Germany's BFSG at One Year: What the First Wave of Enforcement Means for Every EU-Facing Business

Germany's Barrierefreiheitsstärkungsgesetz (BFSG) entered into force on 28 June 2025, implementing the European Accessibility Act (EAA) into German law for private-sector products and services. One year on, the picture is clear: enforcement is not waiting for businesses to catch up.

This post covers what has actually happened since the deadline, how Germany's enforcement model differs from the rest of the EU, and what any business selling to German - or EU - consumers needs to do right now.

What the BFSG actually requires

The BFSG applies to a wide range of private-sector economic operators: e-commerce platforms, online banking and payment services, e-book readers and software, telecoms services, and consumer terminals such as ATMs and ticketing machines. If you sell products or services to consumers in Germany in any of these categories, the law covers you - regardless of where your company is incorporated.

The technical standard that operationalises the BFSG's requirements is EN 301 549 v3.2.1, which incorporates WCAG 2.1 AA. Meeting that standard is the baseline, not the ceiling.

The microenterprise exemption is real but narrow. Businesses are exempt from BFSG service-provision obligations only if they have fewer than 10 employees AND annual turnover or balance sheet total under EUR 2 million - the EU's microenterprise threshold. Both conditions must be met simultaneously. If your company exceeds either threshold, the full obligations apply.

The penalty framework: two tracks, not one

This is where Germany diverges sharply from most other EU member states, and where many compliance teams have underestimated their exposure.

Track 1: Regulatory fines (Ordnungswidrigkeiten)

Violations of the BFSG can be treated as administrative offences (Ordnungswidrigkeiten) with fines up to EUR 100,000 for the most serious breaches, and up to EUR 10,000 for less severe violations. The severity depends on the type of violation - failing to provide the service accessibly at all, missing or incomplete documentation, or incorrect CE marking - and on how the business responds once a violation is flagged.

The regulatory body responsible is the MLBF (Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen). All 16 German federal states agreed by state treaty to centralise market surveillance into a single institution based in Magdeburg, which formally became operational on 26 September 2025. The MLBF adopted its market surveillance strategies for both products and services in January 2026 and has been in active inspection mode since then. It operates on two tracks: proactive systematic checks (often automated) and reactive complaint handling, with the reactive track taking priority.

Track 2: Competitor warning letters (Abmahnungen)

This is the mechanism that caught many businesses off guard - and it is distinctly German.

Under Germany's unfair competition law (UWG), failing to meet a statutory accessibility duty can be pleaded as an unfair competitive advantage. That means competitors, trade associations, and consumer organisations can send a formal warning letter (Abmahnung) demanding a cease-and-desist declaration and costs - without any regulator being involved.

Within six weeks of the BFSG taking effect, the first Abmahnungen alleging BFSG violations had already been sent to online shops. The letters were issued on behalf of a website operator represented by CLAIM Rechtsanwalts GmbH, and a large number of similar letters followed. The initial wave was characterised by blanket allegations - a screenshot of the recipient's website, a claim that it was "not accessible," and a demand for compliance plus a fee. A second, more sophisticated wave began in early 2026, backed by formal audit reports from external accessibility testing providers.

The cost exposure from a single Abmahnung is not trivial. Reported costs per letter range from EUR 3,500 to EUR 20,000 including legal and analysis fees, before any court proceedings.

How Germany compares to the rest of the EU

Germany's dual-track model - regulatory fines plus competitor litigation - is comparatively unusual. Elsewhere in the EU, enforcement has followed a more centralised, regulator-led pattern.

France moved fastest on the civil society side. Formal legal notices were sent to Auchan, Carrefour, E.Leclerc, and Picard in July 2025, days after the EAA took effect. When those retailers failed to respond adequately, disability rights organisations filed emergency injunctions in November 2025. In June 2026, the Tribunal judiciaire de Caen ordered Carrefour to bring both its website and mobile app to full accessibility within six months, with a penalty of EUR 500 accruing for every day it misses that deadline - the first compliance order under any EAA national transposition to cover a mobile app explicitly. A parallel case against Auchan was dismissed on a domestic revenue threshold, though that decision is under appeal.

