BFSG compliance — what German accessibility enforcement means in practice
Germany's implementation of the European Accessibility Act took effect in June 2025. Law firms moved before regulators. The exposure is live regardless of whether you've heard from any authority.
The Barrierefreiheitsstärkungsgesetz (BFSG) is Germany's implementation of the European Accessibility Act. It has applied since 28 June 2025. Within weeks, the first private warning letters (Abmahnungen) began arriving at businesses with consumer-facing digital products and services. We tracked who is sending them and what the letters contain through the first year.
Which businesses the BFSG covers
The BFSG applies to the products and services the European Accessibility Act lists. On the services side, provided to consumers in Germany, that means e-commerce, consumer banking, electronic communications, access to audiovisual media, elements of passenger transport services and e-books. The law is not limited to e-commerce.
Microenterprises providing services (fewer than 10 persons, and an annual turnover or balance sheet total not exceeding €2 million) are exempt. The exemption does not cover products.
What an Abmahnung is
An Abmahnung is not a notification. It is a demand. Under German competition law (UWG), any competitor or law firm can send an Abmahnung when they identify a legal violation. No regulator needs to be involved.
An Abmahnung demands:
- Immediate cessation of the alleged violation
- A signed declaration of future compliance: with a contractual penalty clause if breached again
- Reimbursement of the sender's legal costs: typically €1,000–3,000 per letter
Ignore it and the case goes to court. It is a self-funding private enforcement mechanism, and the exposure is live regardless of whether you have heard from the market surveillance authority or anyone else.
Direct competitors are the most common sender. Under German competition law, if your competitor is compliant and you are not, your non-compliance gives you an unfair cost advantage. That makes it actionable. There is no limit on the number of Abmahnungen a business can receive.
The enforcement timeline
The first Abmahnungen arrived within six weeks of the BFSG taking effect. By the end of 2025, letters were arriving across Germany in steady numbers, and the volume intensified through Q1 2026. A second wave of letters is now emerging, from different law firms and with attached accessibility audit reports. It is more legally substantive than the early letters.
The market surveillance authority, the MLBF, has been operational since 26 September 2025. We have found no fine or named case from it. Germany amended its implementing rules in July 2026 (BGBl. 2026 I Nr. 205, in force 16 July 2026) in response to a European Commission infringement procedure.
The pressure is increasing, not easing.
What the MLBF can impose
Separately from any Abmahnung, the MLBF can impose fines of up to €100,000 under §37 BFSG. This is entirely independent of the private enforcement track. A business can face both simultaneously.
What is coming in Q3 and Q4 2026
The Abmahnung risk is increasing, not stabilising. Industry analysts and specialist law firms are predicting the systematic deployment of automated scanning tools from Q3 2026 onwards, enabling law firms and competitors to identify accessibility violations at scale across thousands of websites simultaneously. Organisations that have not addressed accessibility before that point face a significantly higher probability of receiving a warning letter.
The pattern mirrors what happened with cookie consent enforcement: early letters were legally thin and easily challenged, but the volume and legal quality increased steadily as law firms refined their approach. BFSG is following the same trajectory. The window for addressing compliance proactively, before automated scanning begins in earnest, is narrowing.
The cookie consent parallel
The pattern is familiar to anyone who watched cookie consent enforcement unfold. Law firms moved first there too, sending Abmahnungen for missing cookie banners before regulators had issued a single fine. By the time regulatory cases arrived, the market had already been reshaped: businesses had paid legal costs, signed compliance declarations, and updated their sites. The mechanism is identical here, and the same law firms are already using it.
A nuance worth knowing
Specialist firms including Heuking assessed the early BFSG letters as legally weak, being blanket allegations without specific evidence of which functions were inaccessible. But legally weak does not mean cost-free. Recipients still have to engage a lawyer to respond, and the compliance declaration carries its own contractual penalty clause if later breached. And the second wave of letters, with attached audit reports, is more substantive.
What compliance requires
BFSG compliance comes down to the same four areas of work as EAA compliance generally: technical conformance (in practice, EN 301 549 and WCAG 2.1 AA), accessibility information given in your general terms and conditions or in another clearly perceptible way, active governance, and documentary evidence of ongoing management.
Find out where you stand
One conversation gives you a clear picture of your legal position, your biggest risks, and what a proportionate first step looks like. No obligation.
Book your free assessment today