Uefa bears “primary responsibility” for the catastrophic organisational and safety failures that turned last season’s Champions League final into a horrific, traumatic experience for thousands of supporters, Uefa’s own review has concluded.

That central finding, and alarming criticisms of the culture and operations at the confederation of European football, and of the French police, are made in a damning report produced by the panel Uefa appointed to review the chaos that engulfed the final between Liverpool and Real Madrid at the Stade de France in Paris last May.

Related: Uefa’s report on Champions League final chaos: the main findings

At the report’s heart is a conclusion that Uefa has “marginalised” its own safety and security unit, headed by Zeljko Pavlica, a close friend of the Uefa president, Aleksander Ceferin, in their native Slovenia. The report also strongly rejects claims made persistently by Uefa and the French police and government ministers, that thousands of Liverpool fans without valid tickets caused the problems. The report states that there is no evidence to support such claims, which were made in a “reprehensible” attempt by the authorities to avoid responsibility.

The Paris Préfecture de Police is criticised for not working jointly with other stakeholders organising the final, failing to prevent or remedy congestion on a notoriously problematic access route to the stadium, using “weaponry” such as teargas and pepper spray without sufficient justification, failing to engage with the local community, and “standing by” while supporters were being mugged or physically attacked.

The panel recalls the findings of the French Senate inquiry last year that the Paris chaos should act as a “wake-up call” for improvements before France is considered able to safely host this year’s Rugby World Cup and the 2024 Olympics in Paris. However the Uefa review expresses concern that lessons have not been learned, saying with reference to the evidence of Michel Cadot, the French government official responsible for major sporting events: “Despite Mr Cadot’s willingness to accept that mistakes had been made [at the final], the panel is concerned that there remains a misconception about what actually happened and a complacency regarding what needs to change. This is particularly acute given the proximity of the Rugby World Cup and Olympic and Paralympic Games and the importance of the Stade de France to both events.”

Issuing its conclusions after a six-month investigation into the access delays, congestion, crushing, turnstile closures, brutal policing and criminal attacks by local groups at European football’s showpiece match, the Uefa panel makes clear that the safety failures came close to causing a disaster in which people could have been killed.

“The dangerous conditions on the concourse outside the turnstiles were compounded by the police deploying teargas at disorderly groups of locals, as well as using pepper spray on supporters trying to gain entrance with valid tickets,” the report states. “It is remarkable that no one lost their life. All the stakeholders interviewed by the panel have agreed that this situation was a near-miss: a term used when an event almost turns into a mass fatality catastrophe.”

Related: ‘Terrified’: what Liverpool and Real Madrid fans told Uefa panel

Uefa’s safety and security unit, headed by Pavlica since 2021, played no effective part in planning for the match, nor in dealing with the crisis as it unfolded, the panel found. Although a decision to delay kick-off should be taken by the acting police commander in liaison with Uefa’s safety and security unit and that of the local football association running the game, the report states, Ceferin himself made the decision, in a stairwell of the stadium’s VIP area, where he had been having a meeting with the king of Spain.

The report identifies failures of planning and operations by the Paris Préfecture de Police and the French Football Federation (FFF), to which Uefa almost wholly delegated responsibilities, but makes it emphatically clear that Uefa, which owns the rights and organises the Champions League, was responsible overall.

“The panel has concluded that Uefa, as event owner, bears primary responsibility for failures which almost led to disaster,” it states.

The two public statements Uefa made on the night to explain the delayed kick-off are forcefully criticised. The first, that kick-off was delayed due to “late arrival” of fans, was a prepared statement put up on the stadium screens, that was “manifestly inaccurate”, the report states, and it was a “crass error of judgment” to use it. The second claim, that thousands of Liverpool fans were at the stadium without valid tickets, originated with the French police and ministers, and was given to the media by Uefa at the end of the match. The report reveals that Uefa took out a reference in that statement to local men having caused problems – which was true – at the request of the French authorities.

“The panel concludes that assertions regarding huge numbers of ticketless supporters, and those with fake tickets, have been wrongly inflated and have been stated as fact, to deflect responsibility for the planning and operational failures of stakeholders. This is reprehensible and has involved Uefa, Uefa Events SA [Uefa’s events organising arm], FFF, the Préfecture de Police, government officials and French ministers.”

The panel's 21 recommendations to improve safety and security at finals

1. Uefa should set up a process to ensure that the panel’s recommendations are implemented, including by other stakeholders. Uefa should publish an action plan on its website and regular updates on progress.

2. Uefa should always require that all stakeholders responsible for hosting a Champions League final follow the 2016 Council of Europe “Saint Denis Convention”. It agreed an approach towards supporters based on “safety, security and service” rather than one based on preparing for disorder.

