The Documented Excuse: Why the Exemption in Europe's Accessibility Law Saves No Work but Relocates It – and Why the Duty to Track Standard Revisions Currently Points at a Standard That Does Not Yet Legally Exist

The Hook: The Exemption That Becomes a File

Picture a mid-sized company running an online shop. Forty employees, a solid business, a shop system that has grown over ten years with a bolted-on editorial section, a product configurator from an agency era nobody wants to own any more, and roughly four thousand product pages, an unknown share of which contain images without alternative text.

In the spring of 2025, someone in management asks what this BFSG everyone is talking about actually means. The answer from IT comes in a form that has probably been given a thousand times this year: making the shop fully accessible would be a project spanning several quarters, there is no budget for it, and surely there is that exemption for disproportionate burden. So the company invokes it, prioritises something else, and waits.

What gets overlooked here is not how narrow the exemption is. It is how the exemption is built. Anyone invoking disproportionate burden does not leave the scope of the Act – they enter a procedure. Under § 17(1) sentence 2 BFSG they must carry out an assessment. Under § 17(2) they must document it, keep it for five years and provide the authority with a copy on request. Under § 17(3) they must, for services, renew it at least every five years. Under § 17(5) they must notify the competent authority without undue delay that they are invoking it. And under § 28(3) the authority then examines not only whether the assessment exists, but the assessment itself, including the proper application of the criteria in Annex 4.

So the exemption saves no work. It relocates it: from implementation to proof. And it produces a document carrying retention, renewal and notification duties – a document whose release any consumer may request from the authority under § 28(4) BFSG, subject to a confidentiality limit one should not rely on, as Part 4 shows.

Doing nothing, by contrast, does not automatically forfeit the exemption: § 17(1) sentence 1 is phrased objectively, and the accessibility requirements apply of their own accord only to the extent that compliance would not impose a disproportionate burden. What a company without an assessment loses is any ability to demonstrate that – and with it, it lands in practice within the offence of § 14(1) BFSG, a breach of which falls, via § 37(1) no. 8, into the fine tier of up to EUR 100,000.

This article reads the German Accessibility Strengthening Act and the directive behind it not as a catalogue of design rules but as what they actually are for a software architecture: a requirement of provability, of version tracking, and of whether your system can say, for every piece of content it serves, where that content came from and when it was last changed.

Part 1: The Core Concept – Accessibility as Product Law

A market-access statute, not an anti-discrimination statute

The decisive classification is not in the wording of the Act but in its construction. The BFSG is the German transposition of Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70). In structure and vocabulary it is a product safety statute: it knows economic operators, manufacturers, importers, distributors, conformity assessment, technical documentation, EU declarations of conformity, CE marking, market surveillance and administrative fines.

That is not a formality but the single most important practical fact about the Act. It does not primarily grant an individual user a claim against the provider that one would have to wait for. It prohibits the economic operator from placing a non-accessible offering on the market at all. § 3(1) BFSG puts this in a single sentence: products that an economic operator makes available on the market, and services it offers or provides, must be accessible. What "accessible" means in concrete terms is not in that sentence – § 3(2) refers that question to a regulation, and the most interesting part of the whole regime hangs on that onward reference, as Part 5 will show.

For services, § 14(1) BFSG turns this into a prohibition subject to permission. The service provider may offer or provide its service only if the service meets the accessibility requirements of the regulation under § 3(2) and if the provider has prepared the information under Annex 3 no. 1 and "made it available to the general public in an accessible form". Both conditions are cumulative, and both sit in the same offence. A technically exemplary shop without a publicly accessible accessibility statement breaches § 14(1) just as a barrier-ridden shop with an exemplary statement does – in terms of the offence and the applicable fine range, at least; this says nothing about the amount of a fine or the remedial measures in an individual case.

On top of this comes an ongoing duty that nearly always gets lost in the debate about the 28 June 2025 cut-off. § 14(3) BFSG requires that the requirements be met "at all times" and expressly obliges the provider to take due account of three kinds of change: changes in the manner in which the service is provided, changes in the applicable accessibility requirements, and – in the statute's own words – changes to the harmonised standards or technical specifications "referred to in the declaration that the service conforms with the accessibility requirements". That closing relative clause is the catch: the duty to keep up attaches to precisely the standard you invoked in your own declaration of conformity. Accessibility is therefore not a project milestone. It is a state that must be maintained against a reference you yourself have named.

The key dates

Two details in this table deserve attention, because they show that the German transposition is not simply a translation.

First, self-service terminals. Art. 32(2) EAA is an option: Member States may provide that terminals lawfully used before 28 June 2025 continue to be used until the end of their economically useful life, "but no longer than 20 years after their entry into use". Germany used the option but shortened the cap: § 38(2) BFSG permits continued use until the end of the terminal's economically useful life, but no longer than fifteen years after it was put into use. Both provisions combine the same double condition and attach to the same cut-off date, so the comparison holds. Five years less than the directive would allow. Anyone operating a fleet of payment, ticketing or information terminals in Germany is therefore working with a narrower window than a glance at the directive suggests.

Second, the arithmetic of the deadlines. Art. 32(1) EAA speaks of a transitional period "ending on 28 June 2030" and of legacy contracts that may continue "no longer than five years from that date" – counted from 28 June 2025. § 38(1) BFSG instead names 27 June 2030, twice. In practice that is a difference of one day, and it is the German day that counts: in Germany § 38(1) applies, and the directive's deadline binds the Member State, not the service provider. Anyone copying an exit date out of the directive is calculating their legacy contract twenty-four hours too long.