Sweden's Post and Telecom Authority (PTS) began inspecting laptops, smartphones, and tablets in October 2025 and opened its first e-commerce regulatory cases, receiving 124 public complaints in the process. PTS has since confirmed that systematic e-commerce platform inspections are continuing through 2026.

The Netherlands set a mandatory self-reporting deadline of 15 October 2025 for non-conforming businesses. The Dutch Consumer and Market Authority (ACM) has sent information requests to e-commerce operators globally - including companies with no EU office - and is auditing those that stayed silent. Active enforcement decisions are expected in the second half of 2026.

The key difference: in France, Sweden, and the Netherlands, enforcement pressure comes primarily from regulators and civil society organisations. In Germany, it can come from a direct competitor - and it can arrive within weeks of a violation being visible online.

What this means if you're not a German company

The EAA applies to any business selling covered products or services to EU consumers, regardless of where the company is incorporated. The Dutch ACM has already sent information requests to companies with no EU office. The French court ruling against Carrefour covered a website that predates the EAA by decades - the court gave it six months to comply, not the five-year transition period that some businesses had been relying on.

Germany's Abmahnung mechanism adds a further dimension. If your e-commerce site, banking app, or digital service is accessible to German consumers and fails to meet WCAG 2.1 AA, a German competitor or association can send you a cease-and-desist letter. The geographic reach of that mechanism is not limited to German-incorporated businesses.

The practical implication: non-compliance risk is not a matter of waiting for a regulator to find you. It can arrive as a letter from a law firm within weeks of your non-compliance becoming visible - and the clock starts from 28 June 2025, not from when you first heard about the BFSG.

Is your business actually in scope? Use this decision tool

The readiness checklist: what to have in place now

If your business is in scope, the following items are not optional. They are also the first things an Abmahnung sender or a market surveillance inspector will look for.

1. Accessibility statement The BFSG requires service providers to publish an accessibility statement describing their conformance status, known gaps, and how users can report barriers. The statement must itself be accessible. It must name the competent market surveillance authority (the MLBF). A statement prepared in 2025 and never updated is not a current statement - regulators and courts can tell.

2. WCAG 2.1 AA conformance EN 301 549 v3.2.1, which incorporates WCAG 2.1 AA, is the current harmonised standard. Conformance must cover the full user journey - not just the homepage. For e-commerce, that means the product page, cart, checkout, and account management flows. For banking, it means every transaction path. Partial conformance (the Carrefour case showed that 71% is not enough) is not a defence.

3. Technical documentation Manufacturers of in-scope products must maintain technical documentation demonstrating how their product meets the accessibility requirements. For service providers, the equivalent is a documented conformance record - audit reports, test results, and remediation logs - that you can produce if asked.

4. Feedback and complaints mechanism Users must be able to report accessibility barriers and receive a response. This mechanism must itself be accessible. Document every complaint received and how it was handled.

5. Ongoing monitoring Accessibility is not a one-off audit. New features, content updates, and third-party integrations can all introduce regressions. Build accessibility testing into your release process, not just your annual review cycle.

The enforcement trajectory from here

One year in, no EAA-transposition fine has been publicly confirmed anywhere in the EU. That fact is being misread by some compliance teams as a signal that enforcement is slow. It is not.

The first year produced precedent and pressure rather than penalties. The Carrefour ruling is a court order, not a fine - and in some respects it is a more powerful instrument, because non-compliance after the six-month deadline triggers daily accumulating penalties. The MLBF in Germany has been in active inspection mode since January 2026. A second, more professional wave of Abmahnungen - backed by formal audit reports rather than screenshots - began circulating in early 2026. Industry analysts expect systematic automated scanning by both law firms and consumer organisations to intensify through the second half of 2026.

The businesses that treated June 2025 as a finish line are now the ones receiving letters. The businesses that treated it as a starting point are in a materially better position - not because enforcement has been lenient, but because documented, ongoing compliance is the only credible defence against both tracks.