3. Uefa should ensure that its safety and security unit has oversight and primary responsibility for the safety, security, and service component of Champions League final operations.

4. Uefa’s safety and security unit should develop its capacity to “ensure that mobility and access arrangements are as safe and secure as possible for supporters with any disabilities or special needs, and that service to them is optimised”.

5. A host stadium’s safety team should be directly and more fully involved in the planning for a match and making risk assessments.

6. Host stadiums must all have “well-managed security perimeters, welcome services and crowd guidance and orientation”.

7. Uefa should have a formal requirement in the host bidding process that police commit to compliance with the “engagement-focused” approach towards supporters agreed in the Saint Denis Convention.

8. Uefa’s safety and security unit should engage with host police commanders in advance, support access to relevant expertise and invite them to observe quarter- and semi-finals, gaining experience of clubs’ supporters. If problems are identified in the planning phase and cannot be resolved, these should be “escalated to government authorities”.

9. Uefa should move as rapidly as possible to solely digital ticketing, and ensure host venues are fully capable of supporting this. Having both digital and paper ticketing at the Paris final was a factor in causing the long delays and access problems.

10. Uefa should “optimise” its communications and messaging toward supporters regarding the match facilities, mobility, routing and access arrangements. “Above all else it should embed the involvement of supporter organisations and finalist club stewards in its communication strategy, to effectively spread information and urgent messages.”

11. Finalist clubs should have their supporter liaison officers acting as the key contact for supporters. This is already an obligation under the Uefa club licensing regulations.

12. Football Supporters Europe and its affiliated supporter organisations “need to be involved as meaningful stakeholders throughout the planning process” and their representatives need to act as “integrated observers” at the final. They should also be involved in post-match analysis.

13. Uefa should require the host FA to deploy customer service stewards at key parts of the transport network and across the final approach to the stadium, to give guidance to supporters and also provide information to control rooms.

14. Medical and first aid personnel should be always visible and accessible, including at access points, gates and in the stadium concourse.

15. Uefa’s post-match analysis process should be “more analytically and objectively robust”. Uefa should involve external “operational, academic, and supporter-based expertise”.

16: The Council of Europe monitoring committee should review how compliance with the Saint Denis convention can be better monitored and the obligations “more comprehensively enforced”.

17. The panel encourages the authorities in France to follow Council of Europe recommendations and those made by the French government official Michel Cadot, to improve management and oversight of major sporting events across ministries.

18. The French ministries of interior and sport should institute their own review of the policing model at sporting events. This should involve supporters’ representatives, experts and academics. Policing authorities should guarantee they will operate a “supporter engagement” model, and that riot police, teargas and pepper spray will only ever be used, proportionately, where deemed necessary due to a risk to life.

19. French authorities should review policy relating to retaining CCTV footage and other material for the purpose of investigations likely to improve security and public safety. Uefa should address this as a requirement from hosts.

20. Host stakeholders should “undertake robust scrutiny” to ensure their arrangements will comply with the Saint Denis convention. Uefa’s safety and security unit should be involved to ensure that compliance is being achieved during the planning process.

21. Uefa and the Council of Europe monitoring committee should look closely at their capacity to apply some of the above recommendations at other Uefa-governed fixtures besides the Champions League final, to avoid similar dangers developing. David Conn

The panel repeatedly compared these false accusations against Liverpool supporters to the trauma and long campaign against injustice after the 1989 Hillsborough disaster, when South Yorkshire police falsely blamed Liverpool supporters for the catastrophic failures of policing that were the primary cause of 97 people being killed by a crush.

“Assertions that late, ticketless supporters were either the primary cause or contributed to the dangerous events have a particular resonance with Hillsborough, where similar allegations were made … and persisted for decades before being comprehensively disproved,” the report states.

The component elements of the near-disaster itemised in the report confirm the evidence given by Liverpool and thousands of their supporters, and in media reports, including the Guardian’s investigation. Known risks at the Stade de France in enabling safe access for supporters were ignored or forgotten in the planning, and thousands of Liverpool supporters were directed on a route via a subway underneath the busy A1 motorway, to a disorganised checkpoint, that caused a severe bottleneck and congestion.

The panel said it was “particularly unimpressed” with the evidence given to the French Senate hearings by Uefa’s head of events, Martin Kallen, who said Uefa knew the Stade de France well and had staged “several Champions League finals there without any problems, the last one being in 2006”. That was “objectively untrue”, the report states: in fact Uefa’s assessment after that 2006 final had been of “serious interoperability issues with partners, and in particular the police … access problems, and the Stade de France was not a suitable place for a Champions League final”.