Part 2: Scope – and What of It Depends on Metadata

Products and services

§ 1(2) BFSG covers products placed on the market after 28 June 2025: consumer general-purpose computer hardware systems and their operating systems; self-service terminals – payment terminals unconditionally, and ATMs, ticketing machines, check-in machines and interactive information terminals insofar as they are intended for the provision of services covered by the Act, with the exclusion for terminals installed as integrated parts of vehicles, aircraft, ships and rolling stock attaching only to the interactive information terminals; consumer terminal equipment with interactive computing capability used for telecommunications services; the same for audiovisual media services; and e-readers.

§ 1(3) BFSG covers services provided to consumers after 28 June 2025: telecommunications services, excluding transmission services used for machine-to-machine communication; certain elements of air, bus, rail and waterborne passenger transport services, excluding urban, suburban and regional transport services; consumer banking services; e-books and dedicated software; and e-commerce services.

The last point is the one that affects most companies. "E-commerce services" is not a niche; it is in practice any sale to consumers via a website or app. And that classification is easy: a consumer online shop is an e-commerce service, with no need to look inside any system.

The exemptions in § 1(4) are an architectural requirement

Things get more complicated one level down. § 1(4) BFSG excludes certain content of websites and mobile applications – inside an offering that remains in scope as a whole:

• pre-recorded time-based media published before 28 June 2025,
• office file formats published before 28 June 2025,
• online maps and mapping services, provided that for maps intended for navigational use, essential information is provided in an accessible digital form,
• third-party content that is neither funded nor developed by, nor under the control of, the economic operator concerned,
• content qualifying as archives, meaning content that is neither updated nor edited after 28 June 2025.

Three of these five exemptions attach to a property a system must know about the content; the maps exemption attaches instead to a substantive condition, and the third-party exemption to a question of attribution. The three properties are:

1. Date of publication per media object and per office document – not the import date, not the date of the last migration, but the date of publication.
2. Provenance and control per content component – funded, developed or controlled in-house, or by a third party? An embedded review widget, a map excerpt, a partner feed fall on different sides of this line, and not according to where the code runs but according to who is responsible for the content.
3. Date of the last update or edit per archived item – because the archive exemption presupposes that the content remains untouched after 28 June 2025.

Here the inference matters, and it is weaker than it first appears. Anyone who cannot answer these questions per object from their own system can still establish perfectly well that their offering falls under the Act – and they can also become compliant simply by making everything accessible. What they cannot do is invoke the exemptions in § 1(4). The price of missing metadata is therefore not legal uncertainty about applicability, but forfeiting every content-level relief: every item must then be treated as if it were in scope. That is a permissible strategy. With four thousand product pages and a document archive that has grown over years, it is an expensive one.

A practical side effect of the archive rule is an uncomfortable asymmetry: maintenance costs you the exemption. An HTML archive article from 2019 that nobody touches stays out. The same article, with a phone number corrected in 2027, comes in, because it has then been edited after the cut-off. This creates an incentive to freeze old content rather than correct it – an incentive the Act itself does not address, and one that returns at the end as the reflection question. Incidentally, for a PDF from 2019 two exemptions apply at once: as an office format published before the cut-off and as archive content. If something in it is changed in 2027, both grounds fall away. Whether a single correction affects the archive status of an entire holding or only of the changed object is not stated expressly in the text; this article assumes the per-object reading.

Part 3: The Three Exemptions and Their Prices

The Act offers three ways out of the full requirement. They differ sharply, and in practice they are constantly confused.

The last row is finer than it looks, and the differences are deliberate. § 16(4) exempts microenterprises dealing with products from the documentation and notification duties but, on its wording, leaves the copy duty of subsection 2 sentence 2 intact. § 17(2) sentence 3, by contrast, exempts documentation and copy – while § 17(2) sentence 4 obliges those same undertakings to transmit the facts relevant to the assessment to the authority on request. And § 17(5) sentence 2 reads simply that sentence 1 does not apply to microenterprises – without the product qualifier the other reliefs carry. In practice this too comes down to products, because microenterprises providing services are already fully outside under § 3(3); but the restriction is not in the wording.

The sharp edge for microenterprises

§ 2 no. 17 BFSG defines a microenterprise as an undertaking which employs fewer than ten persons and which either has an annual turnover of no more than EUR 2 million or an annual balance sheet total of no more than EUR 2 million. Art. 3 no. 23 EAA is substantively identical. The headcount threshold is a conjunction, the financial threshold a disjunction: fewer than ten persons and one of the two financial criteria.

What matters is the cut of the exemption. § 3(3) BFSG states that subsection 1 does not apply to microenterprises offering or providing services. Art. 4(5) EAA is just as explicit, covering only "microenterprises providing services". For products there is no corresponding exemption. A company with eight employees running an online shop is exempt from the service obligation. The same company manufacturing or importing an e-reader or an information terminal is fully bound – and, via § 16(4) and § 17(2) sentence 3 and (5) sentence 2, is relieved only of parts of the documentation, copy and notification burden, not of the substantive requirement. Anyone relying on the microenterprise rule must therefore first check whether their offering is, in law, a service or a product – not how big they are.

