Accessibility laws · Germany

Germany: BFSG (Accessibility Strengthening Act)

The biggest accessibility risk for a business in Germany right now is not the regulator. It is a competitor. German unfair competition law lets a rival send you an Abmahnung, which is a cease-and-desist demand with its legal costs attached. Specialist reports say those letters rose sharply through late 2025 and kept climbing into 2026. Meanwhile the state market surveillance authority, the MLBF, has been running since September 2025 and moved into active control in January 2026, with fines to €100,000 on the books. As of July 2026, no MLBF fine had been publicly documented.

Maximum fine: €100k
Via EN 301 549: 2.1 AA
16-state enforcement body: MLBF
Active enforcement began: Jan 2026

What the law is

The Barrierefreiheitsstärkungsgesetz, the BFSG or Accessibility Strengthening Act, is how Germany wrote the European Accessibility Act into its own law. Since June 28, 2025 it has covered consumer-facing services in Germany. The list runs to e-commerce, banking services for consumers, telecommunications, e-books and their reading software, and parts of air, bus, rail and ship passenger transport. It also covers products, including consumer computers and operating systems, payment terminals, ATMs, ticket and check-in machines, and e-book readers. The German law defines accessible in its own words rather than by pointing at a standard, and the definition is worth hearing. A product or service is accessible when people with disabilities can find it, reach it and use it in the generally customary way, without particular difficulty, and in principle without help from anyone else. Without help from anyone else. That is the legal test a German authority applies, and it is broader than any checklist.

WCAG 2.1 Level AA is not legally mandatory in Germany, which is the part almost everybody gets wrong. The BFSG never names WCAG at all. What it does, in section 4, is create a presumption of conformity. Follow a harmonized standard whose reference has been published in the Official Journal of the European Union and you are presumed to meet the statutory requirement. For web content that standard is EN 301 549, currently version V3.2.1. It was published in March 2021, cited in the Official Journal in August 2021, and it maps the WCAG 2.1 Level A and AA success criteria. So conforming to WCAG does not make you immune. It makes you defensible, which is a different and much more useful thing.

Germany built an actual authority under all this, which most member states did not. The Marktüberwachungsstelle der Länder für die Barrierefreiheit, the MLBF, is a joint body of all 16 German states, seated in Magdeburg. It began work in September 2025, and its administrative council adopted the market surveillance strategies on January 29, 2026. It works two ways, reactively through complaints and actively through systematic and often automated checks, and it says the complaints route takes precedence. Its stated priorities are services with high user reach, services that matter for living independently, and providers with a history of defects. Two things we will not dress up. The authority's own site was unreachable every time we tried it. So the staff numbers and the exact September start date quoted elsewhere are not ours to hand you. And Germany is under a European Commission infringement procedure for incomplete transposition of the directive, which reached the reasoned opinion stage, the formal step before a referral to the Court of Justice. We could not confirm the 2026 date that gets attached to it. German commentary expects the BFSG to be tightened as a result.

This applies to you if…

You offer one of the covered services to consumers in Germany, whatever country your company sits in. A foreign online store selling into the German market is in scope on the same terms as a German one. The covered list is e-commerce, banking services for consumers, telecommunications, e-books and their software, and parts of air, bus, rail and ship passenger transport.
You employ 10 or more people and you offer something on the covered list, in which case no size exemption is going to save you. Read those two the right way round. Headcount does not put you in scope. Selling something on the covered list does. Headcount only decides whether you get back out. The microenterprise exemption needs two things to be true at the same time. You employ fewer than 10 people, and either your annual turnover or your annual balance sheet total is at most €2 million. Either figure on its own satisfies the money half. So a business with eight staff, €2.5 million of turnover and a €1 million balance sheet total is still a microenterprise, and still exempt. Section 3(3) then takes microenterprises that offer or provide services out of the accessibility requirement entirely.
You sell one of the covered products rather than a service, in which case the microenterprise exemption does not reach you. A nine-person company selling e-book readers carries the full duty. The BFSG is a product safety statute that happens to include services, and sections 6 to 15 put separate obligations on manufacturers, authorized representatives, importers and distributors. If you make hardware, that chain is the part to read.

