The accessibility check: thirty pages, four WCAG tags, no statement of conformity. And what § 14 BFSG requires regardless

What the scan does, read from the code

Page discovery

Input is a domain. The scanner derives the homepage from it and first looks for a sitemap at the usual paths; if it is a sitemap index, it follows the sitemaps linked there. If that yields little, it collects the homepage links. In both cases only addresses on the same domain remain, and the list is cut off at thirty pages. The constant is called MAX_PAGES in the code and is set to 30. A website with three hundred pages is therefore tested to one tenth, and which pages those are is determined by the order in the sitemap.

Testing per page

Each page is loaded in a browser without a user interface until the document is built, with a time limit; a page that does not respond is noted as unreachable without aborting the run. Then axe-core, an open accessibility testing engine, runs with exactly four tags: wcag2a, wcag2aa, wcag21a and wcag21aa. Those are the success criteria of WCAG 2.0 and 2.1 at levels A and AA. Level AAA criteria and WCAG 2.2 are not tested. Each violation carries the rule id, the impact in four levels (critical, serious, moderate, minor), the number of affected elements and up to three locations.

Traffic light and score

Per page a score is formed: it starts at 100 and loses 12 points per critical, 8 per serious, 3 per moderate and 1 per minor violation, floored at 0. The light is red as soon as a critical or serious violation exists, amber for any other violation, and green only at zero violations. Across all reachable pages an average is formed. These rules are in the code as stated; they are a convention of the tool, not a requirement of the statute.

Where the language model sits, and where it does not

No language model takes part in the test itself. Only afterwards does a model receive a condensed list: per rule the id, the impact, a short description and the number of occurrences and pages, never the source of the pages. From that it phrases a remediation for compliance officers per rule, names the WCAG success criterion and marks rules that additionally need manual checking. It does not take the severity per finding from the model but from the scan. The instruction to the model sets the frame: a technical indication, not legal advice, not a certificate of conformity.

What becomes of a finding

Each finding can become a task in one click, carrying the recommendation and legal basis and staying linked to the finding. The check is tied to an active, paid account because it drives a real browser across up to thirty pages. A second, separate step drafts from the scan summary a text of the information the BFSG requires, with placeholders in square brackets which the provider fills in itself.

What § 14 BFSG requires, independently of the scan

Subsection 1: two conditions before offering is allowed

§ 14(1) BFSG reads, in our translation of the German text: “The service provider may offer or provide its service only if 1. the service meets the accessibility requirements of the ordinance to be issued under § 3(2) and 2. it has produced the information under Annex 3 number 1 and has made that information accessible to the general public in an accessible form”. The first condition concerns the service itself. The second concerns a document which the statute does not call a “statement” but “the information under Annex 3 number 1”. Annex 3 requires, among other things, a general description of the service in an accessible format, a description of how the service meets the accessibility requirements, and the name of the competent market surveillance authority. There is no official English version of the BFSG; the German text is authoritative.

A scan contributes to the first condition by testing part of the requirements on part of the pages at one point in time. It contributes nothing to the second condition; the information under Annex 3 number 1 is a text the provider produces and makes accessible, and § 14(2) requires it to be retained “for as long as it offers or provides the service”.

Subsection 3: “at all times”

§ 14(3) sentence 1 BFSG reads: “The service provider shall ensure that the accessibility requirements of the ordinance to be issued under § 3(2) are met at all times when it offers or provides a service.” Sentence 2 requires it to take “due account” of changes to the service, to the requirements and to the harmonised standards. A scan is a statement about thirty pages on one day. “At all times” is a statement about every day. A website changed after the scan is untested from that moment on. The scan therefore does not cover the duty; it supplies a point in time at which the duty was checked, and it has to be repeated to be more than that.

Subsection 4: what a red finding triggers

§ 14(4) BFSG reads: “In case of non-conformity the service provider shall take the corrective measures necessary to bring the service into conformity with the accessibility requirements of the ordinance to be issued under § 3(2). Where the service does not meet the accessibility requirements of the ordinance to be issued under § 3(2), the service provider shall inform without delay the market surveillance authority and the market surveillance authorities of the Member States of the European Union in which it offers or provides the service.” A scan finding is a technical indication, not a determination of non-conformity. Whether a non-conformity within the meaning of subsection 4 exists is an assessment the provider makes, and if it makes it, two duties follow: correction and informing the authority. A tool that delivers red findings should therefore create a task next to every finding, and the task should contain that assessment.

Why a green light is not conformity

Four reasons sit in the mechanism itself. First, the selection: thirty pages out of possibly many, determined by the sitemap. Second, the scope: axe-core tests what can be tested by machine; the model itself marks rules that additionally need manual checking, and what does not exist as a rule at all is not reported. Third, time: the light applies to the moment of the scan, § 14(3) BFSG applies “at all times”. Fourth, the standard: the tags correspond to WCAG 2.0 and 2.1 at A and AA; which requirements the ordinance under § 3(2) BFSG sets in detail and which harmonised standard under Annex 3 number 2 is applied, the scan does not decide. That is why the instruction to the model states that a green status does not mean full conformity, and why the output is called an indication.

Where this article ends

Whether your service falls within the scope of the BFSG, whether an exemption under § 3(3) or § 17 BFSG applies, whether a particular finding constitutes a non-conformity within the meaning of § 14(4) BFSG and whether that triggers the duty to inform the market surveillance authority are questions that require a legal examination of the individual case. CIVAC is not a law firm and does not provide legal advice. This article describes a mechanism from the code and reproduces the wording of the statute; the assessment of your case belongs with your appointed person or with someone authorised to give it.

Frequently asked questions

Does the check test the whole website?

No. It discovers pages via the sitemap or the homepage links and stops at thirty pages. Pages that are not in the sitemap and not linked from the homepage it does not see, nor pages behind a login.

Does a green light mean the website is accessible?

No. Green means that axe-core found no violation of the tested rules on the tested pages at the time of the scan. It is a technical indication, not a statement of conformity, and the duty under § 14(3) BFSG to meet the requirements “at all times” continues to apply regardless.

Does the BFSG require an “accessibility statement”?

The statute does not use that term. § 14(1) no. 2 BFSG requires that the service provider “has produced the information under Annex 3 number 1 and has made that information accessible to the general public in an accessible form”. The term “accessibility statement” comes from the law governing public bodies; for service providers under the BFSG, Annex 3 applies.

Does a red finding trigger the notification of the market surveillance authority?

Not the finding itself. § 14(4) sentence 2 BFSG ties informing the authority to the service “not meeting” the accessibility requirements. Whether that is the case is an assessment the provider makes. The finding is the occasion to make that assessment and record it.

Why does the language model not take part in the test?

So that the test stays reproducible. A violation reported by axe-core can be reproduced at its location. The model receives only the condensed list of rules and phrases recommendations from it; it sees no source and does not decide on severity.