The first official correspondence on the matter rarely reaches the managing director. It arrives in the general inbox and is forwarded by reception – sometimes to the marketing department, sometimes to the legal department. By the time it reaches the right person, the first week of the response period has already passed. I see this sequence play out regularly in our clients’ projects – and it is the main reason why a harmless complaint later turns into proceedings resulting in a substantial fine. Anyone who has ignored or underestimated the requirement for an accessible website, which comes into force in June 2025, should understand what is actually at stake. In this guide, you’ll find a step-by-step breakdown of the complaint process with the market surveillance authority, a realistic assessment of costs based on current proceedings, and the specific protective measures that hold up in court.
The obligation to provide an accessible website and the real consequences of non-compliance
Since 28 June 2025, the Act to Strengthen Accessibility has required private companies offering consumer services to ensure digital accessibility. Anyone failing to comply with this obligation risks four consequences, which may occur individually or in combination: fines of up to 100,000 euros per breach, an official ban on sales, collective actions seeking an injunction, and competition law warnings from competitors. The colloquial term ‘warning letter’ only loosely covers these cases – in fact, it involves a tiered system comprising administrative proceedings, civil actions and a costly obligation to rectify the situation.
Five ways in which a procedure is triggered
In the procedures I have been monitoring since they came into force, there are five typical triggers. Knowing what these are helps you to identify where your vulnerabilities are most likely to become apparent first.
Firstly, the consumer complaint. A person with a disability, or someone close to them, lodges a complaint with the State Market Surveillance Authority for the Accessibility of Products and Services in Magdeburg. This can now also be done online and is very accessible. The most common issues are checkout processes that cannot be used with screen readers, as well as banking apps with faulty focus control.
Secondly, collective actions. Recognised consumer organisations and organisations representing people with disabilities have the right to bring proceedings under the Injunctions Act. They can bring an action seeking an injunction against a practice that is not accessible, without an individual consumer having to act as the claimant. These proceedings take place before the civil courts and have the advantage of a wide reach – a single organisation can consolidate hundreds of similar infringements. In addition, under Section 32 of the Federal Consumer Protection Act (BFSG), these same organisations may apply to the market surveillance authorities to initiate proceedings and, under Section 33 of the BFSG, may challenge the authorities’ decision before the administrative courts without being personally affected themselves.
Thirdly, the warning letter under competition law. Competitors may issue warnings regarding breaches of the BFSG as breaches of rules of market conduct within the meaning of the Unfair Competition Act. Whilst this has not yet been conclusively clarified in law, attempts have already been made in individual proceedings – with the standard cost consequences under the Unfair Competition Act, i.e. legal and procedural costs borne by the party receiving the warning. Since the summer of 2025, several such waves of warning letters have come to light. Whether BFSG provisions constitute rules of market conduct within the meaning of Section 3a of the UWG has not yet been clarified by the highest court.
Fourthly, the authorities’ investigation into specific cases. Market surveillance authorities may take action on their own initiative, for example following media reports, tips from the professional community or as part of sector-specific targeted campaigns. In such cases, there is no individual complainant; rather, a systematic investigation of an entire sector is carried out.
Fifthly, conciliation. Under Section 34 of the Federal Consumer Protection Act (BFSG), consumers and recognised associations may also refer a matter to the conciliation body established under the Disability Equality Act. This body involves the market surveillance authority and seeks an out-of-court settlement. Any proceedings initiated with the market surveillance authority are suspended for the duration of this process.
What actually happens when a complaint is made to the market surveillance authority
This is the process that our clients want to know about – and which I have outlined based on first-hand experience of the proceedings I have been involved in since the summer of 2025. Seven steps, from the initial correspondence to a possible sales ban.
Step 1: Receipt of the complaint. A complaint is received by the market surveillance authority. It may be accompanied by a detailed explanation or be very brief – the authority is obliged to investigate every plausible report. At this stage, you, as the company concerned, are not yet aware of anything.
Step 2: Preliminary assessment by the authority. The market surveillance authority checks whether the facts presented actually fall within the scope of the BFSG, whether the authority has jurisdiction, and whether there is sufficient initial suspicion of a breach. This phase usually takes between two and six weeks. If it is concluded without any further action, your company will never be informed.
