Telecom providers based abroad: your duties under the German Telecommunications Act (TKG)

This page is for companies based outside Germany, inside or outside the EU, that serve customers in Germany with a public network or a publicly available telecommunications service: carriers, VoIP and cloud telephony providers, IoT and M2M connectivity providers, internet access providers. How the German NIS2 rules classify telecom providers in general is explained on NIS2 for telecom providers in Germany. Whether you are a telecom provider at all is covered on Am I a telecom provider?.

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG), each as amended on 22 October 2026, Telecommunications Interception Ordinance (TKÜV) as amended on 22 October 2026, checked on 6 November 2026. This page provides general information, not legal advice. Whether and how a duty applies to your company is a question for a lawyer admitted in Germany.

Does the German Telecommunications Act apply to a company based abroad?

The TKG applies to all companies and persons that operate telecommunications networks or installations, or provide telecommunications services, within its territorial scope (Section 1(2) TKG). The test is where the activity takes place, not where the company is registered. In our reading, a provider based abroad that offers a publicly available service to customers in Germany is therefore covered. Section 5 TKG, the notification duty, contains no special rule for providers based abroad.

The security duties apply to operators of public telecommunications networks and to providers of publicly available telecommunications services. "Publicly available" means available to an unspecified group of people. Telecommunications services include internet access, interpersonal communication such as voice, and signal conveyance, expressly including machine-to-machine communication. Number-independent services such as messaging apps are exempt from the notification duty, but according to the Bundesnetzagentur (BNetzA), the German Federal Network Agency, they can still have duties under Part 10 TKG, the part on public security that contains the security rules.

Notifying the Bundesnetzagentur (Section 5 TKG)

Anyone who commercially operates a public telecommunications network or commercially provides a publicly available telecommunications service, other than a number-independent one, must notify the BNetzA without undue delay of the planned start, any change and the end of the activity, as well as changes to the company name, legal form and address (Section 5(1) TKG).

• The notification is made in writing or electronically, using the form published by the BNetzA (Section 5(1) and (2) TKG).
• On request, the BNetzA confirms within one week that the notification is complete (Section 5(3) TKG).
• The BNetzA publishes a register of notified companies with a short description of the activity (Section 5(4) TKG).
• Failing to notify, or notifying incorrectly, incompletely or late, is an administrative offence with a fine of up to EUR 10,000 (Section 228(2) no. 2 TKG).

The notification goes to the BNetzA only. It does not replace registration with the Federal Office for Information Security (BSI), which is a separate duty under the BSI Act (see below). Your role, borderline cases such as guest Wi-Fi and M2M, and a role check are on the page Am I a telecom provider? Notification under Section 5 TKG.

Security officer and contact person established in the EU (Section 166(1) TKG)

Every operator of a public telecommunications network and every provider of publicly available telecommunications services must appoint a security officer and designate a contact person established in the European Union (Section 166(1) nos. 1 and 2 TKG). There is no size threshold, and the duty does not depend on the classification under the BSI Act. The EU contact person is required from every provider, including German ones, but for a provider based outside the EU it is the point that needs a real decision: who in the EU takes on this role, with which mandate and which knowledge of your network.

The statute requires the contact person to be established in the EU, not in Germany. It does not describe the contact person's tasks. Tasks and requirements for the security officer come from the catalogue of security requirements of the Bundesnetzagentur and are explained, with a template for the appointment, on security officer under Section 166 TKG. Section 228 TKG has no separate offence for a missing security officer or contact person.

Security concept: who submits, and in which language?

Every provider must draw up a security concept showing its network and services, the threats to be expected and the protective measures taken or planned under Section 165(1) to (7) TKG, as specified by the catalogue of security requirements (Section 166(1) no. 3 TKG). Whether you have to submit it depends on your role:

With every submission comes a declaration that the measures have been implemented or will be implemented without undue delay (Section 166(3) TKG). Failing to submit the concept, or submitting it incorrectly, incompletely or late, can be fined up to EUR 300,000 (Section 228(2) no. 38 TKG). What the concept contains and how to structure it is explained on security concept under Section 166 TKG.

Language: the TKG does not say in which language the concept is submitted. Under Section 23 of the German Administrative Procedure Act (VwVfG), the official language is German, and where documents are submitted in a foreign language, the authority is to ask for a translation without undue delay. In our reading, this also covers the submission of the security concept, because the BNetzA is a federal authority. This is interpretation, not a statement in the TKG. We found English guidance from the BNetzA only for lawful interception (an unofficial translation of the technical directive TR TKÜV and sample concepts), not for the catalogue of security requirements or for incident reporting. Planning a German version of the concept from the start avoids a request for translation later.

