NIS2 for telecom providers in Germany: German Telecommunications Act (TKG) or BSI Act?

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG), each as amended on 22 October 2026, checked on 6 November 2026. The German NIS2 implementation has applied to telecom providers since 6 December 2025, without a transition period. This page provides general information, not legal advice. Whether and how a duty applies to your company is a question for a lawyer admitted in Germany.

Are you a telecom provider, and do you need to notify the regulator?

The security rules apply to anyone who operates a public telecommunications network or provides publicly available telecommunications services as defined in Section 3 TKG, and these services expressly include signal conveyance for machine-to-machine communication. Anyone who does so commercially must notify the Bundesnetzagentur (BNetzA), the German Federal Network Agency, of the start, change and end of the activity under Section 5 TKG, using the BNetzA form, while number-independent services such as messaging are exempt. This notification does not replace registration with the BSI. Terms, documented borderline cases such as guest Wi-Fi and M2M, and a role check with fields for your reasoning are on the page Am I a telecom provider? Notification under Section 5 TKG.

The order in which the duties fall due for particular groups of providers is shown on the pages duties of fibre network operators, VoIP and cloud telephony, Wi-Fi and hotspots and municipal utilities with a telecoms arm.

How the BSI Act classifies telecom providers

The two groups leave no gap, so there is no lower size limit. Size is determined under Commission Recommendation 2003/361/EC. Data of partner or linked enterprises is not added if your company is independent of them as regards its IT systems (Section 28(4)). According to the BSI, the exception for negligible business activities in Section 28(3) does not apply to telecom providers.

Which duties sit in the Telecommunications Act instead of the BSI Act?

Under Section 28(5) sentence 1 no. 1 BSIG, Sections 30, 31, 32, 35, 36, 38, 39, 61 and 62 BSIG do not apply to entities that operate a public telecommunications network or provide publicly available telecommunications services. Their counterparts are in the TKG:

Section 33 BSIG, registration with the BSI, is not excluded. The exclusion also stops where the company operates further critical facilities or, through further activities, falls under an entity type in Annex 1 or 2 of the BSI Act (Section 28(5) sentence 2). A telecom provider that also offers cloud or managed services should check this separately.

Registration with the BSI (Section 33 BSIG)

Telecom providers must register with the BSI within three months of first or again qualifying as an essential or important entity. For providers already active on 6 December 2025, that period ended, by our calculation, on 6 March 2026. The information required includes address, contact details and public IP address ranges. Section 66 BSIG only provides that earlier versions of Section 33(2) and (5) continue to apply for now. It does not postpone the duty to register under Section 33(1). If a company does not register, the BSI may register it itself. Registration takes place in the BSI portal (page in German), which also links to the BSI's instructions.

Duties of the management body (Section 165(2b) to (2d) TKG)

The management body must implement the measures under Section 165(2) TKG and oversee their implementation, and its members must regularly attend training on information security risks. If it breaches these duties, it is liable to its own entity under the company law of the entity's legal form. We offer a briefing for the management body whose content is aligned with the training duty under Section 165(2d) TKG, available on request. What this means in practice, with a template for reporting to the management body, is on the page management duties under Section 165 TKG.

Fines

Fines are tied to specific offences, and all amounts are maximums. Failing to register with the BSI can be fined up to EUR 500,000 (Section 65 BSIG), failing to submit the security concept up to EUR 300,000 and failing to report a security incident under Section 168 TKG up to EUR 10,000 (Section 228 TKG). There is no offence for breaches of Section 165 TKG, and the BSI Act's fines of up to EUR 10 million relate to provisions that do not apply to telecom providers under Section 28(5) BSIG. All offences with maximum amounts, and the orders the BNetzA can issue, are on the page fines under Section 228 TKG.

Foreign providers active in Germany

In our reading, the TKG also applies to providers based abroad that operate networks or provide services in Germany, because Section 1(2) TKG links it to the activity, not to the place of registration. Every provider must designate a contact person established in the EU (Section 166(1) no. 2 TKG), and how BSI registration applies without an establishment in Germany is not settled in the sources we have reviewed. Notification, EU contact person, security concept, language of submission and the open BSI questions are covered, with a checklist, on telecom providers based abroad: duties under the TKG.

Example: duties matrix for three providers

Fictitious examples, not clients. The matrix is our reading of the statutory text and does not replace a case-by-case assessment.

Self-check and advice

Our self-check for telecom providers on www.blackfort-tec.de helps you see which points are still open. For a professional assessment with a gap check of your concept, see the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.