Who is exempt — and who only appears to be

§ 3(3) sentence 1 BFSG reads: “Subsection 1 does not apply to micro-enterprises that offer or provide services.” Subsection 1 is the core duty — products and services must be accessible. A micro-enterprise offering a service is exempt from that core duty.

Who counts as a micro-enterprise is set out in § 2 no. 17 BFSG, and here careful reading pays: “an enterprise which employs fewer than ten persons and which either has an annual turnover of no more than 2 million euros or whose annual balance sheet total does not exceed 2 million euros”. This mirrors Article 3(23) of Directive (EU) 2019/882.

So there are two conditions, not three. The headcount is mandatory — it must be below ten; ten is not enough. The financial part, by contrast, is an “or”: it is sufficient that one of the two figures stays at or below 2 million euros. A business with 3 million euros of turnover but a balance sheet total of 1.8 million still meets the definition. Summaries that write “fewer than 10 employees and no more than 2 million turnover” cut a corner at exactly that point — and exclude businesses that the wording includes.

Two qualifications belong with this. First, by its wording the exemption applies only to micro-enterprises offering or providing services. Anyone manufacturing, importing or dealing in products within the meaning of § 1(2) BFSG is not exempt; for such micro-enterprises the act merely provides relief from documentation and notification duties (§ 16(4), § 17(2) sentence 3).

Second, the statute does not say how “persons” are to be counted — heads, full-time equivalents, with or without temporary staff, with or without the management. We assert no counting method here, because the BFSG contains none. Anyone hovering around the figure ten should have the question settled rather than answer it themselves: everything else depends on it.

1. Content the act does not cover (§ 1(4) BFSG). Excluded are: pre-recorded time-based media published before 28 June 2025; office file formats published before the same date; online maps and mapping services, provided that essential information for navigational maps is available accessibly in digital form; third-party content that the economic operator neither finances nor develops nor controls; and content qualifying as an archive because it is neither updated nor revised after 28 June 2025.

In practice: a product video uploaded in 2023 without captions is not caught — one uploaded in 2026 is. And an embedded third-party review widget is exempt only for as long as you neither pay for it nor control it; with a paid service, that is precisely the open question.

2. Fundamental alteration (§ 16 BFSG). The requirements apply only in so far as compliance does not require a significant change that results in a fundamental alteration of the basic nature of the service. Anyone relying on this must carry out the assessment themselves, document it, keep it for five years and notify the market surveillance authority without delay.

3. Disproportionate burden (§ 17 BFSG). Not a self-service counter either. The assessment follows the criteria in Annex 4, must be documented and kept for five years; a service provider must repeat it at least every five years, additionally whenever the service changes and whenever the competent authority so requires. And subsection 4 contains a clause that is easily overlooked: anyone receiving external public or private funding to improve accessibility may not invoke disproportionate burden. Taking a grant closes that door.

Both exemptions are verifiable, and they are verified: § 28(3) BFSG expressly obliges the market surveillance authority, where § 16 or § 17 is invoked, to check whether the assessment was carried out at all, whether the criteria in Annex 4 were applied correctly, and whether the remaining requirements are met. An undocumented claim of “disproportionate” is therefore worse than none.

Micro-enterprises are exempt from the notification duty in § 17(5) (sentence 2) — though as a rule they do not need it, because § 3(3) already applies to them.

§ 14(1) BFSG names two conditions under which a service provider may offer or provide a service at all. First, the service must meet the accessibility requirements of the implementing regulation (BFSGV). Second, the provider must have produced the information under Annex 3 no. 1 and made it publicly available in an accessible form. That is the much-cited “accessibility statement” for businesses — a different document from the statement required of public sector bodies.

Subsection 3 requires that the requirements be met at all times, and expressly names changes in the way the service is provided, changes in the applicable requirements and changes in the harmonised standards as matters to which the provider must “give due regard”. Conformity is therefore a continuing state in the statutory text itself, not a project with an end date.

Subsection 4 covers non-conformity: take the necessary corrective measures — and inform the market surveillance authority without delay, with details of the nature of the non-conformity and the measures taken. Subsection 5 requires information and cooperation upon the authority’s reasoned request.

What has to be fulfilled in substance is set out not in the BFSG but in the BFSGV. § 12 BFSGV contains the general requirements for services, § 19 BFSGV the additional requirements for services provided by electronic commerce: information on the accessibility of the products offered for sale, in so far as the responsible economic operator makes it available, plus identification, authentication, security and payment functions designed to be perceivable, operable, understandable and robust.

And how does one measure “perceivable, operable, understandable and robust”? § 3 BFSGV refers to the state of the art and obliges the Federal Agency for Accessibility to publish the relevant standards and conformity tables. § 4 BFSG adds the presumption of conformity: where products and services conform to harmonised standards whose references have been published in the Official Journal of the European Union, they are presumed to meet the requirements — in so far as the standard covers them. The relevant standard for websites is EN 301 549, which for web content points to WCAG 2.1 Level AA. That is why we test against that standard and not against a list of our own: it is the only one that triggers the presumption.