BFSG Enforcement: Proving Remediation to the Authority

How a BFSG procedure starts at the market surveillance authority

Services in e-commerce fall under a joint authority of all German states, based in Magdeburg. This joint authority of the 16 federal states began its nationwide work in September 2025 (Land Sachsen-Anhalt). It works reactively on the basis of reports and actively along market surveillance strategies that have been set for the next four years (Land Sachsen-Anhalt).

The law distinguishes between checks with a specific cause and random samples. If the authority has reason to believe that a service does not meet the requirements, it examines it (BFSG, Sec. 28 para. 1). In addition, it checks services without a specific cause by means of appropriate random samples (BFSG, Sec. 28 para. 2). Consumers can provide a cause, through an informal report or a formal request.

The difference matters. A report is taken into account by the authority as part of its market surveillance (MLBF, reporting form). A request under Section 32(1) BFSG, by contrast, opens an administrative procedure that ends with a written decision (MLBF, request form). It can be filed by consumers who claim they cannot use the service, or can only use it to a limited extent, because of a breach; recognised associations can act for those affected and, under certain conditions, in their own right (BFSG, Sec. 32 para. 1 and 2). Once the request has been received, the provider is given the opportunity to comment (BFSG, Sec. 32 para. 1).

Request, second deadline, shutdown: the stages under Section 29 BFSG

Once the authority finds a defect, the part of the procedure with running deadlines begins. The authority itself writes that its approach follows the principle of proportionality and is guided by the step-by-step model set out in the law (MLBF, services strategy).

1. Request with a deadline. The authority promptly asks the provider to take suitable measures to establish conformity within an appropriate deadline (BFSG, Sec. 29 para. 1). Through a cross-reference, the hearing period must not be shorter than ten days (BFSG, Sec. 22 para. 2).
2. Renewed request with a warning. If the provider takes no suitable corrective measures, a renewed request with a new deadline follows, now with the threat of prohibiting the offer (BFSG, Sec. 29 para. 2).
3. Order to stop the offer. If this deadline also passes without suitable correction, the authority can order the offer or provision of the service to stop (BFSG, Sec. 29 para. 3). For an online shop, that can mean the offer to consumers may not continue.

The decisive sentence comes at the end of the provision: if the provider demonstrates that conformity has been established, the authority lifts the order (BFSG, Sec. 29 para. 3). The law ties the way back not to a promise but to proof. And that proof pays off well before the last stage: a provider that answers the first request with documented corrections usually does not reach the warning stage at all.

If the service provider demonstrates to the market surveillance authority that the service has been brought into conformity with the accessibility requirements of the ordinance to be issued under Section 3(2), the market surveillance authority lifts the order.

— Section 29(3), third sentence, BFSG, own translation

How the authority selects and what it checks

For checks without a specific cause, the authority lists its risk factors in its strategy for services: market share or user reach, company size, relevance for independent living, complexity and interactivity, results of automated pre-checks, public user feedback and market trends (MLBF, services strategy). For web-based services it explicitly relies on automated pre-checks with technical testing software in order to cover more offers across the market than manual testing would allow (MLBF, services strategy).

How the check works is set out in Annex 1 to the law. The method is technology-neutral; within the sample, all process steps are checked at least in the standard order of a typical user (BFSG, Annex 1). If a page in the sample is part of a multi-step process such as the checkout, all steps of that process are checked (BFSG, Annex 1). For a shop that means: not just the home page and a product page, but the whole path to the order.

A simple rule for the evidence follows: your own re-test should cover the same page types the authority checks. A good result on the home page says nothing about the payment step.

Why remediation is a question of proof

The law asks for more than the fix. In case of non-conformity, the provider takes the necessary corrective measures and promptly informs the market surveillance authority, with detailed information in particular on the nature of the non-conformity and the corrective measures taken (BFSG, Sec. 14 para. 4). On a reasoned request, it provides all information needed to demonstrate conformity and cooperates on the measures to establish it (BFSG, Sec. 14 para. 5).

Anyone who simply answers that "the reported issues have been fixed" describes an intention, not a state. The authority can only verify such a sentence by measuring again itself, and may then find whatever was left over after the fix or newly introduced. Anyone who submits finding, measure and re-test with date and method provides the basis for the decision right away. That pays off later too: providers that showed little willingness to cooperate are rated as a higher risk under the authority's strategy (MLBF, services strategy).

On top of this comes the duty to meet the requirements on an ongoing basis and to take due account of changes in how the service is provided (BFSG, Sec. 14 para. 3). Evidence that only reflects the day of submission does not answer this duty. Only a measurement series that starts before the deadline and continues afterwards is robust.

What robust proof of remediation contains

Evidence convinces when a third party can follow it without having been there. For every barrier raised, a complete record therefore belongs in the file:

• Finding: affected page, affected element, WCAG success criterion and, where available, the wording from the authority's letter.
• Detection with date: when the defect was first measured or reported, with tool and setting, for example desktop or mobile.
• Measure: what was changed, with a reference to the ticket, the code change or the release in the shop system.
• Re-test with date: the same check on the same page after the change, with result and timestamp.
• Manual cross-check: operation by keyboard and with a screen reader for everything an automated run cannot assess.
• Scope: the same finding on all pages of the same type, not only on the one reported.
• Persistence: further measurements after the deadline showing that the state is being maintained.