The criteria of Annex 4 – and what they are not

Annex 4 BFSG (relating to §§ 17, 21 and 28) is headed "Criteria for assessing disproportionate burden" and names three criteria:

1. the ratio of the net costs of compliance to the overall costs (operating and capital expenditure) of manufacturing, distributing or importing the product, or of providing the service;
2. the estimated costs and benefits for the economic operators in relation to the estimated benefit for persons with disabilities, taking into account the amount and frequency of use;
3. the ratio of the net costs of compliance to the economic operator's net turnover.

The net costs are broken down into two groups, which the Annex repeats verbatim under numbers 1 and 3: one-off organisational costs (additional staff with accessibility expertise, training and skills acquisition, development of a new process for incorporating accessibility, development of accessibility guidance, one-off costs of becoming familiar with the legal position) and recurring production and development costs (planning and designing accessibility features, production processes, testing for accessibility, producing documentation). Annex VI of the directive has the same structure and states expressly for criterion 3 that the cost elements are the same as in criterion 1.

Two things stand out. First, Annex 4 contains no threshold. There is no percentage above which a burden becomes disproportionate. The Annex requires ratios to be formed, not a limit value to be undercut. Anyone writing an assessment must calculate and reason, not tick boxes.

Second, criterion 2 is the only one of the three that does not measure costs alone. It sets against them the estimated benefit for persons with disabilities and factors in the amount and frequency of use – meaning use of the offering overall, not use by persons with disabilities. For a heavily used offering, the benefit side of the calculation therefore grows at constant cost. No automatic consequence follows from this, because the Annex does not weight the three criteria against one another. But for a company's mass channel – the home page, the checkout, the sign-in – the exemption is the hardest one to justify.

The funding bar

§ 17(4) BFSG and Art. 14(6) EAA bar reliance on disproportionate burden where the economic operator receives funding from sources other than its own resources, whether public or private, provided for the purpose of improving accessibility. This rule has real force for recipients of public funding: anyone drawing on a digitalisation programme with an accessibility component loses the cost argument for the object concerned.

Part 4: The Enforcement Mechanics – and a Gap in the Penalty Provision

Up to this point one might take the Act for ordinary product law with generous exemptions. What sets it apart are four provisions that together create an unusual degree of enforcement and disclosure pressure.

First: random sampling without cause. § 28(2) BFSG obliges the market surveillance authority to check services "even without specific cause, on the basis of appropriate samples". For websites and mobile applications it applies the requirements of Annex 1 no. 1 and selects the samples in accordance with Annex 1 no. 2. This is not a complaint-driven model but active market surveillance with a prescribed testing and sampling procedure.

Second: the assessment itself is examined, not merely its existence. Where a provider invokes § 16 or § 17, the authority examines three things under § 28(3) BFSG: whether the assessment was carried out at all; the assessment itself, "including the proper application of the criteria set out in Annex 4"; and whether the remaining accessibility requirements are met. The third point is the one most often missed: the exemption operates only "insofar as". A disproportionate burden in the configurator does not justify a missing alternative text on the home page. The directive frames the authority's duty in parallel in Art. 19(2) for products and Art. 23(1)(a) for services, in each case including the correct use of the Annex VI criteria.

Third: the consumer's access – subject to a reservation. § 28(4) BFSG obliges the authority to provide a consumer, on request and in a form perceivable to them, with two things: the information available to it on whether a particular economic operator complies with the requirements, and the assessment that operator carried out under § 16(1) sentence 2 or § 17(1) sentence 2. Where necessary, the authority is to explain the information simply and comprehensibly, and if that is not sufficient, in easy-to-read language. § 28(5) additionally gives people with hearing and speech disabilities the right to communicate in this procedure in German Sign Language, in sign-supported speech or via other suitable communication aids, at the authority's expense.

The limit sits in sentence 4 of the same subsection: the duty does not apply where the information cannot be provided for reasons of confidentiality under Art. 17 of Regulation (EU) 2019/1020. That limit must be taken seriously, because the content of a § 17 assessment is exactly what Art. 17 typically protects: net costs, overall costs, net turnover. The justification for why accessibility was too expensive is therefore not a purely internal document – any consumer may request its release from the authority. How far confidentiality carries is an open question. I am of the opinion that when writing such an assessment one should not count on it carrying.

Fourth: remedies by recognised associations, even without their own rights being infringed. Under § 33(1) BFSG, consumers may instruct an association recognised under § 15(3) of the Disability Equality Act, or a body under § 3(1) sentence 1 no. 1 of the Injunctions Act, to bring administrative-court remedies against the authority's decision under § 32(3) or against its omission. Under § 33(2), recognised associations may bring remedies "without their own rights being infringed" where a provision of the Act or of the BFSGV is breached and that breach touches their statutory remit. Before the Federal Administrative Court they must act through persons qualified for judicial office (§ 33(1) sentence 4, applied correspondingly via (2) sentence 3).

An important point of classification: this is not a collective action against the company in the sense of the Injunctions Act or the German consumer-rights enforcement statute. § 33 is directed against the authority – against its decision or its omission. The lever against a company therefore runs through the supervisor, not directly.

