The BFSG in Germany: which software it covers

Germany's accessibility law, the Barrierefreiheitsstärkungsgesetz (BFSG), has applied since 28 June 2025 and covers a closed list of products and services offered to consumers, such as online shops, consumer banking services and e-books. A system that only businesses use is usually outside it, and microenterprises that provide services are exempt.

This article reports what the law text and official guidance say. It is not legal advice, so a lawyer should confirm any specific product.

What does the BFSG cover?

The law applies to products placed on the market, and services provided to consumers, after 28 June 2025. The product list in section 1(2) BFSG includes consumer computers and their operating systems, payment terminals, ATMs, ticketing and check-in machines, e-readers and consumer terminals for telecommunications and audiovisual media.

The service list in section 1(3) names five areas: telecommunications services, elements of passenger transport (including websites, apps, e-tickets and travel information), consumer banking services, e-books and software dedicated to them, and e-commerce services. For urban, suburban and regional transport, only the self-service terminals are covered.

The federal labour ministry (BMAS) states in its guidelines that these lists are exhaustive ("abschließend"). If a product or service is not on them, the BFSG does not apply, although accessibility can still be offered voluntarily. The guidelines PDF carries no printed date, and its file properties show July 2022.

The Directive also lists audiovisual media services. The BFSG list does not, and the Bundesfachstelle Barrierefreiheit FAQ says the Directive was implemented in the BFSG and in a second state treaty on media, which we did not read.

Which software counts as an e-commerce service?

Most custom software questions turn on this term. Section 2 no. 26 BFSG defines e-commerce services as digital services that are offered through websites and mobile applications, electronically and at the individual request of a consumer, with a view to concluding a consumer contract. The Directive defines the term in similar words in point 30 of its Article 3, as services provided at a distance through websites and mobile device-based services.

The official FAQ gives examples. Online shops are e-commerce services. A website that offers services to consumers, such as online banking, is in scope. The BMAS guidelines name online sale and online appointment booking. In their worked case, a hairdresser with more than 10 staff, turnover above EUR 2 million, online booking and a shop must make the whole website, including checkout, accessible.

A purely informational or advertising website is a different case. The FAQ says it "should not" be covered, because the element of an individual request is probably missing. The word is "sollte", so this is guidance and not a rule.

Our reading is that the trigger is the contract. A website or app falls under the e-commerce heading when a consumer can start a contract through it. We found no official text that tests this against a product that mixes both, such as a portal with a public information area and a consumer checkout, so the whole product should be assumed in scope until a lawyer says otherwise.

Does it apply to software built for business customers?

The FAQ says the BFSG regulates products and services that consumers use. Services "offered only in the B2B area" should therefore not be affected by it. The wording is again "sollten", which leaves room.

The legal anchor is the definition of a consumer in section 2 no. 16: a natural person acting for purposes that are predominantly outside a trade or profession. Internal software, a B2B portal and an API sold to other firms do not sit on the lists as consumer services.

Two cases need care. A B2B platform that also lets private individuals buy is no longer B2B only. And software built for a client's consumer app leaves the duty with the client as the provider of the service, with the supplier bound through the contract. That second point is our reading and not a statement in the law.

Who is exempt?

Section 3(3) BFSG exempts microenterprises that offer or provide services. Section 2 no. 17 defines a microenterprise as an enterprise with fewer than 10 persons that has either an annual turnover of up to EUR 2 million or an annual balance sheet total of up to EUR 2 million. The Directive has the same rule in Article 4(5).

The BMAS guidelines give examples. A hairdresser with 4 staff and EUR 1 million turnover is a microenterprise. With 4 staff and EUR 2.1 million turnover, or with 10 employees and EUR 1 million, it is not.

The exemption has two limits. It covers services only, so a microenterprise that places products on the market, such as a consumer device, is not exempt (FAQ, answers 5 and 11). And it protects the provider of the service. In our reading, a small supplier does not make a larger client exempt, because the duty sits with the provider of the consumer service.

Sections 16 and 17 add a second relief: a provider may argue that compliance would change the nature of the service or place a disproportionate burden on it. The provider assesses this itself, documents the result for 5 years and informs the authority. Section 17(4) closes this route if the provider received outside funds to improve accessibility.

What do the requirements ask for?