Step 3: Notice of hearing sent to the company. If the authorities consider there to be sufficient initial grounds for suspicion, a notice of hearing is sent to the company concerned. It contains a statement of the facts, a reference to the regulations that have been breached and a deadline for submitting a response – typically two to four weeks. This is when the clock starts ticking for your response.
Step 4: Response period and hearing. You can submit a written response, provide supporting evidence and, if necessary, request an oral hearing. In my experience, this is by far the most important stage: anyone who responds at this stage with an audit report, a documented rectification strategy and a specific timetable often has a genuine chance of bringing the proceedings to a close at the administrative level. Anyone who remains silent or responds with platitudes is only making matters worse.
Step 5: Order to take remedial action with a deadline for rectification. Following an assessment of your response, the authority may issue an order to take remedial action, setting out specific steps to be taken within a specified timeframe. The timeframe depends on the extent of the deficiency and is typically between one and six months. This order is an administrative act – you may lodge an appeal against it, but it is enforceable immediately.
Step 6: Administrative fine proceedings in the event of non-compliance. Anyone who fails to comply with the order, or does so only to an insufficient extent, will face administrative fine proceedings. The fine is determined by the severity of the breach, the financial gain derived from non-compliance and the company’s previous compliance record. The range extends up to 100,000 euros per breach; in cases involving multiple breaches, individual fines can therefore quickly reach six figures.
Step 7: Prohibition on placing a product on the market or providing a service. In particularly serious or persistent cases, the authority may prohibit the placing of a product on the market or the provision of a service – effectively a sales ban. This is the most severe sanction and the one that C-level executives should fear the most. In e-commerce, this means the suspension of the digital sales channel until compliance has been demonstrated.
Practical tip: You can find out how your own website is performing in just a few minutes with Access Score’s free BFSG Check – no registration required, and with an honest assessment based on WCAG 2.2.
What a BFSG claim could actually cost you
If you wish to quantify the risk internally, this overview drawn from audit practice provides a realistic guide. The costs add up – it is not uncommon for companies to end up paying many times the amount of the fine itself.
| Cost factor | Realistic range | Note |
|---|---|---|
| Fine per infringement | €5,000 – €100,000 | Repeat offences and multiple products/domains are counted separately |
| Legal and procedural costs | €5,000 – €30,000 | Increases with the level of escalation and complexity |
| Emergency remediation | €15,000 – €250,000 | Significantly more expensive than planned remediation when under time pressure |
| Loss of sales in the event of a ban | Threatens the business’s survival | In e-commerce: complete loss of turnover until compliance is achieved |
| Damage to reputation | cannot be quantified | Legal proceedings are increasingly covered by the media |
| Consequences of a class action | €10,000 – €100,000+ | Cease-and-desist orders with contractual penalties |
How to ensure you are legally compliant
There is no one-click solution – and I strongly warn you against any provider who promises you that. I have explained in detail why so-called overlay widgets do not structurally eliminate the risk of receiving a cease-and-desist notice in ‘Overlays and one-click solutions: Why they do not resolve the BFSG risk’. What actually works are four complementary building blocks.
Firstly, an in-depth audit followed by a certificate. An automated scan detects 30 to 40 per cent of breaches. The rest can only be identified by an audit involving real users of assistive technologies. The resulting certificate is your strongest evidence of due diligence – market surveillance authorities view it favourably, and so do the courts. You can find out exactly what such evidence must demonstrate in detail in my guide, ‘Certifying Accessibility: What Robust Evidence Must Demonstrate’.
Secondly, an up-to-date and comprehensive accessibility statement. This is required by law, is publicly available, and is the first thing that market surveillance authorities check. A generic template that does not specify particular shortcomings, a timetable or a feedback mechanism is worthless in the event of a dispute – and can sometimes even be detrimental, as it contains inaccurate declarations of conformity.
Thirdly, continuous monitoring. A website is not a static entity. CMS updates, new plugins, marketing campaigns with their own landing pages – any of these changes can introduce new barriers. If you carry out an audit once and then don’t keep an eye on things, you’ll often find yourself back in a situation where the site is non-compliant within six months. I explain exactly how to do this in WordPress in the article ‘Making WordPress accessible’.
Fourthly, documented due diligence. Audit report, action plan, training certificates, version history of your accessibility statement. This documentation is what you can submit during the hearing procedure – and it is the difference between a complaint being dropped and a fine being imposed.