The fine scale and the gap in its middle

§ 37(2) BFSG has two tiers. Up to EUR 100,000 in the cases of subsection 1 nos. 1, 7, 8, 9 and 10 – namely placing a non-conforming product on the market contrary to § 6(1) no. 1 or § 9(1) (no. 1), making a product available contrary to § 11 (no. 7), offering or providing a service contrary to § 14(1) (no. 8), and breaches of the CE and other marking provisions of § 19 (nos. 9 and 10). Up to EUR 10,000 in the remaining cases – cooperation, information and reporting duties, such as failure to produce documents to the authority.

Now comes the finding that is easy to read past, and it is the most interesting one in the whole Act: no number in § 37(1) refers to § 16 or § 17. Neither failing to carry out an assessment, nor failing to document it, nor omitting the notification that an exemption is being invoked, is an administrative offence. The penalty provision neither rewards honest documentation nor punishes its absence.

What follows is a sanctioning mechanic that does not run through fines at all. Anyone without a sound assessment loses not money but the exemption. And without the exemption the full requirement applies – which puts the offering in § 14(1), and that is § 37(1) no. 8, (2): up to EUR 100,000. I am of the opinion that the business signal is therefore different from what the fine table suggests: an assessment under § 16 or § 17 is not a formality whose omission costs ten thousand euros, but the entry ticket to the only line of defence the Act offers. That is an assessment of incentive effects, not a legal consequence; classifying an individual case is for an authority or a court.

Note also that the upper tier protects both halves of § 14(1) – including the absence of the publicly accessible statement under Annex 3 no. 1. The intuitive reading that paperwork duties generally sit in the lower tier is therefore wrong.

Who is "the market surveillance authority"?

§§ 13, 14, 16, 17 and 28 BFSG largely speak of "the market surveillance authority" without naming a body – for services, § 17(3) sentence 2 no. 2 and § 17(5) sentence 1 additionally refer to "the authority responsible for checking the conformity of services". The route of assignment comes from § 2 no. 22 BFSG: a market surveillance authority is any authority competent under Land law for carrying out market surveillance. § 20 BFSG assigns the responsibility to the Länder.

The Länder have pooled the role. The competent body is the Market Surveillance Body of the Länder for the Accessibility of Products and Services – a public-law institution (Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen, MLBF AöR), seated at Carl-Miller-Straße 6, 39112 Magdeburg. It describes itself as the joint surveillance body of all sixteen Länder, monitoring compliance with the statutory accessibility requirements nationwide, for products and for services; as its legal basis it cites § 20(2) and § 21(2) BFSG in conjunction with Art. 11(3) and Art. 13 of Regulation (EU) 2019/1020. It expressly confirms both functions relevant here: it receives notifications from economic operators about non-conformity of their own products or services (§ 21(1), § 28(1) BFSG), and it reviews the assessment where an economic operator invokes a fundamental alteration under § 16 or a disproportionate burden under § 17.

The chronology is notable. The obligations have applied since 28 June 2025. The news item "New market surveillance authority taking shape in Magdeburg" carries the date 1 June 2026 on the body's own site, and the Federal Agency for Accessibility noted on 8 June 2026 that the market surveillance body's website was online. In other words, the addressee of three "without undue delay" duties acquired a website of its own almost a year after the Act became applicable.

For practice, one gap remains that should be closed before the occasion to notify arises: which concrete channel receives the notifications under § 16(3) and § 17(5) and the report under § 14(4) does not emerge unambiguously from the pages retrieved. There is a general contact form for businesses, but no procedure designated for these provisions. Nor do the retrieved pages name the state treaty or administrative agreement by which the institution was established.

Part 5: The Moving Benchmark – and the Standard That Does Not Yet Count in Law

Now to the technically most interesting decision the German legislator took.

One would expect a regulation on accessibility requirements to name a standard. The Regulation on the Accessibility Strengthening Act (BFSGV) does not do so in § 3. Instead it states:

"In meeting the requirements of this regulation, the state of the art shall be observed. Departure from the state of the art is permitted where the requirements of this regulation are met to the same extent by other means." (§ 3(1) BFSGV)

§ 3(2) BFSGV tasks the Federal Agency for Accessibility with regularly publishing on its website a list of the most important standards to be observed, conformity tables, and current information on the standards to be observed. So the regulator has not delegated the benchmark to a website – it remains an indeterminate legal concept, "state of the art", with an express option to depart where compliance is achieved to the same extent. What appears on the website is information, not law-making. That list is not legally binding; in practice it is, for many, the only tangible answer to the question of what one is being measured against.

There is a logic to this: standards age faster than regulations. But there is also a price, and it is plainly visible in the current state of affairs.

The relevant standards

WCAG 2.2 has been a W3C Recommendation since 12 December 2024. It rests on four principles – perceivable, operable, understandable and robust – and is, by its own account, organised into thirteen guidelines, with three conformance levels: A, AA and AAA. Compared with WCAG 2.1, nine success criteria are new: 2.4.11 Focus Not Obscured (Minimum) (AA), 2.4.12 Focus Not Obscured (Enhanced) (AAA), 2.4.13 Focus Appearance (AAA), 2.5.7 Dragging Movements (AA), 2.5.8 Target Size (Minimum) (AA), 3.2.6 Consistent Help (A), 3.3.7 Redundant Entry (A), 3.3.8 Accessible Authentication (Minimum) (AA) and 3.3.9 Accessible Authentication (Enhanced) (AAA). One criterion was removed: the document states that WCAG 2.2 has removed one success criterion, 4.1.1 Parsing, and carries it under the heading "4.1.1 Parsing (Obsolete and removed)". Important for practice: the publication of WCAG 2.2 neither deprecates nor supersedes WCAG 2.0 or WCAG 2.1.

