Since 28 June 2025 (Bundesfachstelle Barrierefreiheit), the German Accessibility Act (BFSG) has obliged large parts of digital consumer business to be accessible - from online shops and booking portals to banking and e-book services. A year on, the picture has shifted: the joint market surveillance body of the German states took up its nationwide work in September 2025 and adopted its market surveillance strategies for products and services in January 2026 (MLBF, 2026). For operators this means an audit is no longer an abstract possibility but a concrete procedure with deadlines, orders and fines of up to EUR 100,000 (BFSG § 37). This guide explains step by step who audits, what is checked, how the procedure unfolds - and how a structured WCAG audit helps you prepare for it.
Key takeaways
- The market surveillance body of the German states (MLBF) in Magdeburg is responsible nationwide, for services and products alike.
- Triggers are sampling, consumer complaints, tip-offs from recognized bodies or the authority's own research - not only competitor warnings.
- The technical reference is EN 301 549, which refers to the WCAG success criteria at level AA for web content; the accessibility statement is checked as well.
- The procedure is staged: information request, audit report, a reasonable deadline to remediate, and as a rule only then an order and a fine.
- The range runs up to EUR 100,000 (BFSG § 37) for serious violations and up to EUR 10,000 (BFSG § 37) for notification, labelling and disclosure duties; a ban on the service can be added.
- The gap is wide: 95.9% (WebAIM Million, 2026) of home pages carry WCAG failures, on average 56.1 (WebAIM Million, 2026) per page - an audit finds a target almost everywhere.
Who Audits: the Market Surveillance of the States
Enforcement of the BFSG lies with the German states, not the federal government. For products and for the many consumer services in scope - including online shops and all of electronic commerce - the 16 states have created a joint body by state treaty: the market surveillance body of the states for the accessibility of products and services (MLBF), based in Magdeburg. It concentrates oversight for all of Germany in one place, so that a provider is not audited by sixteen authorities in parallel. Its remit also covers physical products such as ATMs and ticket machines, smartphones or e-book readers (MLBF, 2026).
The legal background is European Directive (EU) 2019/882, the European Accessibility Act, which the BFSG transposes into German law (European Commission). The authorities work along the principles of market surveillance familiar from product safety law: risk-based, by sampling and reactive to complaints. The MLBF adopted its market surveillance strategies for products and services in January 2026 (MLBF, 2026). How enforcement and legal risks look overall is explored in the article on BFSG enforcement and its legal risks.
Market surveillance is not a competitor warning
What the Authority Checks
The yardstick is not a subjective impression but the European standard EN 301 549. It translates the requirements into technically testable criteria and, for web content, refers to the success criteria of the Web Content Accessibility Guidelines (WCAG) at level AA - version V3.2.1 to WCAG 2.1, the revised version to WCAG 2.2. A statutory presumption of conformity under § 4 BFSG requires the reference of a harmonized standard under the European Accessibility Act to be published in the Official Journal of the EU; until then, EN 301 549 is the central technical reference (Bundesfachstelle Barrierefreiheit). The audit combines automated tools with manual testing, because a scanner reliably finds missing alt text or insufficient contrast, but only a person judges the quality of an implementation. Six areas are central.
Perceivability
Alt text, captions and sufficient contrast. On 83.9% (WebAIM Million, 2026) of home pages contrast is too low, and on 53.1% (WebAIM Million, 2026) alt text is missing.
Operability
Full keyboard operation, a visible focus and correct form labels. Cart and checkout must be usable without a mouse.
Structure
Semantic headings, landmarks and marked-up lists. Empty links, found on 46.3% (WebAIM Million, 2026) of home pages, fail here.
Accessibility statement
The mandatory notice under Annex 3 BFSG on how the service meets the requirements, including the competent market surveillance authority.
Robustness
Compatibility with assistive technology through valid, standards-compliant markup - stable on desktop and on mobile devices alike.
Documentation
Conformity evidence and - if claimed - the written justification of a disproportionate burden under § 17 BFSG.
One point is often overlooked: protected areas behind a login also count when they are part of the service - for example the customer account of an online shop. And content coming from embedded third-party components does not relieve you of responsibility; whoever builds them into their page must ensure their accessibility. How far this responsibility reaches is set out in the article on third-party widgets and BFSG duties.
How an Audit Unfolds Step by Step
An audit does not fall from the sky but follows a traceable process. Between the first trigger and a possible enforcement order lie several stages at which operators actively take part - and at which a later sanction can still be averted. The seven steps at a glance.
- Trigger and case selection: a sample, a consumer complaint, a tip-off from a recognized body or the authority's own research brings a provider into focus.
- Initial review: automated and manual testing of the publicly accessible service against EN 301 549, plus a check of the accessibility statement.
