article Blog & Knowledge

Web Accessibility: Laws, Obligations and WCAG Guidelines

A modern, clear overview – how laws and WCAG are connected and what you should do concretely.

Legal Foundations in the EU and Germany

The European Union has created binding requirements for digital accessibility in recent years. Since 2016, the EU Web Accessibility Directive 2016/2102 has been in effect, requiring public bodies (authorities, offices, etc.) to make their websites and mobile apps accessible [1]. By September 23, 2020 at the latest, all public websites in the EU had to be accessible (mobile apps since June 2021) [1]. However, this directive only applies to the public sector. To advance accessibility in the private sector as well, the EU adopted the European Accessibility Act (EAA) in 2019 [2]. This directive (EU 2019/882 of April 17, 2019) establishes uniform accessibility requirements for certain products and services across the EU for the first time [2]. Member states had to transpose the directive into national law by June 28, 2022 and apply it from June 28, 2025 [2]. In Germany, this was implemented with the Accessibility Strengthening Act (BFSG) [2]. The BFSG was announced on July 22, 2021 and came into force on August 5, 2021 [2]. However, most obligations from it only apply from June 28, 2025 [2] – from this deadline, companies must comply with the new requirements. Important to know: These new rules (EAA/BFSG) supplement existing laws. Public bodies continue to be obligated by the Web Accessibility Directive or in Germany by the Disability Equality Act (BGG) and the Accessible Information Technology Regulation (BITV 2.0) to keep their web offerings accessible. What's new is that many private companies must now also provide accessibility [2]. The BFSG obligates the private sector for the first time to offer certain digital products and services accessibly (e.g., computers, smartphones, online commerce, digital offerings in passenger transport) [2]. The legal standards are based on common EU standards to strengthen the internal market and create uniform competitive conditions [3].

Who is Affected?

Public institutions (federal, state, municipal, public bodies) have already had to make their websites and apps accessible in recent years [1]. Only a few areas were exempt (e.g., pure archive content, some educational offerings, or live broadcast media in certain cases according to EU directive [1]). In Germany, this is regulated by BITV 2.0 for government websites [1]. Private companies are affected by the new BFSG, but not all of them, only those that offer certain products and services to consumers. The law primarily targets cross-company essential areas [2]. According to BFSG/EAA, the following product categories in particular must be accessible from June 2025 [4]:

IT hardware for end consumers (e.g., computers, laptops, tablets) including operating systems [4],
Self-service terminals in transport and service sectors (e.g., ticket, check-in, and ATM machines) [4],
Electronic communication devices (e.g., smartphones, smart TVs for audiovisual services) [4],
E-book readers [4].

The following consumer services also fall under the accessibility obligation [4]:

Telecommunications services (telephone services, messaging, etc.) [4],
Passenger transport services in parts – such as accessible websites/apps for passenger information, ticket booking, etc. [4],
Banking services (online banking and similar electronic banking offerings) [4],
E-books and associated software [4],
E-commerce: all online shops, sales and service platforms, and apps through which consumers conclude contracts or register [4].

In practice, this means: Companies that operate websites or apps to sell products/services to end consumers are generally affected [4]. Even if the service is free (e.g., registration pages), it is considered part of a consumer contract and must be accessible [4]. Micro-enterprises (fewer than 10 employees and ≤2 million € annual turnover/balance sheet) enjoy an exception in the service sector [4] [5]. A small service provider therefore does not necessarily have to meet the BFSG requirements, provided they exclusively provide services and no larger company is behind them [4]. Attention: However, if a micro-enterprise manufactures or distributes one of the above-mentioned products, the accessibility obligation still applies [4] [5]. The legislators want to relieve micro-companies but also advise them to voluntarily implement accessibility [3]. In Germany, for example, the Federal Office for Accessibility provides advice and FAQs [4]. In summary: All public bodies and a large number of private companies are affected, especially in the sectors of e-commerce, transport, communication, banking, online media, and technology manufacturers. Small businesses in the service sector are exempt to avoid excessive burden [4]. Nevertheless, it is also recommended for them to implement accessibility where possible – if only to avoid excluding customer groups.

What Must Companies Do?