Three of the four new AA criteria are particularly relevant for development teams, because they target widespread interaction patterns directly. 2.5.7 Dragging Movements requires an alternative to dragging motions – affecting sliders, kanban boards, map interactions. 2.5.8 Target Size (Minimum) concerns the size of click targets. 3.3.8 Accessible Authentication (Minimum) concerns sign-in procedures that require a cognitive function test; anyone making users transcribe characters from an image or reproduce strings from memory has a problem here – and a good reason to look into phishing-resistant methods. The fourth new AA criterion is 2.4.11 Focus Not Obscured (Minimum).

EN 301 549 is the European standard "Accessibility requirements for ICT products and services". The version currently published in the ETSI directory is V4.1.1 (2026-09). Its foreword records that the requirements of clauses 9, 10 and 11 have been updated to align with the WCAG 2.2 recommendation. Clause 9.5 is headed "WCAG 2.2 AAA Success Criteria (informative)" – so the AAA level is expressly informative there. The standard was prepared under standardisation request C(2022) 6456 final and describes itself as "one voluntary means of conforming to the essential requirements of Directive (EU) 2019/882". The document is marked "Harmonised European Standard"; that is, initially, an ETSI document category for a standard prepared under a standardisation request – not yet the legal status under Art. 15 EAA. And that is precisely what now matters.

The gap between the standard and its legal effect

Art. 15(1) EAA ties the presumption of conformity to a condition: products and services in conformity with harmonised standards are presumed to conform where the references to those standards "have been published in the Official Journal of the European Union". EN 301 549 V4.1.1 states the same condition itself: the presumption applies only once the document is cited in the Official Journal under that directive. An Annex ZB relating to Directive (EU) 2019/882 is prepared in the standard.

In the European Commission's official register of harmonised standards, that citation is currently not demonstrable. The "Accessibility" sector there contains exactly one entry, "Websites and mobile applications of public sector bodies", and that entry rests exclusively on Directive (EU) 2016/2102 on the accessibility of the websites and mobile applications of public sector bodies, with Implementing Decision (EU) 2018/2048 and its amendment of 11 August 2021. Directive (EU) 2019/882 is not named in that register at all. A negative finding from a register is not proof, but it is the most reliable information available.

Two things follow, and together they produce a peculiar situation.

First: applying EN 301 549 is a well-founded way of meeting the requirements – the standard describes itself as a voluntary means to that end. But it is not a presumption that reverses the burden of proof. Anyone relying on it still bears the burden of showing that their implementation meets the requirements of the BFSGV.

Second, and this is the structural point: § 14(3) BFSG obliges service providers to take account of changes to the harmonised standards "referred to in the declaration that the service conforms with the accessibility requirements". As long as no harmonised standard is cited in the Official Journal under Directive (EU) 2019/882, there is, in the strict sense, no such standard for a declaration of conformity to refer to. The duty to keep up then points at a legal slot that is not yet filled. In practice nobody solves this by doing nothing – one simply refers to EN 301 549 in a particular version and keeps it current. But it is worth knowing that this reference currently stands on its own feet and not on the presumption of conformity in Art. 15.

On top of this comes a visible lag in the national updating. The Federal Agency for Accessibility's page on standards carries, according to its own page data, a last-updated date of 27 July 2026 and names V3.2.1 (2021-03) as the applicable version of EN 301 549, describing it as referring to WCAG 2.1; it announces that the updated version will refer to WCAG 2.2. So this is a lag in linking, not a lack of awareness. The conformity tables envisaged by § 3(2) BFSGV have, according to the page, not yet been published, and it cannot give a precise publication date. The page additionally names EN 17161:2019 as a process standard for the "Design for All" approach, as well as several harmonised standards under development at CEN/CENELEC JTC 12 and at ETSI Human Factors, the latter on emergency communication with completion planned by 15 January 2027; M/587 is named as the Commission mandate.

In sum, an architect should take away two points. The most recently published version of the standard (V4.1.1, 2026-09, WCAG 2.2) and the officially linked version (V3.2.1, 2021-03, WCAG 2.1) have diverged. And § 14(3) BFSG ties the duty to keep up to the version you yourself refer to. The practical consequence: the version number of the standard you tested against belongs, with a date, in every conformity record. "We comply with EN 301 549" is, without a version, a statement without a point in time – and in five years it will no longer be reconstructible.

Part 6: The Empirical Picture – How Far the Web Is from the Requirement

It is worth holding the standards up against measured data. The most extensive recurring survey at present is the WebAIM Million, whose 2026 edition is based on measurements from February 2026 (page last updated 30 March 2026).

Methodologically it is an automated test: the home pages of the one million most-visited websites by Tranco ranking were examined using the WAVE engine via its stand-alone API, on the rendered DOM after scripts and styles were applied, against WCAG 2.2 A/AA. The authors state the limits of their method themselves, and plainly: "All automated tools, including WAVE, have limitations—not all conformance failures can be automatically detected. Absence of detected errors does not indicate that a page is accessible or conformant."

