Since 28 June 2025 (Bundesfachstelle Barrierefreiheit), the German Accessibility Act (BFSG) has obliged large parts of digital consumer business to be accessible - from online shops and booking portals to banking and e-book services. A year on, the picture has shifted: the initial leniency is over, the market surveillance authorities of the German states have been in the active enforcement phase since early 2026 (ehome-news, 2026), and the level of implementation in the market averages only around 49% (itiko, 2026). For operators this means an audit is no longer an abstract possibility but a concrete procedure with deadlines, orders and fines of up to EUR 100,000 (BFSG § 37). This guide explains step by step who audits, what is checked, how the procedure unfolds - and how a structured WCAG audit makes you audit-ready.
Key takeaways
- For services, the market surveillance body of the German states (MLBF) in Magdeburg checks nationwide; for physical products, the authorities of the individual states.
- Triggers are sampling, consumer complaints, tip-offs from recognized bodies or the authority's own research - not only competitor warnings.
- Testing is against the harmonized standard EN 301 549, which adopts the WCAG success criteria at level AA for web content, along with the accessibility statement.
- The procedure is staged: information request, audit report, a reasonable deadline to remediate, and only then an order and a fine.
- The range runs up to EUR 100,000 (BFSG § 37) for serious violations and up to EUR 10,000 (BFSG § 37) for information and documentation duties; a ban on the service can be added.
- The gap is wide: 95.9% (WebAIM Million, 2026) of home pages carry WCAG failures, on average 56.1 (WebAIM Million, 2026) per page - an audit finds a target almost everywhere.
Who Audits: the Market Surveillance of the States
Enforcement of the BFSG lies with the German states, not the federal government. For the many consumer services in scope - including online shops and all of electronic commerce - the 16 states have created a joint body by state treaty: the market surveillance body of the states for the accessibility of products and services (MLBF), based in Magdeburg. It concentrates oversight for all of Germany in one place, so that a provider is not audited by sixteen authorities in parallel. For physical products such as self-service terminals, payment machines or e-book readers, the market surveillance authorities of the individual states remain responsible.
The legal background is European Directive (EU) 2019/882, the European Accessibility Act, which the BFSG transposes into German law (European Commission). The authorities work along the principles of market surveillance familiar from product safety law: risk-based, by sampling and reactive to complaints. Since early 2026 they have been in the active enforcement phase (ehome-news, 2026) - the initial restraint, in which many businesses still treated the deadline as a mere announcement, is over. How enforcement and legal risks look overall is explored in the article on BFSG enforcement and its legal risks.
Market surveillance is not a competitor warning
What the Authority Checks
The yardstick is not a subjective impression but the harmonized European standard EN 301 549. It translates the BFSG requirements into technically testable criteria and, for web content, adopts the success criteria of the Web Content Accessibility Guidelines (WCAG) at level AA. Meeting this standard confers the statutory presumption of conformity. The audit combines automated tools with manual testing, because a scanner reliably finds missing alt text or insufficient contrast, but only a person judges the quality of an implementation. Six areas are typically in focus.
Perceivability
Alt text, captions and sufficient contrast. On 83.9% (WebAIM Million, 2026) of home pages contrast is too low, and on 53.1% (WebAIM Million, 2026) alt text is missing.
Operability
Full keyboard operation, a visible focus and correct form labels. Cart and checkout must be usable without a mouse.
Structure
Semantic headings, landmarks and marked-up lists. Empty links, found on 46.3% (WebAIM Million, 2026) of pages, fail here.
Accessibility statement
The mandatory notice on how the service meets the requirements, including a feedback channel and a reachable point of contact for users.
Robustness
Compatibility with assistive technology through valid, standards-compliant markup - stable on desktop and on mobile devices alike.
Documentation
Conformity evidence and - if claimed - the written justification of a disproportionate burden under § 17 BFSG.
One point is often overlooked: protected areas behind a login also count when they are part of the service - for example the customer account of an online shop. And content coming from embedded third-party components does not relieve you of responsibility; whoever builds them into their page must ensure their accessibility. How far this responsibility reaches is set out in the article on third-party widgets and BFSG duties.
How an Audit Unfolds Step by Step
An audit does not fall from the sky but follows a traceable process. Between the first trigger and a possible enforcement order lie several stages at which operators actively take part - and at which a later sanction can still be averted. The seven steps at a glance.