Scope is often underestimated. A missing label on the search field sits in a template and therefore on every page. Anyone who only repairs the reported URL has moved the defect, not fixed it. How to find barriers that only show up without a mouse is covered in the article on keyboard navigation and focus testing. A uniform format per finding can later be used as an annex without reformatting:

{
  "finding": "Search field in the header without an accessible label",
  "criterion": "WCAG 2.2, success criterion 4.1.2 Name, Role, Value",
  "scope": "header template, therefore all pages",
  "detected": "YYYY-MM-DD, axe-core, desktop and mobile",
  "change": "ticket SHOP-..., label added in the template",
  "recheck": "YYYY-MM-DD, same check, rule label without hits",
  "manual_check": "keyboard and screen reader, announcement checked, screenshot",
  "follow_up": "ongoing in monitoring, history as annex"
}

How far automated measurements go

The WebAIM analysis shows how widespread detectable defects are: 95.9 percent of the home pages examined had automatically detected WCAG failures, with an average of 56.1 errors per page (WebAIM Million 2026). Home pages in the shopping category were clearly above that, with an average of 71.0 detected errors (WebAIM Million 2026). The study covered the most visited websites worldwide, not German shops in particular; the figures show the order of magnitude, not the state of any particular offer.

An automated run is the right tool for checking many pages on a fixed schedule and spotting regressions. It does not replace checking whether alternative text makes sense, the focus order is logical and error messages are understandable. The authority uses testing software for pre-checks (MLBF, services strategy), but its method also requires assessing forms, error messages and behaviour with assistive technologies (BFSG, Annex 1).

Which defects come up most often is summarised in the article on the most common WCAG 2.2 errors on business websites. They usually sit in templates and disappear from many pages with a single change. Whether a rule that was raised still fires after the fix is shown straight away, without an account, by the free BFSG check.

Evidence over time with XICTRAQ

XICTRAQ checks websites with axe-core against WCAG 2.0, 2.1 and 2.2 at level AA and sorts violations by impact: critical, serious, moderate, minor. Each violation comes with the affected HTML element and instructions for fixing it. In monitoring, the check runs again on a fixed schedule. The Lighthouse accessibility score per run and the PDF reports are kept with their dates. The BFSG accessibility feature page describes the scope.

For an ongoing procedure, a fixed routine is advisable: measure a baseline before the first change and save the report, measure again after each change, generate a report at the deadline and keep monitoring running. This produces exactly the measurement series sketched in the evidence strip of the illustration above.

Deadline plan: from the request to the re-test

The authority sets the deadline, and it has to be appropriate (BFSG, Sec. 29 para. 1). Meeting it takes a plan on day one. A sequence that builds in the evidence from the start makes sense:

1. Log the receipt: record the date of the letter and of receipt, the deadline set and the defects named.
2. Measure the baseline: before any change, measure and save the pages complained about and the page types from Annex 1.
3. Get a legal assessment: whether the defect applies, whether an exemption under Section 16 or 17 BFSG could be relevant and what belongs in the statement is for legal counsel to clarify.
4. Prioritise by template: first fix the defects that sit in templates and affect many pages.
5. Re-test and cross-check: re-measure the same pages automatically, log the manual check with keyboard and screen reader.
6. Submit the report: finding, measure, re-test and cross-check per defect with dates, on time, to the authority.
7. Continue the series: keep monitoring running after the deadline so that a regression is noticed before it is reported again.

How a measurement report has to be structured so that it still holds months later is described in the article on website acceptance with a test report. The logic matches the website evidence for cyber insurance: a finding with date and method replaces memory.

Avoiding regressions: deploys, seasonal pages, new components

Providers that stood out for formal or material defects are monitored with priority in future measures (MLBF, services strategy). A regression after the procedure has closed therefore weighs more heavily than the first finding. The causes are usually mundane: a theme update, a new plugin, a reworked cookie notice, a campaign banner with too little contrast.

Ahead of the holiday season, many shops add new components: countdowns, voucher fields, campaign pages. If you keep the campaign page at the same address every year, as described in the article on the Black Friday page with a permanent URL, it can stay in the measurement permanently. How regressions arise after a deploy and how to find them early is covered in the article on monitoring WCAG regressions. If an agency looks after the shop, the contract should state who approves templates and who sees the alert.

Fines, legal remedies and conciliation at a glance

Anyone who intentionally or negligently offers or provides a service in breach of the requirements commits an administrative offence; the range then goes up to 100,000 euros, in all other cases up to 10,000 euros (BFSG, Sec. 37 para. 2). The other cases include information to the authority under Section 14(4) or information under Section 14(5) that is not given, not given correctly, completely or on time (BFSG, Sec. 37 para. 1).

Reliable figures on fines imposed are not available. The authority itself writes that there is no historical data on case numbers or defect rates for the current strategy period, because the law has only applied since 28 June 2025 (MLBF, services strategy). Anyone claiming individual cases or amounts is speculating.

For consumers and recognised associations, the law provides for legal remedies under the Code of Administrative Court Procedure against a decision or its omission; associations can, under certain conditions, use them even without their own rights being infringed (BFSG, Sec. 33). A rejected request therefore does not necessarily end a case. If a consumer chooses conciliation, a procedure under Section 32 must be suspended until it has ended (BFSG, Sec. 34 para. 4). How the official procedure differs from a warning letter is explained in the article on BFSG warning letters; the basics are covered in the BFSG overview for websites.

Make remediation measurable before the deadline runs

The market surveillance procedure is a staged process with deadlines and a clearly named way out: proof that conformity has been established. Anyone who keeps a dated measurement series before the first letter arrives starts the deadline with a baseline, a list of open issues and a tool that re-measures every change. The live demo shows what this looks like with sample data; the individual functions are described under BFSG accessibility. Anyone who just wants to know where their own home page stands today can start with the BFSG check and keep the result as the first dated point of the series.