- Information request: the authority asks for information and documents, such as the conformity assessment or the justification of a disproportionate burden. Economic operators must cooperate.
- Technical assessment and audit report: the authority identifies concrete barriers and records them clearly.
- Request to remediate: a reasonable deadline is set within which the barriers must be fixed.
- Re-check: after the deadline the authority verifies whether the corrections actually hold.
- Order and fine: if the defects remain, orders follow up to a ban on the service; fine proceedings are also possible, and results may be published.
The duty to cooperate is central: anyone who refuses information or documents risks separate sanctions, regardless of the underlying accessibility finding. Cooperation, by contrast, can shorten the procedure and create room on the deadlines - especially when part of the defects is visibly already being worked on.
Deadlines, Orders and Fines
If barriers persist after the deadline, the authority reaches for graduated measures. The overview below maps typical case groups to the possible legal consequences and the fine range under § 37 BFSG - the concrete classification and amount are always decided by the authority in the individual case.
| Case group | Possible legal consequence | Fine range |
|---|---|---|
| Service offered or provided that does not meet the requirements | Restriction or ban | up to EUR 100,000 (BFSG § 37) |
| Product placed on the market or made available that does not meet the requirements | Restriction, withdrawal or recall | up to EUR 100,000 (BFSG § 37) |
| Accessibility statement missing or incomplete | Request to remediate | up to EUR 100,000 (BFSG § 37) |
| Information or documents not provided | Order to cooperate | up to EUR 10,000 (BFSG § 37) |
Not everyone is affected to the same extent. For services there is an exemption for microenterprises with fewer than 10 employees (BFSG § 2 no. 17) and no more than EUR 2 million (BFSG § 2 no. 17) in annual turnover or balance sheet total - for physical products, however, this relief does not apply. Whether your business falls under it is clarified in the article on the microenterprise exemption in the BFSG. Anyone relying on a disproportionate burden must document it under § 17 BFSG and present it to the authority on request; which requirements apply is explained in the article on the disproportionate burden under § 17 BFSG.
The deadline is your most important resource
How to Prepare for an Audit
Preparation beats reaction. The most effective protection against the consequences of an audit is a website that already meets the requirements - and that can prove it. It starts with an honest inventory: a WCAG audit combines automated scans with manual testing and a screen reader check and delivers a prioritized list of issues that can at the same time serve as evidence towards the authority. Tools that merely simulate accessibility through a script loaded on top are best avoided; why such overlays are not a viable solution is explained in the article on accessibility overlays.
A solid audit result turns into sound preparation when six building blocks come together.
- A documented audit against WCAG 2.2 AA and EN 301 549 with a prioritized list of issues
- A complete, current accessibility statement with a working feedback channel
- Conformity documentation and - if claimed - the written justification of a disproportionate burden
- A named contact who handles information requests and the authority's deadlines
- Accessibility firmly embedded in editing, design and development so new content stays conformant
- Regular re-checks that make regressions visible early
These building blocks only hold over time when accessibility is embedded in the workflow - in accessible web development as much as in editing. A complete accessibility statement with a reachable feedback channel belongs here just as much as ongoing BFSG monitoring that surfaces regressions before they become a finding. It makes sense to begin with the structure before the details follow; our references describe our project approach. Many touchpoints of a website are in scope - from accessible appointment booking to the accessible e-invoice.
Market surveillance does not check the intention but the result. What matters is not that accessibility was planned, but that the service is usable today - demonstrable, documented and in day-to-day operation.
Ongoing market surveillance changes the calculus for operators. As long as 95.9% (WebAIM Million, 2026) of home pages carry detectable WCAG failures, the likelihood of a complaint is real - and the effort of a retrofit under time pressure regularly exceeds that of a planned implementation. Whoever tackles accessibility early not only satisfies the law in force since 28 June 2025 (Bundesfachstelle Barrierefreiheit) but also gains a larger audience and, as the article on the double lever of accessibility and SEO shows, additional visibility. The obligation thus becomes an investment - and market surveillance a calculable procedure rather than a risk. Which steps are due for your website we clarify as part of our services.
Related Articles
Keeping Accessibility: Review Cadence After Go-live
The duty does not end at acceptance. Which events trigger a re-test, which sample size holds up and how long the evidence has to stay on file.
Third-Party Widgets: BFSG Duties for Embedded Tools
Booking calendars, chat widgets and payment iframes are third-party code, yet BFSG duties stay with the operator. Evidence, testing and fallback routes.
Disproportionate Burden: Documenting the BFSG Exemption
Section 17 BFSG is no free pass but a burden of proof: how to calculate, document and notify the Annex 4 assessment and keep it on file for five years.