Design digital offerings accessibly: Companies must ensure that their websites, online shops, mobile apps, and electronic services meet accessibility requirements [4]. But what does this mean concretely? At its core, it's about designing web content so that people with disabilities can use it without restrictions. The technical standards for this are provided by the Web Content Accessibility Guidelines (WCAG) – more on this below. In practice, the requirements include, for example:

Sufficient contrast between text and background (for visually impaired people) [4],
Zoom and scalability of texts without layout problems (larger font for the visually impaired) [4],
Alternative texts for images so screen readers can read them aloud [4],
Subtitles or transcripts for videos and audio content (accessibility for the deaf) [4],
Keyboard operability: All functions must be usable with the keyboard only, without a mouse (important for users with motor impairments) [4],
Forms and controls must be recognizable and readable by screen readers [4],
Clear, simple language and understandable content (where possible) to reduce cognitive barriers [4].

These and many other criteria largely result from the WCAG guidelines (level AA), which are considered the state of the art for accessibility [6] [1]. It is also important that companies keep this state of the art constantly in view. As technologies evolve, it may be necessary to adapt web offerings or products over time to meet new accessibility standards [5]. The BFSG explicitly requires that products must always be accessible according to the current state of the art as soon as they are placed on the market [5]. Companies should therefore plan regular reviews. Provide accessibility statement: Public bodies already know this – now it also applies to many private providers: An "accessibility statement" must be published on websites and apps [4]. This explains how accessibility is ensured and where deficiencies may still exist [4]. This statement should be easily findable, e.g., in the footer next to imprint or privacy policy [4]. A feedback mechanism (contact option for users to report barriers) was already mandatory for the public sector and is also recommended for companies. Technical proof obligations: The law provides additional obligations for manufacturers of hardware/software. Anyone who, for example, brings a new electronic product (computer, ticket machine, etc.) to market from July 2025 must create an EU declaration of conformity and attach CE marking that confirms the product is accessible within the meaning of the requirements [5]. This requires a conformity assessment procedure as well as technical documentation listing referenced standards and specifications, among other things [4]. Basically, accessibility is treated here as part of product quality and product compliance [5]. Dealers and importers must ensure that manufacturers fulfill these obligations; they may not distribute non-compliant products [4]. These detailed requirements primarily concern industry and trade in devices – for operators of websites/apps, the practical implementation of content accessibility criteria is primarily in the foreground. Additionally, the BFSG requires service providers (such as operators of websites and apps) according to Annex 3 to publish certain accessibility information, e.g., general descriptions of services, explanations of how requirements are met, and indication of the responsible supervisory authority [4]. Often these details can be integrated into the accessibility statement or terms and conditions.

WCAG Guidelines: Standard for Accessible Web Content

The Web Content Accessibility Guidelines (WCAG) are the international standard for accessible web content [7]. They were developed by the World Wide Web Consortium (W3C) [7] and define criteria so that websites, apps, and digital documents are accessible to people with the most diverse impairments [7]. Legally, the WCAG have weight insofar as EU directives indirectly prescribe them: The Web Accessibility Directive refers to the harmonized standard EN 301 549, which essentially contains WCAG 2.1 Level AA [1]. In other words, the EU requires public bodies and now also many companies to comply with WCAG 2.1 AA as a minimum standard [1]. WCAG itself are "only" recommendations from W3C, but through their adoption into laws (via standards) they become de facto mandatory [1]. WCAG structure: WCAG version 2.1 (published in 2018) comprises 4 principles with a total of 13 guidelines and a series of concrete success criteria [7]. The four basic principles of accessible web content are [6]:

Perceivable – Information and UI elements must be presented so that all users can perceive them (e.g., through text alternatives for images, subtitles for audio) [6].
Operable – Controls and navigation must be usable by everyone (e.g., fully operable by keyboard, sufficient time for inputs, no insurmountable time limits) [6].
Understandable – Information and operation of the website must be understandable (clear structure, simple language, predictable behavior of interactions) [6].
Robust – Content must be technically robustly implemented so that it can be reliably interpreted by different user agents (browsers, assistive technologies like screen readers) [6].

