Is your online shop in scope of the BFSG? The microenterprise test, and the 2030 date that is not a grace period

The two things most German shop operators believe about the BFSG are both wrong. The first is that being an SME gets you out. The second is that there is a transition period until 2030.

Neither is true, and the second one is costing people the most, because it converts an obligation that has been live since 28 June 2025 into something that feels like next problem.

Most teams get scope wrong in three predictable ways:

• they apply the SME definition instead of the microenterprise one, and exempt themselves at 40 employees,
• they read Article 32 as a grace period for websites, when it is about physical products,
• they check whether the company is in scope, when the Directive scopes products and services one at a time.

This guide is written for the operator or advisor who needs a defensible answer to "does this apply to us", with the article numbers to back it.

• Count persons employed, then check turnover and balance sheet total. The microenterprise test is under 10 staff and (turnover or balance sheet at or under EUR 2 million).
• If you are over either limb, you are in scope. There is no SME exemption in this Directive.
• If you sell physical products as well as running a shop, note that the microenterprise exemption does not apply to products at all.
• Write down the date you did this assessment. Scope changes when you grow, and there is no grace period on crossing the threshold.
• List your surfaces: website, mobile app, checkout, PDFs, support channels. The obligation attaches per service, not per company.

The microenterprise test, precisely

Article 4(5) of the Directive:

Microenterprises providing services shall be exempt from complying with the accessibility requirements referred to in paragraph 3 of this Article and any obligations relating to the compliance with those requirements.

Three things in that sentence do real work.

"Microenterprises", not SMEs. The threshold is fewer than 10 persons employed and either an annual turnover or an annual balance sheet total not exceeding EUR 2 million. An 11-person company with EUR 900,000 turnover is in scope. The familiar SME category, under 250 staff and under EUR 50 million, appears nowhere in this Directive as a carve-out.

"Providing services". There is no microenterprise exemption for products. A four-person hardware manufacturer carries the full Article 7 manufacturer stack: technical documentation, conformity assessment under Annex IV, an EU declaration of conformity, CE marking, and five-year retention.

"and any obligations relating to the compliance with those requirements". The exemption reaches further than the technical requirements. It also clears the Article 13 duties and the Annex V information that carry them, because those are obligations relating to compliance with the paragraph 3 requirements.

What it does not reach: Article 14 and Annex VI (fundamental alteration and disproportionate burden), and Annex I Section VII (functional performance criteria). Those bind every economic operator, and Article 4(5) is services-only.

Real-world example: a nine-person shop with EUR 1.4 million turnover is exempt from Section III and Section IV. It hires two people in March. From the day it crosses the threshold it owes the full service requirement set, with no transitional relief for having recently been exempt.

The 2030 date, and what it actually says

Article 32(1):

Member States shall provide for a transitional period ending on 28 June 2030 during which service providers may continue to provide their services using products which were lawfully used by them to provide similar services before that date.

Read the noun. The transitional period is for products a service provider was already using: a payment terminal on the counter, a ticketing machine in a station, a kiosk in a shop. It is not a grace period for the service itself.

Websites, mobile apps and e-commerce checkouts are services under Article 2(2)(f). They had to comply on 28 June 2025. There is no five-year runway for a website.

The second limb of Article 32(1) does cover contracts: service contracts agreed before 28 June 2025 may continue unaltered until they expire, but no longer than five years from that date. That is a contract wind-down provision, not a compliance holiday.

Article 32(2) lets Member States allow self-service terminals lawfully in use before 28 June 2025 to keep running until the end of their economically useful life, capped at 20 years from entry into use. Germany took 15 years in section 38(2) BFSG, so the German ceiling is 2040, not 2045.

Legalithm materials are operational guidance only and do not constitute legal advice.

What actually applies to an e-commerce service

Scope is not a yes/no on the company. It resolves per service, and for a webshop it lands in a specific and quite small set.

Annex I Section III applies to all services except urban, suburban and regional transport, under Article 4(3). That is the general set: information about the service and its accessibility characteristics across more than one sensory channel, understandable presentation, adequate fonts and contrast, text formats that can generate assistive formats, alternatives to non-textual content, and websites and mobile applications made perceivable, operable, understandable and robust.

Annex I Section IV(g) adds the e-commerce specifics, and there are only three:

1. providing the information concerning accessibility of the products and services being sold, where the responsible economic operator provides it,
2. ensuring the accessibility of the functionality for identification, security and payment when delivered as part of a service instead of a product, by making it perceivable, operable, understandable and robust,
3. providing identification methods, electronic signatures and payment services which are perceivable, operable, understandable and robust.

Point 2 is the one that catches hosted checkouts. If your identification, security and payment functions are delivered as part of your service rather than as a product the customer bought, they are in scope as part of the service.

You do not owe the e-book limbs, the banking limbs, or the transport limbs. Section IV attaches requirements to named service categories, and a webshop gets (g).

Real-world example: a shop embeds a third-party payment iframe and assumes the provider owns its accessibility. The practitioner consensus is the opposite: if you pay for it, control it or embed it, the barrier is inside your service. The remedy is contractual, requiring conformance from the vendor or replacing it, not disclaiming it.

The other Annex I sections, briefly

Two more bind you regardless of the size test.

