Germany's EAA Enforcement: Regulatory Fines and Competitor Litigation
Germany runs two enforcement tracks at once — a regulator that can fine up to €100,000, and a competitor-driven cease-and-desist system that moves faster and ignores the grace periods. Here's how both work, from the BFSG itself.
Quick answer
Germany's EAA law (the Barrierefreiheitsstärkungsgesetz, BFSG) is enforced two ways. The market-surveillance regulator, the MLBF, can impose fines of up to €100,000 under § 37 BFSG. Separately — and this is what makes Germany unusual — competitors and qualified associations can send cease-and-desist letters (Abmahnungen) over accessibility breaches. That second track is faster, already active since mid-2025, and not bound by the law's grace periods — though many individual letters are legally shaky.
The two tracks, in plain English
Most EU countries enforce the EAA through a regulator. Germany has that and a second, private route — and for many businesses the second one is the more immediate risk.
Track one — the regulator (MLBF). The Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen is a single joint body run by all 16 German states from Magdeburg. It can investigate, demand documentation, order fixes, restrict or ban a non-compliant product or service, and levy fines.
Track two — competitors (Abmahnung). Under German unfair-competition law, a business that breaks the BFSG can also be treated as gaining an unfair advantage over rivals. That lets competitors — and certain trade and consumer associations — send a formal warning letter demanding you stop, plus a settlement fee. No regulator is involved, and it can happen the moment you're non-compliant.
| Regulator (MLBF) | Competitors (Abmahnung) | |
|---|---|---|
| Who acts | The joint market-surveillance body of the 16 states | Competitors and qualified trade or consumer associations |
| What you face | Orders to fix, market restriction or ban, fines | A cease-and-desist demand plus a settlement fee |
| Maximum | €100,000 (core breaches) / €10,000 (other breaches) | No statutory cap; settlements often around €600–€1,000+ |
| Grace periods apply? | Yes | No |
| Legal basis | § 37 BFSG | §§ 3a, 8 UWG |
What the law actually says
The regulator's fines are set in § 37 BFSG:
"Die Ordnungswidrigkeit kann in den Fällen des Absatzes 1 Nummer 1, 7, 8, 9 und 10 mit einer Geldbuße bis zu hunderttausend Euro und in den übrigen Fällen mit einer Geldbuße bis zu zehntausend Euro geahndet werden."
("The administrative offence may, in the cases of paragraph 1 numbers 1, 7, 8, 9 and 10, be punished with a fine of up to one hundred thousand euros, and in the remaining cases with a fine of up to ten thousand euros.")
— § 37(2) BFSG (Gesetze im Internet)
So the ceiling isn't a flat €100,000 — it's tiered. The €100,000 maximum applies to the core breaches: placing a non-compliant product on the market, making one available, offering a non-compliant service, and CE-marking violations. The lesser €10,000 maximum covers information and documentation failures.
How the regulator (MLBF) enforces
The MLBF works like a product-safety regulator. In practice that means: it investigates (often on a complaint), requests your accessibility documentation, and issues a corrective order — typically with a short remediation deadline (around 10 days) before it escalates. If you don't fix the problem, it can restrict or prohibit the product or service, and impose the § 37 fine.
Crucially, the BFSG's transitional periods — for example, a grace window running to 2028 for services already offered before 28 June 2025 — protect you from regulatory fines during that time. But, as the next section explains, they do not protect you from the competitor track.
The competitor track (Abmahnung) — real, but handle with care
This is the part of the German market that's genuinely different, and it needs careful, honest framing.
The legal basis exists. German courts and legal commentary generally treat BFSG duties as "market-conduct rules" under § 3a of the Unfair Competition Act (UWG), which means a breach can also be an act of unfair competition. Standing to send an Abmahnung (§ 8 UWG) is limited to actual competitors and qualified trade or consumer associations.
A wave started fast. The first BFSG Abmahnungen appeared roughly six weeks after the law took effect, concentrated on e-commerce. A typical letter alleges an inaccessible site (sometimes backed only by a screenshot), asserts an injunction claim, and offers to settle — often for around €600–€1,000+ — in exchange for a cease-and-desist declaration and a few months to fix things.
But many are legally weak. German competition lawyers widely note that a large share of these letters don't hold up: they fail to specify the concrete violation (a formal requirement under § 13(2) UWG), or the sender can't prove a genuine competitive relationship. The standard advice is don't sign or pay without legal review.
The catch on grace periods. An Abmahnung can be sent at any time — the BFSG's transitional periods don't apply to it. And relaunching a site or shipping a new feature can forfeit any "grandfathered" status, exposing you immediately.
Has it been enforced yet?
Both tracks are live. The MLBF began operating when the law took effect on 28 June 2025; large regulatory fines take time to work through, so few (if any) have surfaced yet. The Abmahnung track, by contrast, has already produced a measurable volume of letters — which is exactly why Germany carries more near-term legal exposure than most EU markets, even though it applies the same technical standard (EN 301 549 / WCAG 2.1 AA) as everyone else.
What this means for your business
Germany is the market where "we'll wait and see if regulators act" is the wrong instinct — because the pressure doesn't only come from regulators. If you sell into Germany, two things matter now: get to EN 301 549 / WCAG 2.1 AA with real testing (German authorities are explicit that automated scans alone don't prove compliance), and have a plan for what to do if an Abmahnung lands — namely, get it reviewed rather than reflexively paying. Keeping dated audit documentation is your best defence on both tracks.
Frequently asked questions
How big is the German EAA fine?
Up to €100,000 for the serious breaches and up to €10,000 for lesser ones, under § 37 BFSG, imposed by the regulator (MLBF).
Who enforces the BFSG?
The MLBF, a single joint market-surveillance body for all 16 German states, based in Magdeburg — plus the separate competitor/association Abmahnung route under competition law.
Can competitors really act over accessibility in Germany?
They can send cease-and-desist letters (Abmahnungen), and the legal basis is recognised — but many individual letters are legally questionable, so they should be reviewed, not automatically paid.
Do the grace periods protect me?
Only from regulator fines. They do not stop a competitor Abmahnung, which can be sent at any time — and a site relaunch can end grandfathered status.
Related
- ← Back to EAA Fines by Country — the full 27-state comparison
- Sweden's EAA fines — a regulator-only market, with no competitor-lawsuit route
- How we verified all 27 national laws — our sourcing method
