TKG Amendment Act 2026: what the draft would change in Sections 165, 167, 168 and 228 TKG

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, BSI Act (BSI-Gesetz, BSIG) as amended on 22 October 2026, government draft as Bundestag printed paper 21/8277, checked on 6 November 2026. This page describes a draft. It may change in the further procedure, and only the statutory text in force at any given time is binding. This is general information, not legal advice. Whether and how a future duty would apply to your company is a question for a lawyer admitted in Germany. Quotations from German statutes on this page are our own unofficial translations. Only the German text is legally binding.

Where does the legislative procedure stand?

After the committee hearing, before the committee recommendation. The individual steps:

What was the hearing about?

Network expansion. The Bundestag report names copper-to-fibre migration, access to fibre networks (Sections 22a, 22b of the draft), the fibre provision charge (Glasfaserbereitstellungsentgelt, Section 72) and full fibre roll-out in buildings (Section 144). The security duties do not appear in the report. In the seven written statements we found no statement on Sections 165 to 168 and 228 TKG. The broadband association BREKO calls for a security concept agreed with the Federal Office for Information Security (BSI) only for the gigabit land register (Gigabit-Grundbuch, Section 86 of the draft), which is something different from the security concept under Section 166 TKG. The network expansion rules are described in our article TKG Amendment Act 2026: New Network Expansion Rules on www.blackfort-tec.de.

What would change in Section 165 TKG?

The draft amends Section 165 in four places (Article 1 no. 62), and in substance mainly in three. The common thread: where the law in force refers to increased threat potential, the classification as an essential entity under Section 28(1) sentence 1 no. 3 BSIG, or 5G mobile networks expressly, would take its place. Under the general ruling in force of the Bundesnetzagentur (BNetzA), the German Federal Network Agency, only operators of 5G mobile networks with a frequency assignment have increased threat potential today. Under that provision, a telecom provider is an essential entity if it employs at least 50 people or has annual turnover and an annual balance sheet total each above EUR 10 million.

• Subsection 2 sentence 2: “security breaches” (Sicherheitsverletzungen) would become “security incidents” (Sicherheitsvorfälle). This is an editorial alignment.
• Subsection 3 sentence 2, attack detection: The duty to use attack detection systems would apply to network operators and service providers that are essential entities. Today it applies only with increased threat potential. For everyone else, use would remain voluntary under sentence 1.
• Subsection 4, certification of critical components: Network operators that are essential entities could use critical components in the core network only if certified. Under its wording, subsection 4 still does not cover service providers without their own network. The Bundesnetzagentur could designate further critical components “in public telecommunications networks” by general ruling, according to the wording without restriction to essential entities. Details are on the page critical components in telecommunications.
• Subsection 9, audit: An audit ordered under sentence 1 would in future be carried out by the BSI or a qualified independent body designated by it. The mandatory audit without an order would apply only to operators of public mobile networks of the fifth generation and successor generations with a frequency assignment, every three instead of every two years. The Bundesnetzagentur assesses the results in agreement with the BSI and communicates them to the company concerned.

On subsection 3, the Bundesrat proposed exempting providers whose telecommunications networks and services count as negligible business activity under Section 28(3) BSIG. In its reply, the federal government agreed in principle, without the explanatory last half-sentence of the proposal. Whether the Bundestag adopts the change is open. What Section 165 requires today is explained on the page protective measures under Section 165 TKG, and which components count as critical on the page critical components in telecommunications.

What would change in Sections 167, 168 and 228?

Section 167(2): The draft aligns two references with the BSI Act in force: Section 56(6) instead of (7) and Section 2 no. 23 instead of no. 24 BSIG. No new duties arise from this. The Bundesrat also wanted the catalogue to include requirements for protection against power outages, emergency power for mobile sites and redundancy of central network components, and wanted the federal states to be consulted before it is issued. The federal government rejected this.

Section 168(6): The Bundesnetzagentur would inform the Federal Ministry for Digital Transformation and Government Modernisation and the Federal Ministry of Defence about reported security incidents, and in the case of cross-border effects also the Federal Foreign Office. The Bundesrat also wants the locally affected federal state to be included, and the federal government wants to examine this. By our inference, the deadlines and content of your own report stay the same, because the draft amends Section 168 only in subsection 6. How to report is set out on the page incident reporting under Section 168 TKG.

Section 228: Subsections 3 to 9 would be replaced by new subsections 3 to 5. The ranges for the security concept under Section 166 (subsection 2 no. 38, up to EUR 300,000) and for reporting under Section 168 (no. 39, up to EUR 10,000) would stay the same, and the draft does not list Section 165 either. For some offences from subsection 2 no. 53 onwards, which concern customer data and the storage of traffic data, the new list assigns the numbers as if subsection 2 were shifted by one from that point. Subsection 2, however, only gains the new numbers 17a and 17b. In our assessment this is an editorial error. The details are in the table below. The ranges in force are explained on the page fines under Section 228 TKG.

The draft does not amend Section 166, that is the security officer and the security concept. Outside the security duties, it also amends emergency preparedness under Sections 184 and 185 TKG, see emergency preparedness in telecommunications.

Comparison: law in force and draft

The table is our work product based on the TKG in force and the printed paper. The last column is our assessment for small and medium-sized providers, not legal information for an individual case.

BMDS stands for the Federal Ministry for Digital Transformation and Government Modernisation, BMVg for the Federal Ministry of Defence.

Example: what the draft would mean for two providers

Fictitious example, not clients. Provider A is a regional fibre ISP with 12 employees and annual turnover below EUR 10 million, and so an important entity. Provider B is a regional carrier with 80 employees, its own core network and telephony for business customers, and so an essential entity. Neither operates a 5G network. If the draft became law in this version, it would look like this in our assessment:

For B there is a further point: if the draft catalogue of security requirements version 2025-10 were adopted first, B would, by our inference, have increased threat potential under it. B would then already be obliged under today's Section 165 to use attack detection (subsection 3 sentence 2), to certify critical components (subsection 4) and to be audited every two years (subsection 9 sentence 2). The row on the mandatory audit in the table therefore only applies if the act enters into force before the catalogue. Which comes first is open. The draft catalogue is explained on the page catalogue of security requirements under Section 167 TKG.

What makes sense now?

Monitor and plan. Implement only once the act has been promulgated. Our recommendation is that today you only check whether you are an essential entity and include the result in the report to management, see duties of management. If you reach the threshold, you can include attack detection and procurement for the core network in budget and contract planning, so that entry into force on the day after promulgation does not come as a surprise. Until then, describe only measures under the law in force in the security concept.

Three typical gaps

How we help

We show which measures in the security concept a change under the draft would affect, plan them with you and keep the concept up to date with the law in force. Whether a future duty would apply to your company is a question for your legal adviser. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. Where you stand today is shown by the status review (stage 1). The date at the top shows the status of this page. Only the statutory text in force at any given time is binding.