What market surveillance actually does — read in the authority’s own strategy

The European Accessibility Act (Directive (EU) 2019/882) leaves enforcement to the member states. Germany transposed it as the Barrierefreiheitsstärkungsgesetz (BFSG), and the federal states set up a joint body for it: the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen, a public-law institution known as the MLBF, based at Carl-Miller-Straße 6 in 39112 Magdeburg. It supervises nationwide — there is no per-state jurisdiction, and therefore no difference between North Rhine-Westphalia, Bavaria and Saxony.

The BFSG has applied since 28 June 2025. The statute knows no grandfathering for existing websites: § 1(3) turns on whether a service is provided to consumers after that date, not on when the website was built.

What the MLBF states it does not provide: legal advice. Its statutory mandate, it writes, does not include “legal advice by the market surveillance authority”; it does publish information for the public and about its own work and decisions. Advising micro-enterprises is instead expressly the task of the Federal Agency for Accessibility (§ 15 BFSG).

The MLBF also has an advisory board in which disability organisations and business umbrella associations sit together — among them the German Disability Council, the German Confederation of Skilled Crafts, the Association of German Chambers of Commerce, Bitkom and the German Publishers and Booksellers Association. That is not a footnote: the authority’s priorities are professionally accompanied in this body.

In the chapter on market penetration it reads, in the original German: „Zur effizienten Durchdringung des Markts setzt die MÜB insbesondere bei webbasierten Dienstleistungen auf automatisierte Vorprüfungen. Durch den Einsatz technischer Prüfsoftware ist es möglich, eine deutlich größere Anzahl an Dienstleistungen in der Breite zu erfassen, als dies durch rein manuelle Prüfungen möglich wäre.“ In English: to penetrate the market efficiently, the authority relies on automated preliminary checks, particularly for web-based services; using technical testing software makes it possible to cover a far larger number of services than purely manual testing would allow.

Consistently with that, the same document lists the “results of automated preliminary checks” among the risk factors for active market surveillance — alongside user reach, company size, relevance for independent living, complexity and interactivity of the service, public user feedback and market trends. The corresponding strategy for products does not contain this item; it is specific to the services part, and web-based services are named explicitly.

That substantiates what has so far only been asserted: the competent authority does not check websites only when someone complains, and it does not check them only by hand. It uses testing software to achieve breadth — and the results of those preliminary checks feed into the selection of what it then examines more closely.

And now what the document does not say. It gives no date. It gives no scope, no number of sites checked, no tool name, no threshold at which a finding is pursued. Anyone writing “automated scanning starts in the third quarter of 2026” did not take that from a source but invented it. We know this precisely because that claim stood twice in our own texts and had to be removed twice after we failed to find it at the source.

And a preliminary check remains a preliminary check. It is the filter in front, not the examination itself. What the actual examination has to look like is laid down in the statute — see the next section.

§ 29 BFSG sets out three stages for services. If the authority concludes that the requirements are not met, it requires the service provider without delay to take suitable measures within an appropriate deadline it sets (subsection 1). If that produces nothing, it issues a second demand, this time threatening prohibition, again with an appropriate deadline (subsection 2). Only then does it take the necessary measures and may in particular order that the offering or provision of the service be discontinued (subsection 3). If the provider demonstrates that conformity has been established, the authority lifts the order.

The market surveillance strategy describes exactly this staged model again in its own words and expressly places it under the “principle of proportionality”: first a demand to correct, then restriction and prohibition, then a fine.

On the size of fines: § 37(2) BFSG names up to 100,000 euros — but only for the cases listed in subsection 1 nos. 1, 7, 8, 9 and 10. For a shop operator, no. 8 is the relevant one: offering or providing a service that does not meet the requirements of the implementing regulation (§ 14(1) BFSG). In all other cases — including the information and disclosure duties — the ceiling is up to 10,000 euros. Both figures are the upper limits of a range, not standard amounts.

One point of perspective: an administrative offence requires intent or negligence (§ 37(1)). And the staged procedure means that at least two set deadlines lie between first contact and a prohibition. That is the difference between supervision and a trap — and the reason why alarmism on this subject is not merely unattractive but simply inaccurate.

There is no minimum level of control. The strategy says so itself: because the BFSG has only applied since 28 June 2025, there are “no historical data on case numbers or defect rates for the current strategy period” from which a quantitative minimum could be derived. The focus therefore lies on securing responsiveness and on building a qualitative data base. Anyone claiming the authority checks “X shops per month” is inventing a figure that, by the authority’s own account, does not yet exist.

There is no European reporting system for services. For products, authorities report non-conformities to the Commission and the other member states via the Federal Institute for Occupational Safety and Health. For services the strategy expressly states that a formalised reporting system via central EU databases such as ICSMS does not follow from the BFSG and is not currently envisaged; cooperation takes place case by case.

The testing methodology in detail is not published. Which software is used, with which rule sets, at what point a preliminary check turns into a proper examination — none of that appears in either document. We do not guess.

What is known is how priorities are set. For active market surveillance the strategy names above all relevance for independent living and market penetration — where a service has high user reach, a lack of accessibility affects many. For a local or sectoral monopoly, high market penetration is assumed even if absolute user numbers are small. And anyone who has already come to notice, or has shown little willingness to cooperate, is “monitored as a priority” and rated higher in risk.

The picture that emerges is sober. The authority works on a risk basis, in stages and with limited means — and for websites it uses testing software simply to achieve breadth. No looming threat. But also not the calm that many read into the fact that they have heard nothing so far.