BFSG market surveillance: how Germany's MLBF checks your website

Since January 2026, Germany has had a dedicated authority that checks whether websites, shops and apps meet the accessibility requirements of the BFSG, the German implementation of the European Accessibility Act. It is called the MLBF, it sits in Magdeburg, and its remit does not stop at the border: whoever offers covered services to German consumers falls under its watch, foreign providers included. The remarkable part: the authority has published its inspection strategy. Nobody has to guess how Germany checks, you can simply read it. This guide covers who the MLBF is, how an inspection unfolds, what its automated scans find and miss, and what to do if a letter from Magdeburg arrives.

Who is the MLBF?

The full name is a mouthful: Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen, the market surveillance authority of the German states for the accessibility of products and services. Behind it stands a public-law institution based in Magdeburg, established on 26 September 2025 by a state treaty of all 16 German states. Around 70 staff monitor compliance with the BFSG for the entire country. So there are not 16 regional authorities with 16 interpretations, but one central body for all of Germany.

The MLBF supervises every product and service the BFSG covers: online shops, banking portals, ticket machines. Whether your offer falls under the law at all, including when you sell into Germany from abroad, is explained in our guide to Germany's BFSG. This article is about what comes next: the inspection. For official information and complaint channels, the authority's website mlbf-barrierefrei.de is the first stop.

Around 70 people for the whole German market: that number explains how the authority works better than any org chart. Nobody in Magdeburg is going to click through millions of websites by hand. So the MLBF prioritises what comes in and automates what can be automated. Its strategy describes exactly these two mechanisms, and both are predictable.

How an inspection starts: complaints first, scans at scale

The MLBF has been in its active inspection phase since January 2026. Its market surveillance strategy, dated 8 January 2026 and adopted on 29 January 2026, is public. For a supervisory authority that is unusually transparent, and it pays to take the document seriously: it describes two routes into an inspection.

Route one, with priority: complaints. Consumers and associations can complain directly to the MLBF under § 32 BFSG, and according to the strategy these complaints are the most important trigger for an inspection. Translated: the shortest path into an official inspection is a user who failed at your website. A blind customer who cannot complete your order form needs no lawyer and no law firm. A report to the authority is enough.

Complaints have a practical advantage for the authority: they point to a concrete barrier at a concrete provider. The examination does not start from zero, it starts with a clear suspicion. For operators the reverse lesson applies: the barrier someone complains about is rarely the only one. Whoever receives a report should check the whole site, not just the reported spot.

Route two: the authority's own scans. In parallel, the MLBF tests actively and systematically. It uses technical inspection software that scans websites for barriers automatically, to find non-conformity at scale rather than only where someone complained. Accessibility expert Marcus Herrmann has analysed the strategy in depth (in German). The short version: waiting for complaints underestimates the second route, because the authority also checks without a specific occasion.

What the automated scans find, and what they miss

The most important nuance in the strategy sits in one word: pre-check. The MLBF's automated scans are not a final verdict but a filter. Automated tests cover only around 30 percent of the WCAG criteria, the success criteria of WCAG 2.2 that the BFSG points to via the European standard EN 301 549. Websites that stand out in the scan are then examined manually, by people, not by software.

What does machine-readable mean? An example: a form field without a label is a blind flight for screen reader users, they hear 'edit text' and nothing else. That the label is missing is something software detects reliably and within seconds. Whether an existing label makes sense is something it cannot judge. The entire division of labour between scan and manual examination follows this pattern.

For practice this means two things. First: what a scan finds are the machine-readable violations. Exactly these errors sit in the shop window during the pre-check, and they are the same ones every other testing tool sees as well.

Second: a clean scan is not the all-clear. Whoever fixes only the machine-checkable points has not touched the remaining roughly 70 percent of criteria and can still fail the manual examination. The reverse also holds: whoever already fails the automated scan signals to the authority that not even the basics are in place. Fixing the machine-detectable errors first, for example re-measuring contrast with the contrast checker, is therefore the logical order: these are exactly the errors that trip the MLBF's pre-check.

A letter from Magdeburg: the escalation ladder

If the authority finds violations, a staged procedure follows. It does not open with a fine, it opens with the chance to fix things. The stages at a glance, as laid out in the BFSG statute:

1. Demand to remedy: the MLBF names the violations it found and sets a deadline for fixing them. This is the normal opening and your best opportunity to end the procedure quietly.
2. Official orders: if the deadline passes without visible improvement, the authority can order concrete measures with binding effect.
3. Fines: under § 37 BFSG, fines of up to 100,000 euros are possible.
4. Prohibition: as a last resort the authority can prohibit the provision of the service. For an online shop that means, in plain words: no more selling to German consumers.

Documentation is worth more here than many think. Keep the letter, export scan reports with dates, record which violation was fixed when. If the authority follows up, documented progress is your strongest argument. A vague reference to work in progress is not one.

If a letter from the MLBF lands in your inbox: keep calm, note the deadline, cross-check the named violations with your own scan and document every fix. Unlike with a warning letter (in Germany: Abmahnung), you are not facing a law firm with a bill, but an authority with a statutory mandate and a staged procedure. Both risks run independently of each other, though: what to do about lawyers' letters is covered in our guide to the BFSG Abmahnung.

Prepare before the inspection happens

The published strategy has a practical side effect: you can test in advance exactly what the authority will test. The two inspection routes dictate the order by themselves.

• Scan your website automatically and find the same class of violations the authority's inspection software sees
• Fix the machine-detectable errors first: alternative texts, contrast, form labels, document language
• Check manually what no scan sees: keyboard operation, reading order, understandable error messages
• Publish an accessibility statement and keep it current, with an honest status instead of wishful thinking
• Offer your own reporting channel for barriers and answer reports quickly
• Re-scan after every release so updates do not introduce new barriers

The last item on the list is the most underrated. Accessibility is not a state but a process: every new template, every plugin update, every hastily added banner can introduce barriers that were not there yesterday. A recurring automated check costs little and prevents your own website from surprising you during an inspection.

A word on the accessibility statement (in Germany: Barrierefreiheitserklärung): it is the first document an inspector opens and the easiest cross-check of all. If the statement claims full conformance while the scan shows twenty images without alternative text, the contradiction is documented within two minutes. What belongs in it is covered in our guide to the accessibility statement requirements.

Frequently asked questions about the MLBF

The MLBF has laid its cards on the table: complaints with priority, automated scans at scale, manual examination where something stands out. Preparation is therefore no longer a guessing game, it is routine work in a known order. The scan above shows you within two minutes what inspection software finds on your website. After that you know more than most of those waiting for the letter.