Legal policy set: written before needed, dormant until a context activates

Operator ruling: no external determination in build mode, but keep the
set of legal policies for reuse when a work context needs one in place.

docs/regulatory/policies/ catalogues thirteen, keyed by activation
condition rather than by regime, with a retrieval table so a context
pulls a slice: first real user account pulls six of them; a
consumer-facing product in Germany pulls those plus accessibility. Two
are already active and nobody had noticed — commercial and tax retention,
and the e-invoicing receiving obligation that has been live since 2025
with no named owner in the estate. Four written in full; the rest carry
their trigger now and get their text when a context approaches, which is
the point.

RISK-POL-0011 is the argument for the whole catalogue: accessibility
cannot be retrofitted cheaply, so a policy retrieved at launch is a
rebuild while one read at design time is just a constraint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/regulatory/policies/RISK-POL-0011-accessibility.md

@@ -0,0 +1,60 @@
+---
+id: RISK-POL-0011
+type: legal-policy
+title: "Accessibility of digital services"
+regime: "BFSG (European Accessibility Act, Directive 2019/882), EN 301 549 / WCAG"
+status: dormant
+activates_when: "a consumer-facing digital service or product is offered in Germany — e-commerce, banking, e-books, ticketing, or a consumer app"
+owner: risk-nexus
+written: "2026-08-20"
+cadence: instant
+clean_streak: 0
+last_checked: "2026-08-20T21:30:00Z"
+next_check: "2026-08-20T21:30:00Z"
+---
+
+# RISK-POL-0011 — accessibility
+
+**Dormant, and the most likely of the dormant set to activate.** The estate has
+a consumer domain and design work in it; the day any of that is offered to
+consumers in Germany, this applies in full and without a grace period for new
+services.
+
+## Why it is written before it is needed
+
+Accessibility cannot be retrofitted cheaply. It constrains component choice,
+colour, focus handling, form semantics and content structure — decisions taken
+early and expensively reversed. A policy retrieved at launch is a rebuild; a
+policy read at design time is a constraint like any other.
+
+That is the whole argument for this catalogue existing, and this is the entry
+that demonstrates it.
+
+## What it requires, in outline
+
+- Conformance to the harmonised standard (EN 301 549, which carries WCAG at
+  level AA) for the service's interface, and for its documentation and support.
+- An **accessibility statement**, published, saying what conforms and what does
+  not.
+- Accessibility considered in the product's own conformity assessment, with
+  records kept.
+
+Micro-enterprises providing services are outside scope, which is a real
+exemption and also a fragile one to build on — it disappears with headcount or
+turnover, and the product does not become accessible by growing.
+
+## What it requires of systems
+
+Design-time, not launch-time: semantic markup, keyboard operability, contrast
+and focus visibility, form labelling and error identification, no
+information-by-colour-alone, captions and alternatives for media. Plus a way to
+**test** these that runs before release rather than at it.
+
+## Evidence that would show this is met
+
+A conformance assessment against EN 301 549; a published accessibility
+statement; automated and manual test results in the release path.
+
+Nothing here binds any repo today. `whynot-design` and the consumer-domain
+repos are where it will land, and naming the owner is theirs, not the
+register's.