What it technically requires

You need to meet EN 301 549, which in practice means WCAG 2.1 Level AA for your website and your apps. A revision that moves the web clauses to WCAG 2.2 is drafted and working through ETSI's process, with no published version number and no date behind it. Testing against WCAG 2.2 Level AA now buys you a margin that will still be there when the standard catches up. One asterisk, and it is the same one everywhere a law names an older edition. WCAG 2.2 dropped success criterion 4.1.1 Parsing. Everything else in 2.1 is still there, with a handful more on top.
Section 14 says you may only offer a service if it meets the requirements and the information in Annex 3 has been produced and made publicly available in accessible form. Annex 3 wants you to state your accessibility compliance in your general terms and conditions, or in another clearly perceptible place. So the terms of service is one option, not the only one. The information has to describe the service, explain what somebody needs to understand how it is delivered, and say how it meets the accessibility requirements of the implementing regulation. It also has to identify the responsible market surveillance authority. That last item catches people out. Germany wants the regulator named inside your own accessibility information, and its guidance takes that as far as the contact details.
You have to keep the requirements met continuously, keep the information for as long as you offer the service, and report yourself if you slip. Section 14(4) says a provider who finds its own service is not conforming must tell the market surveillance authority without delay. That report has to say what the defect is and what has been done about it. Read that twice. Discovering your own problem starts a clock with the regulator, not a quiet internal ticket.
Know how far that presumption actually carries you, because section 4 puts the limit inside its own sentence. You are presumed compliant only so far as the requirements are covered by the standard you followed, or by the parts of it you followed. EN 301 549 covers web content in clause 9, so a site at WCAG 2.1 Level AA is presumed compliant on the web and presumed nothing at all about the rest of the law. Section 5 opens a second door of exactly that shape, for technical specifications adopted by the European Commission. Underneath both of them sits section 3, and that is the duty itself. A presumption gets you a long way. It is not the thing you are being measured against.
You have to keep documentation ready for the MLBF to ask for at any time. It should show how the service meets the requirements, and what you did about anything that was found. Germany does have a route out, in sections 16 and 17, and it costs more than most people expect. Section 16 covers fundamental alteration and section 17 covers disproportionate burden. Claiming either means documenting the assessment and keeping it for five years, redoing it at least every five years, and redoing it early whenever the service changes or the regulator asks. One line catches people out. Take public or private money to improve accessibility and you lose the disproportionate burden defence entirely, so a grant that funds the work also removes the excuse for not doing it. The full account is in our guide to the cost defence.
If you do claim the disproportionate burden, Annex 4 tells you what the assessment is made of, and it turns out to be arithmetic rather than argument. Three ratios decide it. The net cost of compliance against your total operating and investment costs for making, distributing or importing the product, or for providing the service. The estimated costs and benefits to you against the estimated benefit to people with disabilities, weighed by how many people use the thing and how often. And the net cost of compliance against your net turnover. Annex 4 then itemizes what you are allowed to put on the cost side, which is more generous than most owners assume. One-off costs cover hiring accessibility expertise, training your own staff, building a new process that designs accessibility in, writing internal guidance, and getting to grips with the legal position for the first time. Running costs cover planning the accessibility features, the production process itself, testing, and writing the documentation. Learning the law is a cost you may count.

All roads lead to WCAG. Start with Level AA, the legal standard or the full 55-rule library. Unfamiliar term along the way? The A to Z glossary decodes it.

This law expects a published accessibility statement, and regulators check for it first. Generate yours free →

How it is enforced

Start with the risk that is actually landing. German unfair competition law lets a competitor issue an Abmahnung, a cease-and-desist demand that arrives with its legal costs attached, for a breach that gives you a competitive advantage. An inaccessible site qualifies on that theory. The accessibility specialists at axes4 report those letters rose significantly in late 2025 and accelerated through the first quarter of 2026. Nobody publishes a count, so treat that as reported rather than measured. For a German business the practical order of risk runs competitor first, conciliation second, regulator last.

Section 34 sends disputes to conciliation before the Schlichtungsstelle set up under the Behindertengleichstellungsgesetz. Three kinds of complainant can start it, a consumer who says a business has breached the BFSG, a recognized disability association, and a qualified entity under the injunctions act. The market surveillance authority can be brought in on request. And the proceedings section 32 covers are stayed until the conciliation ends, so that particular route pauses rather than running alongside it. It does not put every other process on hold.

The MLBF itself escalates in steps rather than fining on sight. Section 30 says it first tells you to correct the problem within a reasonable period. If that fails it repeats the demand, this time with an express threat of prohibiting the service, and gives you another reasonable period. Only then does it take the necessary measures, which can mean keeping the service out of the German market altogether. Section 37 sets the fines. Services sit in the top band. Offering or providing a non-conforming service is one of the categories carrying up to €100,000, rather than the €10,000 that applies to the rest.

And the honest part. As of July 2026 no individual MLBF fine had been publicly documented. Absence of a published fine is not proof that none exists. Section 31 requires the authority to tell the public about its work and its decisions in an accessible way, so a public record should build over time. What that means for you today is that the €100,000 number is real law and not yet a real invoice.

Key dates

Jun 28, 2025BFSG applies: covered services must conform
Sep 2025MLBF, the joint market-surveillance authority, starts operating
Jan 2026Active enforcement phase begins
Jun 27, 2030End of transition for pre-existing service contracts

What to do about it

Every obligation on this page is measured against WCAG, so the first step is knowing where you actually stand. Run the free 10-page scan for the machine-checkable slice. For the rest, we review the key journeys with an expert and a real blind screen-reader user, then attach a screenshot and a fix to every finding. $499, 5 business days.

Order your audit Run the free scan

This law does not set the web requirement itself. It points at EN 301 549, the European accessibility standard, and that is where the requirement actually lives. Clause 9 of the standard carries WCAG 2.1 Level AA, so a site that already meets Level AA has met the web part of it. The rest of the standard covers ground WCAG never touches, including hardware, two-way voice, documents that are not web pages, and the support channels a customer reaches once the site has already failed them. Several countries adopt the standard under their own national designation, which carries the same requirements under a different name.

Primary sources

Other laws

Related on this site

What to read next, and the terms this page uses.

Orientation only, current as of August 2026. Not legal advice, and no attorney-client relationship is created. For your specific situation, talk to your own lawyer.