Services must be "findable, accessible and usable" for people with disabilities in the usual way, without special difficulty and in principle without outside help (section 3(1)). The regulation behind the law, the BFSGV, requires websites, online applications and mobile services, including apps, to meet four criteria, which start with perceivable, operable and understandable.

For e-commerce, section 19 BFSGV adds accessibility information about the products and services on sale, where the responsible operator supplies it, and requires that identification, authentication, security and payment functions meet those same four principles. Under section 14(1) BFSG, a provider may offer the service only if it also publishes information on how the service meets the requirements, for example in the terms and conditions, in an accessible form.

The technical reference is the European standard EN 301 549. The Bundesfachstelle FAQ says that the current version, V3.2.1, points to WCAG 2.1 at levels A and AA for web content, and its standards page calls the standard the central technical reference. A compliance presumption exists only for harmonised standards cited in the Official Journal of the European Union (sections 4 and 5 BFSG; Directive Article 15). Without it, the operator must be able to show conformity itself. The Bundesfachstelle promises conformity tables without a date.

A newer version exists. ETSI EN 301 549 V4.1.1 is dated September 2026, was adopted on 24 August 2026, and updates the web, document and software clauses to follow WCAG 2.2. It says that once it is cited in the Official Journal under the Directive, compliance with its normative clauses gives a presumption of conformity. We did not find a citation, so we cannot say whether it has that status yet.

What happens if software does not comply?

A market surveillance body for all German states, the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF), checks compliance. It sits in Magdeburg, and its site has a form for reporting barriers and one for applications under section 32(1) BFSG, which consumers and recognised associations may use to ask the authority to start proceedings.

Services are checked by sampling without a specific cause (section 28(2)). For websites and apps, the pages tested include the home page, login, contact, help and legal pages, at least 10% additional random pages and every step of a process.

The BMAS guidelines describe the sequence for services: a request to restore conformity, a second request with a threat of an order to stop providing the service, and then the order itself. Under section 37(2), offering a service contrary to section 14(1) can carry a fine of up to EUR 100,000. Other breaches can reach EUR 10,000. The guidelines still cite the section as 36, so the current text is the one to rely on.

Is there a transition period?

Yes, a limited one. Section 38(1) BFSG lets providers keep using products that they used lawfully before 28 June 2025 to provide services until 27 June 2030. Service contracts concluded before that date may continue unchanged until they end, but no longer than 27 June 2030. Self-service terminals can stay in use for at most 15 years.

Our reading is that a changed or renewed contract leaves this relief, because the law says "unverändert". We found no guidance on what counts as a change.

Our addition: a scoping check for a product owner

This list is our own, built from the legal text above and not from any official checklist.

1. Who uses it? If only businesses or their staff, the BFSG is probably not engaged. If consumers can use it, go on.

2. Is it on the lists? Does it fall under e-commerce, consumer banking, e-books, telecommunications or passenger transport?

3. Can a consumer start a contract through it? If yes, treat the whole site or app as an e-commerce service.

4. Is the provider a microenterprise? Check both criteria: fewer than 10 persons, and either EUR 2 million turnover or EUR 2 million balance sheet total.

5. Does the transition apply? Only for services running on products used lawfully before 28 June 2025, and not past 27 June 2030.

6. Is the accessibility information published, and has the assessment under sections 16 and 17 been documented, if it is relied on?

Testing against the standard is the part that needs engineering. Our custom software development page states that every web app is built to WCAG 2.1 AA, and our QA and test automation service covers testing. Neither is a statement that a given product meets the BFSG.

What we could not confirm

We searched and found no citation of EN 301 549 V4.1.1 in the Official Journal under Directive 2019/882, and the ETSI document says the presumption of conformity applies "once" it is cited. We did not read the MLBF market surveillance strategies page. The date the MLBF started work, 26 September 2025, appears only in the Bundesfachstelle FAQ, which is dated July 2025 in its own header, and not on the MLBF site.

We did not search for case law or enforcement statistics. Two scope questions are open: the FAQ says the B2B exclusion "should" apply to mixed products, and the BMAS guidelines call the lists exhaustive but say nothing more specific about borderline consumer apps, such as one with no contract. EUR-Lex blocked our automated fetch, so we read the Directive text through the EU Publications Office and cite the EUR-Lex page.