If you’ve already received a letter from the market surveillance authority in your letterbox
If you’re reading this article because you’ve already received the hearing notice, you should take the following five steps within the first 72 hours.
- Make a precise note of the deadline for submitting a response and, if possible, request an extension. Authorities usually grant a justified extension of two weeks.
- Have the issues raised technically verified. Can the auditors reproduce the alleged deficiency? If so, to what extent?
- Identify immediate measures that can be implemented within the deadline. Even a partial rectification will be viewed positively by the authority.
- Draw up an action plan with a realistic timeframe that also addresses the issues which cannot be rectified within the deadline.
- Do not send your response without first having it reviewed by a lawyer. Any admission or voluntary disclosure may later be used as evidence.
Received a warning letter from the BFSG: How to respond correctly
Not all post comes from the authorities. More often than not, a warning letter from a solicitor ends up in your letterbox, usually accompanied by a pre-drafted cease-and-desist declaration, a bill for costs and a short deadline. Follow these steps in this order:
- Make a note of the deadline and keep calm. The deadline is often tight, but a hasty reaction will cost you more than a day’s time spent reviewing the matter.
- Do not sign the cease-and-desist declaration without checking it first. It is usually a permanent commitment, carries a contractual penalty and is often worded more broadly than necessary.
- Have the authority to issue a warning checked. Under Section 8 of the Unfair Competition Act (UWG), only competitors, qualified business and consumer associations, and chambers of industry, commerce and trade may issue warnings. Mass-produced, identical warnings may constitute an abuse of the law (Section 8c UWG).
- Carry out a technical review of the allegation. Have the barriers in question replicated by experts before you admit to anything.
- Rectify and document the barriers. Regardless of the outcome, this reduces your risk in the event of any further warning letters or inspections by the authorities.
- Coordinate your response with a solicitor. If a warning letter is unjustified, you may, under certain circumstances, be entitled to claim back the costs of your legal defence (Section 13(5) of the UWG).
People often look for a template for their reply. However, a template is no substitute for assessing your specific circumstances, as whether a warning letter is justified depends on your offer, the sender and the specific allegation. This article does not constitute legal advice.
Not sure exactly what the BFSG means for your business? In 30 minutes, we’ll work with you to clarify which obligations apply and what you should tackle first.
Frequently asked questions about BFSG warnings and inspections
How much is the fine under the BFSG?
Up to 100,000 euros. The amount depends, amongst other things, on the severity and duration of the breach. In addition, market surveillance authorities may issue orders, which may go as far as prohibiting the provision of the service.
Who monitors compliance with the BFSG?
Responsibility lies with the State Market Surveillance Authority for the Accessibility of Products and Services (MLBF) in Magdeburg, which is jointly funded by all 16 federal states. It has been operating nationwide since September 2025, investigating reports from consumers and, in addition, carrying out checks in line with a multi-year strategy focusing on specific areas.
Who is authorised to issue warnings under the BFSG?
Under Section 8 of the Unfair Competition Act (UWG), this generally includes competitors, recognised trade and consumer associations, and professional chambers. Whether competitors are permitted to issue warnings regarding BFSG infringements has not yet been decided by the highest court. Recognised associations may also bring injunctive relief proceedings and request that market surveillance authorities initiate proceedings.
Structural protection: Access Protect
Anyone who takes the preparatory work seriously faces a significantly lower risk of legal proceedings – and stands a better chance in court. What they do not have, however, is protection against the consequences should proceedings go ahead despite all due care. It is precisely this gap that Access Protect, our contractually guaranteed protection against warning letters and liability, fills. In the event of a BFSG-related claim or administrative proceedings, we and our partner law firms handle the entire process: legal representation, negotiations with the authorities and payment of any fines imposed, within the contractually agreed limits.
It is important to be clear about this: Access Protect is not a standalone product. It requires a valid Access Ready certificate and active Access Guard monitoring. We cannot accept any liability for applications that we have not audited ourselves and whose status we do not monitor on an ongoing basis. That is the difference between genuine insurance against residual risk and an empty marketing promise, such as those peddled by some overlay providers on the market.
Anyone who is just starting out and simply wants to find out the current state of their website should begin with the free Access Score. Anyone wishing to take the next step towards robust evidence should start with Access Ready. And anyone who, at the end of this journey, wants the protection offered by a contract should opt for Access Protect. In this order, and no other.