- Trigger and case selection: a sample, a consumer complaint, a tip-off from a recognized body or the authority's own research brings a provider into focus.
- Initial review: automated and manual testing of the publicly accessible service against EN 301 549, plus a check of the accessibility statement.
- Information request: the authority asks for information and documents, such as the conformity assessment or the justification of a disproportionate burden. Economic operators must cooperate.
- Technical assessment and audit report: the authority identifies concrete barriers and records them clearly.
- Request to remediate: a reasonable deadline is set within which the barriers must be fixed.
- Re-check: after the deadline the authority verifies whether the corrections actually hold.
- Order and fine: if the defects remain, orders follow up to a ban on the service, along with fine proceedings; results may be published.
The duty to cooperate is central: anyone who refuses information or documents risks separate sanctions, regardless of the underlying accessibility finding. Cooperation, by contrast, shortens the procedure noticeably and creates room on the deadlines - especially when part of the defects is visibly already being worked on.
Deadlines, Orders and Fines
If barriers persist after the deadline, the authority reaches for graduated measures. The overview below maps typical case groups to the possible legal consequences and the fine range under § 37 BFSG - the concrete classification and amount are always decided by the authority in the individual case.
| Case group | Possible legal consequence | Fine range |
|---|---|---|
| Service still offered without accessibility despite an order | Restriction or ban | up to EUR 100,000 (BFSG § 37) |
| Failure to comply with the authority's order | Enforcement, coercive measures | up to EUR 100,000 (BFSG § 37) |
| Accessibility statement missing or incomplete | Request to remediate | up to EUR 10,000 (BFSG § 37) |
| Information or documents not provided | Order to cooperate | up to EUR 10,000 (BFSG § 37) |
Not everyone is affected to the same extent. For services there is an exemption for microenterprises with fewer than 10 employees (BFSG § 3) and no more than EUR 2 million (BFSG § 3) in annual turnover or balance sheet total - for physical products, however, this relief does not apply. Whether your business falls under it is clarified in the article on the microenterprise exemption in the BFSG. Anyone relying on a disproportionate burden must document it under § 17 BFSG and present it to the authority on request; which requirements apply is explained in the article on the disproportionate burden under § 17 BFSG.
The deadline is your most important resource
How to Become Audit-Ready
Preparation beats reaction. The most effective protection against the consequences of an audit is a website that already meets the requirements - and that can prove it. It starts with an honest inventory: a WCAG audit combines automated scans with manual testing and a screen reader check and delivers a prioritized list of issues that at the same time serves as evidence towards the authority. Tools that merely simulate accessibility through a script loaded on top are best avoided; why such overlays are not a viable solution is explained in the article on accessibility overlays.
A solid audit result turns into audit-readiness when six building blocks come together.
- A documented audit against WCAG 2.2 AA and EN 301 549 with a prioritized list of issues
- A complete, current accessibility statement with a working feedback channel
- Conformity documentation and - if claimed - the written justification of a disproportionate burden
- A named contact who handles information requests and the authority's deadlines
- Accessibility firmly embedded in editing, design and development so new content stays conformant
- Regular re-checks that make regressions visible early
These building blocks only hold over time when accessibility is embedded in the workflow - in accessible web development as much as in editing. A complete accessibility statement with a reachable feedback channel belongs here just as much as ongoing BFSG monitoring that surfaces regressions before they become a finding. In our reference projects, safeguarding almost always begins with the structure before the details follow; and many touchpoints of a website are in scope - from accessible appointment booking to the accessible e-invoice.
Market surveillance does not check the intention but the result. What matters is not that accessibility was planned, but that the service is usable today - demonstrable, documented and in day-to-day operation.
The active enforcement phase changes the calculus for operators. As long as only around 49% (itiko, 2026) of the requirements are implemented in the market and 95.9% (WebAIM Million, 2026) of home pages carry detectable WCAG failures, the likelihood of a complaint is real - and the effort of a retrofit under time pressure regularly exceeds that of a planned implementation. Whoever tackles accessibility early not only satisfies the law in force since 28 June 2025 (Bundesfachstelle Barrierefreiheit) but also gains a larger audience and, as the article on the double lever of accessibility and SEO shows, additional visibility. The obligation thus becomes an investment - and market surveillance a calculable procedure rather than a risk. Which steps are due for your website we clarify as part of our services.