BFSG One Year On: Accessibility Gaps German Shops Face

Since 28 June 2025, the German Accessibility Strengthening Act (BFSG), the national transposition of the European Accessibility Act (EAA), has been binding. One year in, the first enforcement cases are moving, and three accessibility gaps show up in nearly every shop audit. Fines reach up to 100,000 euro per violation, and most gaps are fixable in weeks if your components are clean.

One year of BFSG enforcement: what regulators actually do

Germany's central market surveillance body sits in Magdeburg, with state authorities feeding it cases. Consumer protection groups and the welfare body VdK have filed complaints systematically since summer 2025. activeMind.legal documents in its BFSG guide that complaint volume is now four-digit, and authorities request a formal statement within eight weeks. Miss that deadline and you move into a hearing procedure.

Level Access, in its analysis of penalties for EAA non-compliance, pegs the German upper limit at 100,000 euro per violation. France caps fines at 50,000 euro, Ireland at 60,000 euro. Germany is the strictest market and the largest e-commerce market in the EU. Our earlier piece on the European Accessibility Act in e-commerce holds up: enforcement is targeted, not blanket. For large visible shops the chance of being sampled in any given year sits in the double-digit percent range.

The three gaps German shops still have in 2026

We reviewed audit data from over 40 German mid-market shops in recent months. Three patterns keep repeating.

1. Cookie banners with broken focus traps. Roughly 70 percent of German top-100 shops ship a cookie banner that is a dead end for keyboard users. Press Tab, land in the banner, never get out, because the ARIA modal attribute is misconfigured. Screen reader users do not hear the banner at all. Direct WCAG 2.1.2 violation (No Keyboard Trap), our most common audit finding.

2. ARIA live regions for cart updates are missing. Add an item, visually a mini-cart pops up or a badge updates. Screen readers get nothing. Our estimate: 80 percent ship no aria-live="polite" announcement. Visually impaired buyers abandon because they cannot confirm the action worked. Compliance impact: WCAG 4.1.3 violation (Status Messages).

3. Keyboard navigation breaks in the mega menu. In about 60 percent of mega-menu shops, tab order is not thought through. Sub-menus open on hover but arrow keys do nothing. Tab skips to a footer link. Violates WCAG 2.1.1 (Keyboard) and 2.4.3 (Focus Order) at the same time.

Each gap on its own is fine-relevant. The combination, which is typical, is where risk compounds.

What an audit fix costs, and what it does not

A WCAG 2.2 audit for a mid-sized shop runs between 6,000 and 18,000 euro, depending on depth and template count. Refactoring the three gaps above usually takes 80 to 200 engineering hours, roughly 12,000 to 30,000 euro. Add QA and re-audit, another 4,000 to 8,000 euro. For context: a single fine notice can reach 100,000 euro per documented violation. One average enforcement case already costs more than a full audit-and-fix cycle.

The piece many shops underestimate is not the audit, but the component refactor. If you sit on a monolithic frontend where cart logic, cookie banner and mega menu are tightly coupled, every change is expensive. A composable frontend architecture with isolated components cuts that effort roughly in half.

Why a composable frontend makes BFSG compliance structurally easier

Laioutr is built so accessibility is not patched on top, but baked into every component. Three consequences.

First, our WCAG-ready components ship what audits check for. Cookie banners with correct focus trap, cart updates with aria-live announcements, mega menus with arrow-key navigation. We validate against WCAG 2.2 and already track WCAG 3.0 draft requirements. Background in Accessibility by Design: Why Laioutr is Built for WCAG 3.0.

Second, design tokens for brand consistency keep contrast values centrally managed. When marketing introduces a new color, the token system flags contrast issues in the design system, not in the customer's browser.

Third, the Visual Page Builder validates content at the editing step. Images without alt text, buttons without labels, heading hierarchies with skipped levels are flagged in the studio before publish. Plus we host in the EU and are GDPR-compliant, usually the second question after BFSG comes up.

What conversion and UX teams should do in the next 60 days

1. Run a baseline scan with Axe or Wave. Two hours, first list of hard violations. Not an audit replacement, but a prioritization basis.
2. Fix the cookie banner first. Best risk-reward ratio. A weekend sprint covers it if the banner is isolated.
3. Ship the cart-update announcement. aria-live="polite" plus a short status string. Three to five story points.
4. Live-test the mega menu with keyboard only. Have someone navigate only by keyboard for a week. Toughest practical test.
5. Commission the audit once obvious gaps are closed. Saves you paying for the audit twice.

FAQ

What does a BFSG audit cost for a mid-sized shop? Between 6,000 and 18,000 euro, depending on template count, depth and whether a re-audit after fixes is included.

Which shop size is in scope for BFSG? BFSG applies above 10 employees or 2 million euro annual revenue. Micro-businesses are exempt, B2B shops only partially. The activeMind guide has a clear scoping table.

What fines are realistic? Level Access cites 100,000 euro per violation as the German cap. Early notices sit lower, but risk scales with the number of documented gaps.

Does this apply to US shops with German customers? Yes. Once you sell into the German market, BFSG applies. Hosting location and company seat are irrelevant.

Is compliance one-time or continuous? Continuous. Every new component or content change can introduce a gap. An accessibility validation step in the publishing workflow matters more than a one-off audit.

If 2026 caught you mid-roadmap, the next quarter is the critical window. A WCAG-Ready demo shows in 30 minutes which gaps your stack already solves. More on laioutr.com and the Insights blog.