Related: How the Champions League final descended into chaos – visual investigation

Kallen also told the panel that he was unaware of problems at the 2016 French cup final on the same access route designated for Liverpool supporters. Kallen said he had “not known about those problems”, even though they prompted a review before the 2016 Uefa European Championship matches held at the stadium.

The checkpoint increasingly failed to cope with the huge numbers of people crammed into the queue, and was abandoned at 7.45pm, the report states. However at the stadium several turnstiles had been closed by stewards, whose level of training is also criticised in the report. The risk of a crushing disaster was highest at that point, the panel found, as large numbers of supporters came on to the forecourt and found static queues.

Groups of young men from the surrounding St-Denis neighbourhood caused a running series of problems for hours around the match. The panel criticises a failure by police and organisers to engage with the community and prepare for antisocial behaviour, and the police responded with teargas and pepper spray, “weaponry” that “has no place at a festival of football”.

The panel found that many Liverpool supporters’ experience of the Hillsborough disaster meant they had heightened awareness of the danger and collectively this helped to avoid a lethal disaster, but they were also vulnerable to increased trauma. Many supporters of both clubs were attacked on the way back after the match, while the police failed to protect them, the report finds.

The panel identified Uefa’s absence from the safety planning and operations of the match as the key element that created a vacuum of responsibility, and said this resulted from a failure of senior leadership. Uefa’s events arm “marginalised” the safety and security unit, and did not follow its own safety requirements, “a recipe for the failures” that occurred.

“Senior officials at the top of Uefa allowed this to happen, even though the shortcomings of its model were widely known at senior management level, as acknowledged to the panel.”

Uefa announced its independent review two days after the final, appointing a former education and sports minister in Portugal, Tiago Brandão Rodrigues, who had previously worked closely with Tiago Craveiro, a Portuguese adviser to Ceferin. In July, after concerns expressed in particular by Liverpool as to the review panel’s neutrality, Rodrigues appointed Kenny Scott, Uefa’s former head of safety and security until his retirement in 2021, the Amsterdam police chief Frank Paauw, Pete Weatherby KC, an experienced barrister in public inquiries who represented 22 bereaved families at the 2014-16 Hillsborough inquests, Clifford Stott, an academic and expert in crowd management and policing, and senior representatives of the English Football Supporters’ Association, Spanish national supporters’ group FASFE, and the umbrella group Football Supporters Europe.

The panel reached its conclusions after gathering written evidence, interviewing relevant officials at organisations including Uefa, the Préfecture de Police, FFF and Liverpool, as well as supporters. Several senior Uefa executives were interviewed, but not Ceferin, who opted to reply in writing, the report stated. The panel said they had received “good cooperation” from the stakeholders but were dismayed that the CCTV at the Stade de France had been auto-deleted because none of the authorities had asked for it to be preserved. The report also states the panel was “very disappointed” that Uefa asked that sections of an interview given by an unnamed senior Uefa executive, relating to evidence they gave to the French Senate, be redacted on the grounds of maintaining their anonymity.

Overall, the review expresses dismay that Uefa and the French authorities continued to maintain their stance of blaming supporters, and failed to take responsibility.

“Subsequently, Uefa has not recognised its own role or that of other stakeholders in the problems on the night,” the report states. It notes that although the statement blaming ticketless fans was removed from its website after requests from Football Supporters Europe and the Liverpool supporters’ trust Spirit of Shankly, Uefa never issued a correction.

The report expresses gratitude to the French authorities for supplying evidence, but says of their approach: “The p[anel is left with a sense of real concern at the lack of insight into what occurred on 28th May and the failure to recognise the role of the authorities. The panel is also troubled by a number of stark differences as to the facts of what happened, and a general default position of blaming the Liverpool supporters, without any proper evidential basis.”

The report makes 21 recommendations for improvements, including for safety and security to be put at the centre of match planning, and matches to be managed with a “facilitation and service” approach towards supporters rather than viewing them as a potential public order problem. The panel calls on Uefa to publish an action plan and regular updates on its progress towards implementing all the recommendations.

Uefa published the report at 7pm UK time on Monday. In a statement, the organisation did not say that it accepted the panel’s findings, saying it was “currently analysing” them “and assessing them against its own analysis of the organisation of the event and facts that occurred around it”. Uefa also said it was “reviewing” the panel’s recommendations “in order to introduce appropriate changes and arrangements to ensure the highest level of safety for fans at future finals”. A “special refund scheme for fans” will be announced shortly, Uefa said.

The Paris police, French government and FFF have been approached for comment.