A certificate from your home country, for example under ISO/IEC 27001, does not replace the concept. Much of the content can be reused, but the network and service description for Germany, the mapping to the catalogue and the implementation declaration have to be added.

Minimum measures and incident reporting

Section 165(2a) TKG sets ten minimum measures for telecom providers that are essential or important entities under Section 28 of the BSI Act. Section 28 classifies operators of public networks and providers of publicly available services by headcount, turnover and balance sheet, with no lower size limit. In our reading, this classification depends on these criteria, not on where the company is established. The measures are explained on protective measures under Section 165 TKG.

Significant security incidents are reported to both the BNetzA and the BSI (Section 168 TKG): an early warning without undue delay and no later than 24 hours after becoming aware, an incident notification no later than 72 hours, and a final report no later than one month after the 72-hour notification. Whether an incident is significant depends on its effect on your network or service in Germany. The steps, deadlines and a practice scenario are on incident reporting under Section 168 TKG.

BSI registration and supervision: what is open

Under Section 28(5) BSIG, most NIS2 duties of the BSI Act do not apply to telecom providers, because the TKG contains them. Registration with the BSI under Section 33 BSIG is not among the exceptions, so it applies to telecom providers in principle. For a provider based abroad, two provisions make the picture less clear:

• The BSI is the supervisory authority for Part 3 of the BSI Act, which includes registration, for essential and important entities established in Germany and for operators of critical facilities located in Germany (Section 59 BSIG).
• Section 60 BSIG assigns some digital providers to the BSI by their main establishment in the EU, for example cloud computing services. Telecom providers are not on that list.

How the registration duty applies to a telecom provider without an establishment in Germany is not addressed in the statute or in the BSI and BNetzA sources we have reviewed (as of 6 November 2026). The BSI states that operators of critical facilities remain so regardless of where the company is based, but that statement concerns critical facilities, not the NIS2 entity categories in general. We therefore treat this point as open. In our reading, a provider with an establishment in Germany, for example a branch, falls under Section 59 BSIG. Without one, clarify the question with the BSI or a lawyer before deciding not to register, and document the answer. Registration takes place in the BSI portal (page in German).

Lawful interception and information requests (Section 170 TKG)

Section 170 TKG and the TKÜV set duties for lawful interception, which also have a domestic element. An operator of a telecommunications installation used for publicly available services must name an authorised recipient for service of documents in Germany. A provider without its own installation must tell the BNetzA which office in Germany receives interception orders. Neither rule applies within the scope of Directive (EU) 2023/1544 (Section 170(12) TKG). Whether that exception covers your company is a question for a lawyer. Under the TKÜV, the equipment controlling the interception functions has to be operated in Germany.

The TKÜV exempts installations with no more than 10,000 connected users from providing interception equipment. It does not apply to network nodes that route publicly available voice services abroad (Section 3(2) sentence 2 TKÜV). That threshold applies only to interception equipment under Part 2 TKÜV. Traffic data requests have no such threshold (only simplifications up to 100,000 end users), and information requests on customer data under Section 174 TKG apply regardless, see customer data under Sections 172-174 TKG. The details for small providers are on Section 170 TKG and TKÜV. We do not provide interception technology. The BNetzA publishes its technical directive TR TKÜV in an unofficial English translation.

Example: checklist for a provider based outside the EU

Example, not a client. A VoIP provider based in Switzerland with 20 employees offers cloud telephony with German phone numbers to business customers in Germany. It has no network of its own in Germany. The voice platform runs in a data centre in Frankfurt operated by a contractor. It has no establishment in Germany and no subsidiary in the EU. The checklist below is our reading of the statutory text for this example and does not replace a case-by-case assessment.

Three common gaps

Where to go next

• Classification under the BSI Act and the duties that sit in the TKG: NIS2 for telecom providers in Germany.
• Content, structure and submission of the concept: security concept under Section 166 TKG.
• The two mandatory roles, with an appointment template: security officer under Section 166 TKG.
• Reporting steps and a practice scenario: incident reporting under Section 168 TKG.
• The ten minimum measures and how to evidence them: protective measures under Section 165 TKG.
• Version 2.0 in force and the 2025-10 draft: catalogue of security requirements under Section 167 TKG.
• Customer data and information requests: customer data under Sections 172-174 TKG.

We work with you in English and prepare the German text you submit to the Bundesnetzagentur. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. Our services are described on our telecom security services page, the entry point on the page status review (stage 1).