de (in German); until that site launches, it is available on request.

Example: quarterly report to the management body

Fictitious example, not a client. A regional fibre ISP with 12 employees is a network operator and service provider and therefore an important entity. Once a quarter the security officer presents a report to the managing director, who decides on each item and signs. The report is our suggested structure; the statute does not prescribe a form.

A report like this shows that the management body knows the status and has taken decisions. It replaces neither the security concept nor the records that a review by the Bundesnetzagentur requires, as described on review by the Bundesnetzagentur.

Three typical gaps

Support for the management body

We prepare reports and decision papers so that the management body can assess the status of the measures and of the security concept. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. An overview of our services is on the page telecom security under the TKG.