The headline figures for 2026:

• 95.9 per cent of home pages had detected WCAG 2 failures – up from 94.8 per cent in 2025.
• 56,114,377 distinct errors in total, an average of 56.1 errors per page – up from 51 in 2025, an increase of 10.1 per cent.
• An average of 1,437 elements per home page, up from 1,257 in 2025.

The distribution of the most common failure types (share of home pages):

These six categories account, according to the report, for 96 per cent of all detected errors. Low contrast text occurred an average of 34 times per home page; 16.2 per cent of images lacked alternative text; 33.1 per cent of form inputs were not properly labelled.

Three readings of these numbers are practically useful.

First: what a tool handles automatically improves the most. Missing document language has fallen from 33.1 to 13.5 per cent – a relative decline of nearly sixty per cent, the steepest of all six categories. It is also the only one you fix with a single attribute on the <html> element, and one that every modern framework sets by default. Low contrast text (85.3 to 83.9 per cent) and missing form labels (52.8 to 51.0 per cent), by contrast, have stagnated almost completely over eight years; alternative text sits in between at 68.0 to 53.1 per cent. The pattern is weaker than a rule, but it is visible: the less a correction has to be decided per individual element, the more likely it is to happen. Empty buttons, incidentally, are the only category that has increased over the series, from 25.0 to 30.6 per cent – the rise of the icon button without an accessible label can be read off directly here.

Second: the ARIA finding. Home pages using ARIA had markedly more detected errors on average (59.1) than pages without ARIA (42.0). 82.7 per cent of home pages used ARIA – landmark roles not counted – up from 79.4 per cent the year before; in total 133,589,803 ARIA attributes were counted, more than 133 per page. Caution is needed here, and the authors exercise it themselves: the pages using ARIA were also the more complex ones. This is an association, not a demonstration of causation; complexity produces both ARIA usage and errors. The finding does not show that ARIA causes errors. It shows that ARIA attributes in the code are not evidence of accessibility, but an occasion to test.

Third, and here lies the greatest temptation to a fallacy: it would be natural to write that the web measurably got worse in the first year after the BFSG came into force. This dataset does not support that, for four reasons.

The survey examines the globally most-visited home pages, not the offerings covered by the BFSG. It measures only home pages, not checkout flows. It detects, by its own statement, only a subset of failures. And above all: the series oscillates, it does not decline. For 2024, WebAIM already reports 95.9 per cent and 56.8 errors per page – so 2026, at 95.9 per cent and 56.1 errors, sits exactly at or below the 2024 level, and well below the 97.8 per cent of 2019. Add to that the fact that pages grew from 1,257 to 1,437 elements in a single year: measured per element, error density actually fell slightly, from roughly 0.041 to roughly 0.039. Nor do the authors attribute the increase to a change in method, but to page complexity, the growth in ARIA, reliance on third-party libraries and AI-assisted code generation.

What the data do support is a weaker but still hard statement: the baseline state of the web is far from WCAG 2.2 A/AA – on more than 95 per cent of the home pages examined – and it has barely moved in eight years. Anyone walking into an audit today on an unverified assumption of compliance is, statistically speaking, very likely wrong.

Part 7: A Framework for Practice – the Chain of Provability

From §§ 14, 16, 17 and 28 BFSG one can derive which artefacts a company must be able to produce. Not should – must be able to, because the authority can request them and a consumer can apply for parts of them.

1. The scope list. A statement of which of your own offerings fall within scope under § 1(2) and (3) BFSG, with reasons per offering. This includes classification as product or service, because the microenterprise exemption turns on it.

2. The content inventory with three metadata fields. Per media object, office document and content component: date of publication, provenance and control within the meaning of § 1(4), date of last update or edit. Without these fields the exemptions of § 1(4) cannot be invoked. The test is simple: can your CMS produce a list of all archive content changed after 28 June 2025? If not, that is your first gap.

3. The test report with the standard version. The result of a test against a named version of a standard, with date, tool and – importantly – the share of manual testing. The WebAIM figures show why: automated tools find, by their own authors' statement, only a subset of failures, and the absence of detected errors is expressly not evidence of conformance.

4. The statement under § 14(1) no. 2. The information under Annex 3 no. 1, publicly accessible in an accessible form, to be retained for as long as the service is offered or provided (§ 14(2)). This is the only artefact visible from the outside – and its absence is, via § 37(1) no. 8, a breach in the upper fine tier.

5. The assessment under § 16 or § 17, if you invoke one. With the ratio calculations under Annex 4, the benefit weighing under criterion 2, evidence that no earmarked external funding was received (§ 17(4)), a renewal date within five years (§ 17(3)) and evidence of notification to the competent authority (§ 16(3), § 17(5)). And with the awareness that its release may be requested by any consumer under § 28(4) and that the confidentiality limit may not hold – so it should be written as a document you would be content to see read.

6. A version log of the reference standards. Because § 14(3) BFSG requires you to keep up with changes to precisely those standards you refer to in your own declaration of conformity, you need a place that records which version you tested against and when, and when the next re-test is due. The move from EN 301 549 V3.2.1 (WCAG 2.1) to V4.1.1 (WCAG 2.2) is exactly the case this provision was written for.

Fact Check

For this article, 125 checkable claims were extracted and verified against the primary sources: 80 hard facts (dates, amounts, provisions, standard versions, measurements), 12 verbatim quotations, 12 source attributions and 21 synthesis claims. The review was carried out by two separate reviewer instances, which received the draft and the source list with the mandate to find errors. Result: 87 claims CONFIRMED, 8 FALSE, 27 TO BE WEAKENED, 3 NOT VERIFIABLE. 38 claims were corrected, weakened or struck.