Each of these principles is assigned several guidelines that specify the goals (e.g., under Perceivable the guideline to provide text alternatives) [7]. The guidelines in turn have testable success criteria at three conformance levels: A, AA, and AAA [7]. Level A is the basic requirement, AA extends this (AA contains all A criteria plus additional ones), AAA includes the strictest additional criteria. Laws usually require level AA. So complying with WCAG 2.1 Level AA means that all success criteria of levels A and AA must be met (that's a total of 50 criteria for WCAG 2.1; WCAG 2.2 has 55 criteria for AA) [6]. Level AAA is not mandatory and often not fully achievable for all content, but rather to be understood as a best-practice goal [8]. Examples of important WCAG success criteria (Level A/AA) include: Text for images (1.1.1), subtitles for videos (1.2.2), not conveying information through color alone (1.4.1), sufficient contrast of text (1.4.3) and graphical controls (1.4.11), flexible text size (1.4.4), complete keyboard control (2.1.1) and visible keyboard focus (2.4.7), avoidance of content that could trigger seizures (2.3.1), consistent navigation mechanisms (3.2.3), clear labels and instructions for forms (3.3.2) – to name just a few [8] [4]. Behind the number codes are the WCAG criteria; they cover a broad range of requirements to address various disabilities: from visual and hearing impairments to motor limitations to cognitive impairments. Versions: The version currently anchored in legal standards is WCAG 2.1 (from 2018). There is now WCAG 2.2 (released October 2023), which adds some additional criteria [6]. However, this new version is not yet part of EU standards – so far EN 301 549 continues to reference WCAG 2.1 [6]. In the future, WCAG 2.2 or even the WCAG 3.0 ("Silver") in development could become relevant, but for compliance with legal obligations in 2025, WCAG 2.1 AA is the standard. An official German translation of WCAG 2.1 is available (although not W3C-certified) [7]. The WCAG guidelines are technically demanding, but they are supplemented by many explanatory texts, examples, and techniques that help developers and editors implement the criteria [6]. Numerous resources – from W3C itself, but also from bodies like the Federal Office or initiatives – offer guides, checklists, and tests to make websites WCAG-compliant.

Sanctions for Violations

Companies and institutions should take accessibility requirements seriously – not only out of social responsibility, but also because of threatened penalties. The legislator has created mechanisms to enforce compliance:

Fines: In case of violations of the BFSG, authorities can impose significant monetary fines. In Germany, fines of up to €100,000 are provided for [4] [9].
Warnings and lawsuits: Accessibility is a legal market behavior rule – a violation can be warned against as a competitive violation [4].
Orders and distribution bans: Market surveillance can order that a non-accessible product or service be removed from the market [4].
Legal rights for consumers: Users with disabilities can contact supervisory authorities and take legal action [3].

Transition periods and exceptions: As mentioned, June 28, 2025 is the deadline for most products and services. But there are exceptions: Some specific devices received longer deadlines. In Germany, for example, ATMs and ticket machines only have to be retrofitted accessibly by 2040 [2]. Such extended transition periods were granted where immediate retrofitting is considered very complex. Nevertheless: For websites, apps, and most digital services, the grace period ends in 2025. Only existing self-service terminals (e.g., in public transport or banking) sometimes have until 2030 or 2040 [2]. New systems should of course be procured accessibly from 2025.

Conclusion

Digital accessibility has evolved from a "nice-to-have" to a legal obligation. Companies – especially in online commerce, financial sector, transport, or communication – must act now to make their offerings accessible by June 28, 2025 [7]. This includes compliance with WCAG 2.1 AA criteria in web and apps [1], which requires technical and content adjustments. However, the investment is worthwhile: Accessible websites reach more customers (in Germany, about 7.8 million people live with recognized severe disabilities [7], with an increasing trend) and are often more user-friendly for all users. In addition to this market advantage, companies also avoid significant legal risks through compliance – from high fines [4] to warnings [4] to distribution bans [4]. In short: Accessibility is a must from 2025. Companies should inform themselves early and take measures to bring their websites and digital products to the legally required standard. Support is provided by numerous guides and advisory bodies (e.g., the Federal Office for Accessibility [4]). If all stakeholders meet the requirements, ultimately not only people with disabilities benefit, but every user through a more inclusive, comfortable web.