Section VII, functional performance criteria, is the fallback. Where Sections I to VI do not address a function, that function still has to be accessible by meeting eleven criteria: usage without vision, with limited vision, without perception of colour, without hearing, with limited hearing, without vocal capability, with limited manipulation or strength, with limited reach, minimising photosensitive seizure risk, usage with limited cognition, and privacy. It matters more than usual here, because no harmonised standard is cited in the Official Journal under this Directive.

Article 14 and Annex VI are the exemption machinery, and they are not a size test. They are a documented assessment. More on that below.

If you want the full applicable set for a given profile without reading the Directive end to end, the obligation corpus is published as open data in the legalithm-map npm package, keyed by role, subject kind and service category. A non-microenterprise e-commerce service provider resolves to 77 obligations across the articles and annexes.

What being in scope actually obliges you to do

For a service provider, four duties, all in Article 13:

1. Design and provide the service in accordance with the accessibility requirements, 13(1).
2. Prepare the Annex V information and explain how the service meets the applicable requirements. It must be public in written and oral format, including in a manner accessible to persons with disabilities, and kept for as long as the service is in operation, 13(2).
3. Keep procedures in place so conformity survives changes in the service, changes in the requirements, and changes in the standards, 13(3).
4. On non-conformity, correct it and immediately inform the competent national authorities in every Member State where the service is provided, 13(4).

Duty 2 catches almost everyone. The oral format requirement is explicit in the text and we have not found a single vendor in this market that ships it.

Enforcement, honestly

Germany's market surveillance body, the MLBF in Magdeburg, became operational in September 2025 with around 70 staff, adopted its surveillance strategies in January 2026, and had received roughly 700 complaints and reports by early June 2026. It has published no enforcement statistics and no named fine. Section 37 BFSG provides for fines up to EUR 10,000, and up to EUR 100,000 in defined cases.

The sharper signal is in France. On 4 June 2026 the Judicial Court in Caen ordered Carrefour to make carrefour.fr and its mobile app fully accessible within six months, with a penalty of EUR 500 per day thereafter and EUR 10,000 in damages. The court treated digital accessibility as an obligation of result, and rejected the argument that 71% conformance was enough, analogising to a ramp that has to cover all of the stairs, not most of them.

That last point is the commercially significant one. If it holds, "we are making progress" stops being a defence.

Common pitfalls, and how to avoid them

1. Using the SME definition. Under 250 staff means nothing here. The line is 10 persons and EUR 2 million, and it is an and on headcount with an or on the financial limbs.
2. Reading Article 32 as a website grace period. It covers products a service provider was already using, and contracts agreed before June 2025. Your website was due on 28 June 2025.
3. Assessing the company instead of the service. A microenterprise selling a physical product still carries the full manufacturer stack for that product, because the exemption is services-only.
4. Copying a public-sector accessibility statement. The statement with a feedback mechanism and an enforcement-procedure link is the Web Accessibility Directive instrument. The EAA requires the Annex V information in your terms and conditions or an equivalent document, in written and oral format. Different instrument, different content.

Does the BFSG apply to small online shops?

Only above the microenterprise threshold. A service provider with fewer than 10 persons employed and an annual turnover or balance sheet total not exceeding EUR 2 million is exempt from the Annex I service requirements under Article 4(5) of Directive (EU) 2019/882. There is no SME exemption, so a company with 11 employees is in scope regardless of turnover.

Is there a transition period until 2030 for websites?

No. The 28 June 2030 transitional period in Article 32(1) covers products that a service provider was already lawfully using before that date, such as payment terminals. Websites, apps and e-commerce checkouts are services under Article 2(2)(f) and had to comply from 28 June 2025.

What counts as an e-commerce service under the EAA?

Services provided at a distance, through websites and mobile device-based services, by electronic means and at the individual request of a consumer, with a view to concluding a consumer contract. The "with a view to concluding a consumer contract" limb is what pulls a checkout into scope, and it is also why a purely informational site with no purchase path sits outside this category.

What are the penalties under the BFSG?

Section 37 BFSG provides for administrative fines up to EUR 10,000, and up to EUR 100,000 in defined cases. As of August 2026 no individual BFSG fine has been publicly documented, though the market surveillance body had around 700 complaints on hand by June 2026. In France, a court ordered Carrefour to comply within six months under a EUR 500 per day penalty in June 2026.

Do I need an accessibility statement for the BFSG?

You need the Annex V information, which is not the same document as a public-sector accessibility statement. It goes in your general terms and conditions or an equivalent document, describes how the applicable Annex I requirements are met, must be available in written and oral format, and must be kept for as long as the service is in operation.

Official legal text

• Directive (EU) 2019/882, OJ L 151, 7.6.2019: EUR-Lex HTML · ELI
• Barrierefreiheitsstärkungsgesetz (BFSG): gesetze-im-internet.de
• BFSG-Verordnung (BFSGV): gesetze-im-internet.de
• Marktüberwachungsstelle der Länder (MLBF): mlbf-barrierefrei.de

Disclaimer

Legalithm materials are operational guidance only and do not constitute legal advice. The authentic texts are those published in the Official Journal of the European Union and prevail over this representation in every case.