The most important corrections:

1. The draft described the identity of the market surveillance authority as not verifiable. That was wrong: the Market Surveillance Body of the Länder for the Accessibility of Products and Services (MLBF AöR) in Magdeburg is documented in several official sources. The section was replaced; what remains open is only the concrete notification channel for §§ 14(4), 16(3) and 17(5) and the instrument of establishment.
2. The presumption of conformity via EN 301 549 was marked too weakly as "not verifiable". The Commission's official register of harmonised standards lists, under the accessibility sector, only an entry relating to Directive (EU) 2016/2102; Directive (EU) 2019/882 does not appear there. The claim was recast around this negative finding, and the resulting tension with the updating duty in § 14(3) was added.
3. The claim that 2026 was the first year with a new testing basis for the WebAIM Million was unsupported and false. It was replaced by the documented counter-arguments: 2024 was already at 95.9 per cent and 56.8 errors per page, 2019 at 97.8 per cent, and measured per element the error density fell relative to 2025.

Further substantive corrections: the claim that missing document language was the only monotonically declining category was refuted both by the source and by the article's own table, and was reduced to the steepest relative decline (a 2024 column was added). The central thesis was shifted from a cost comparison to the defensible claim that the exemption relocates work from implementation to proof. The inference "no documentation, no exemption" was weakened, because § 17(1) sentence 1 is phrased objectively. The fine-incentive argument was corrected once it emerged that §§ 16 and 17 appear nowhere in § 37(1) and that the missing public statement also sits in the upper fine tier. The confidentiality limit of § 28(4) sentence 4 was added, because the draft named it and then ignored it in the following sentence. The claim that scope as a whole is a metadata question was narrowed to invoking the exemptions of § 1(4). Several provision citations were corrected as well – the microenterprise relief sits in § 17(2) sentence 3 and not sentence 4, § 17(5) sentence 2 carries no product qualifier, the entry-into-force rule sits in Article 3 of the transposing Act and not in the BFSG, and the representation rule of § 33 applies only before the Federal Administrative Court – as were the wordings of § 1(4) nos. 1, 3 and 5 and of the terminal exclusion in § 1(2), the description of § 33 as a "collective action", the portrayal of § 3(2) BFSGV as a delegation, and the number of new AA success criteria. Struck was the unsupported claim that in practice the exemption is most readily invoked for mass channels.

Note: automated AI verification against primary sources; no human expert review. Two points remained open in this run and are marked as such in the text: the instrument establishing the MLBF and the concrete notification channel for the notification duties.

The Central Takeaway

At first glance the Accessibility Strengthening Act looks like a design statute – contrast, alternative text, keyboard operability. Its actual mechanics sit in two other places.

The first: the two substantive exemptions, fundamental alteration under § 16 and disproportionate burden under § 17, save no work. They relocate it from implementation to proof – a ratio calculation under Annex 4 with no prescribed threshold, five years of retention, a copy on request, for services a renewal at least every five years, a notification of the authority without undue delay, and at the end a document whose release any consumer may request under § 28(4). The exemption is not the exit. It is the file.

The second, and the more unexpected one: the Act does not penalise that file. No number in § 37(1) refers to § 16 or § 17 – failing to write an assessment is not an administrative offence. You simply lose the exemption, which puts your offering in § 14(1), and that falls via § 37(1) no. 8 into the tier of up to EUR 100,000. The assessment is therefore not a formality carrying a small fine risk, but the only line of defence the Act offers.

The practical prompt that follows is technical, not legal, and it fits into one question: can your system say, for each piece of content, when it was published, who is responsible for it, and when it was last updated or edited? As long as the answer is no, the exemptions of § 1(4) are practically unavailable to you – you then have to treat every piece of content as if it were in scope.

The concrete first step, doable in a week: take the publicly reachable offering through which most consumer contact flows, and produce three things. First, a list of all content changed after 28 June 2025 that previously counted as archive. Second, a test run against a named version of EN 301 549 or WCAG 2.2, recording the tool, the date and the version number – because that version statement is, under § 14(3) BFSG, the anchor of your duty to keep up. Third, the answer to whether a statement under § 14(1) no. 2 exists and is publicly accessible. What is missing is your gap list – and it is at the same time the raw material for any assessment you might later need.

Reflection Question

The archive exemption in § 1(4) BFSG presupposes that content is neither updated nor edited after 28 June 2025. That creates an asymmetry with uncomfortable logic: correct an old document and you pull it into scope; leave it untouched and you keep it out. Maintenance costs you the exemption; neglect preserves it.

How would you decide this rule for a specific holding you are responsible for today – say an archive of several thousand older documents, some of which are substantively out of date? Would you correct them and accept the obligation, freeze them and leave factually wrong content in place, or delete them? And does your answer change if you frame it not as the operator but as the person trying to read those documents with a screen reader?

