Municipal utility with a telecoms arm: assigning duties under the TKG, EnWG and BSI Act

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSIG) as amended on 22 October 2026, Energy Industry Act (Energiewirtschaftsgesetz, EnWG) as amended on 23 July 2026, checked on 6 November 2026. This page provides general information, not legal advice. How the business units of your utility are to be classified in law is a matter for a lawyer admitted in Germany. We cover the energy side only as far as it touches the telecoms arm. Quotations from German statutes and other German sources on this page are our own unofficial translations. Only the German text is legally binding.

Which roles does a municipal utility with a telecoms arm have?

At least two, and each has its own set of rules. With the fibre network and the services over it, the utility is a telecom provider under the TKG. With the electricity or gas network, it is an operator of an energy supply network under the EnWG. If it also runs drinking water supply, district heating or charging points, the BSI Act comes in for those activities. Whether your fibre offering is public, and you are therefore a telecom provider, can be checked on the page Am I a telecom provider?.

Even within the Bundesnetzagentur the channels are separate: unit 627 looks after the IT security catalogue for energy, while the security concept and incident reports of the telecoms arm go through dedicated telecoms units.

What does Section 28(5) BSIG mean for a municipal utility?

Most duties of the BSI Act do not apply to the telecoms arm or to energy networks and energy facilities, but they do apply to further business units. Under Section 28(5) sentence 1 BSIG, Sections 30, 31, 32, 35, 36, 38, 39, 61 and 62 do not apply to entities that operate a public telecommunications network or provide publicly available telecommunications services (no. 1). Equally excluded are entities that operate energy supply networks, energy facilities or digital energy services and are subject to Sections 5c to 5e EnWG (no. 2). For the telecoms arm the counterparts are in the TKG, for the energy arm in the EnWG.

The exception under sentence 2 only covers further critical facilities or activities that fall under an entity type in Annex 1 or 2 of the BSI Act. Drinking water supply and district heating are such entity types, as are electricity suppliers and charging points, which in our reading Section 5c EnWG does not cover. For these business units, in our reading, the BSI Act duties apply again, and for further critical facilities they extend to all IT systems those facilities need (sentence 3). The electricity network itself is not a case for the exception; it is excluded under sentence 1 no. 2.

Two points should be checked separately. If operating an energy facility is only an ancillary activity measured against the business as a whole, Section 28(5) BSIG by its wording does not apply (sentence 4). And size is determined by the entity: in our reading the employees of the whole company count, not only those of the business unit. For organisational units of a regional or local authority without separate legal personality, such as a municipal enterprise (Eigenbetrieb), Section 28(4) BSIG expressly excludes the EU recommendation on SMEs. How to count in that case is a question for the individual case. How telecom providers are classified in general, and why registration under Section 33 BSIG still applies, is explained on NIS2 for telecom providers in Germany. The classification of the energy arm itself is not covered on this page.

Where the IT security catalogue touches the telecoms arm

Only at the network's internal technology. Section 5c EnWG requires appropriate protection of the telecommunications and data processing systems that are necessary for the secure operation of the energy supply network. The BNetzA sets the requirements in agreement with the BSI in the IT security catalogue (Section 5c(2) sentence 1 EnWG). The EnWG also calls it a “catalogue of security requirements”. To distinguish it from the catalogue under Section 167 TKG, this page only speaks of the IT security catalogue. According to the BNetzA, until a new catalogue is issued, the catalogues of August 2015 (electricity and gas networks) and December 2018 (energy facilities) continue to apply. Older documents still cite Section 11(1a) and (1b) EnWG as the legal basis; these subsections no longer exist in the EnWG in force. Who has to implement the IT security catalogue and what it requires in detail is not covered on this page.

Does meeting one set of rules count for the other?

No. The statute does not let one count towards the other. Neither Section 5c EnWG nor Sections 165 to 167 TKG contain a rule under which meeting one set of rules satisfies the other. In our reading, Section 5c(1) no. 1 EnWG only covers the network's internal technology, meaning systems “necessary for the secure operation of the energy supply network”, such as communication with the network control centre. The public fibre network and the services for end customers fall under the TKG.

What can be shared is the work. The security concept under Section 166 TKG may base its measures on recognised standards, and an ISMS under ISO/IEC 27001 from the energy arm supplies building blocks such as the risk method, roles and evidence. A certificate does not replace the concept. What can be reused and what has to be created specifically for the telecoms arm is set out on the page security concept under Section 166 TKG and ISO 27001.

If the utility uses the same ducts, fibres or sites for network control technology and for the public services, those parts belong, in our reading, in both assessments: in the telecoms security concept for the public services, and in the implementation of the IT security catalogue for network operation.

In which order should the telecoms arm proceed?

The telecoms arm has the same duties as any other telecom provider, with no size threshold. The order is our recommendation; the deadlines are set by statute. The right-hand column shows what a municipal utility should pay particular attention to.

The detailed procedure for a small network operator, with a plan for the first 90 days, is shown on the page duties as a fibre network operator.

Example: duties matrix for a municipal utility

Fictitious example, not a client. A municipal utility with 140 employees, organised as a limited company (GmbH), operates the town's electricity and gas network, the drinking water supply and, for the past three years, a fibre network with around 5,000 connections. It sells internet access as its own product, and telephony with its own numbers via a wholesale provider's platform. For electricity and gas there is a certified ISMS under the IT security catalogue. The network control centre is connected via its own fibres in the same duct network.

The table is our reading of the statutory wording and not a case-by-case assessment. For the energy arm it only names the set of rules; its duties in detail do not belong on this page. A dash means: not covered on this page or not relevant. You can adopt the columns and rows for your utility and add the columns “responsible” and “status”.

The “security officer” row shows a typical trap: an ISMS officer of the energy arm is not automatically the security officer under Section 166 TKG. Anyone combining both roles in one person should appoint them expressly and document it.

Three typical gaps

How we support you

We work on the telecoms arm: security concept under Section 166 TKG, security officer and the NIS2 duties in the TKG, aligned with what your energy arm already has. Where your utility stands today is shown by the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. The legal classification of the utility units belongs in the hands of a lawyer.