Cross-References in the Vault

• Security by Default: The EU Cyber Resilience Act and the End of the Insecure Product – the same construction applied to a different protected interest: a horizontal product regulation, presumption of conformity via harmonised standards, market surveillance. Anyone who knows the CRA will recognise the familiar mechanics in the BFSG – including the dependence on a citation in the Official Journal.
• When Software Becomes a Product: Why a Security Update You Never Shipped Becomes a Liability Case on 9 December 2026 — and Why Your Observability Architecture Suddenly Has a Legal Function – the liability side. Both regimes shift burdens of proof to where the technical information sits, and both demand documentation that outlives a decade.
• The Pyramid of Risk: How the EU AI Act Tames Artificial Intelligence – and Why It Concerns the Whole World – the third example of risk-tiered market access and the presumption of conformity as Europe's standard instrument.
• The Way Out of the Cloud: Why the Data from Your Machines Belongs to You, What a Cloud Migration May Cost From January — and Why That Legal Question Has Very Technical Consequences – the kinship lies in the lever: an obligation that can only be met if your own system carries the right metadata.
• The Algorithm as Judge: Article 22 GDPR, the SCHUFA Ruling, and the Right to a Human Decision – the same pattern as § 28(4) BFSG: the affected person gets access to the reasoning, not merely the outcome – and in both cases bounded by trade secrecy or confidentiality.
• The End of the Password: Passkeys, WebAuthn and the Anatomy of Phishing-Resistant Sign-In – the direct technical connection to WCAG 2.2 success criterion 3.3.8 Accessible Authentication (Minimum): sign-in without a cognitive function test.
• The ID That Stays Silent: eIDAS 2.0, the EU Identity Wallet, and the Art of Revealing Only What Is Needed – another European project whose legal effect depends on a standardisation status that trails the legal text.
• NIS2 and What It Really Means for Mid-Market IT Consulting Firms in Germany – the organisational perspective on the same underlying problem: an obligation whose fulfilment you must be able to demonstrate.

Sources and Further Reading

1. Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (European Accessibility Act), OJ L 151, 7.6.2019, p. 70; in force since 27 June 2019. Articles 2, 3(23), 4(5), 14, 15, 19(2), 23(1), 31 and 32 were checked. EUR-Lex, English full text
2. Barrierefreiheitsstärkungsgesetz (BFSG) – the Act transposing Directive (EU) 2019/882, of 16 July 2021 (BGBl. I p. 2970), last amended by Article 32 of the Act of 6 May 2024 (BGBl. 2024 I no. 149); in force in substance since 28 June 2025. §§ 1, 2, 3, 6, 13, 14, 16, 17, 28, 33, 37, 38 and Annex 4 were checked. gesetze-im-internet.de
3. Verordnung zum Barrierefreiheitsstärkungsgesetz (BFSGV) – the regulation on accessibility requirements for products and services under the BFSG; § 3 in particular was checked (state of the art, publication mandate to the Federal Agency for Accessibility). gesetze-im-internet.de
4. Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen – Anstalt öffentlichen Rechts (MLBF AöR), Magdeburg – joint surveillance body of all sixteen German Länder; legal basis, by its own account, § 20(2) and § 21(2) BFSG in conjunction with Art. 11(3) and Art. 13 of Regulation (EU) 2019/1020. mlbf-barrierefrei.de
5. W3C: Web Content Accessibility Guidelines (WCAG) 2.2, W3C Recommendation of 12 December 2024 – four principles, thirteen guidelines, conformance levels A/AA/AAA, nine new success criteria compared with WCAG 2.1, removal of 4.1.1 Parsing. w3.org/TR/WCAG22
6. ETSI/CEN/CENELEC: EN 301 549 V4.1.1 (2026-09) – Accessibility requirements for ICT products and services, Harmonised European Standard, prepared under standardisation request C(2022) 6456 final; clauses 9, 10 and 11 aligned with WCAG 2.2, clause 9.5 "WCAG 2.2 AAA Success Criteria (informative)". ETSI directory
7. European Commission: Harmonised Standards – the official register of harmonised standards cited in the Official Journal; the accessibility sector contains only the entry on websites and mobile applications of public sector bodies, based on Directive (EU) 2016/2102 with Implementing Decision (EU) 2018/2048 and its amendment of 11 August 2021. single-market-economy.ec.europa.eu
8. Bundesfachstelle für Barrierefreiheit (Federal Agency for Accessibility): Normen und Standards – the overview published under § 3(2) BFSGV; names EN 301 549 V3.2.1 (2021-03) as referring to WCAG 2.1 and announces the WCAG 2.2 version, names EN 17161:2019 and harmonised standards under development at CEN/CENELEC JTC 12 and ETSI Human Factors (mandate M/587). bundesfachstelle-barrierefreiheit.de
9. WebAIM: The WebAIM Million – The 2026 report on the accessibility of the top 1,000,000 home pages, measured February 2026, page last updated 30 March 2026 – 95.9 % of home pages with detected WCAG 2 failures, 56.1 errors per page on average, methodology WAVE stand-alone API against WCAG 2.2 A/AA on the rendered DOM. The comparison figures for 2024 (95.9 %, 56.8 errors per page) and 2019 (97.8 %) come from the 2024 edition. webaim.org/projects/million · 2024 edition

Note: this article is a technical account of the regulatory position and not legal advice. The negative finding on the citation of EN 301 549 in the Official Journal under Directive (EU) 2019/882 rests on the Commission's official register at the time of retrieval and should be rechecked before any decision; the same applies to the MLBF's notification channel and its instrument of establishment, neither of which emerges from the pages retrieved.

← All articles