UEFA-appointed investigators have said European footballing's ruling body bears the "primary responsibility" for chaotic security failures at the 2022 Champions League final in Paris that put the lives of Liverpool and Real Madrid fans at risk.

"It is remarkable that no one lost their life," the investigation panel wrote in a 220-page document published Monday regarding a near "mass fatality catastrophe" at the biggest club game in world football.

"The panel has concluded that UEFA, as event owner, bears primary responsibility for failures which almost led to disaster," the report said.

A failed security operation saw tens of thousands of fans held in increasingly crushed queues for hours before the May 28 game at the 75,000-capacity Stade de France, which is a key venue for the 2024 Paris Olympics.

Many fans were fired on with tear gas by police before the game, which was delayed by nearly 40 minutes. After Madrid's 1-0 win, dozens were robbed leaving the stadium by local residents in the impoverished Saint-Denis neighborhood.

UEFA statements during the chaos and after the game blamed Liverpool fans for arriving at the stadium late and using fake tickets to try to gain entry _ wrongly blamed on both counts, the report said.

An apology to Liverpool supporters for "the experiences of many of them'' and the unjust blaming was made Monday by UEFA general secretary Theodore Theodoridis.

The panel, appointed seven months ago by UEFA, aimed blame Monday at leadership of both the soccer body and its commercial subsidiary UEFA Events, and French public authorities.

"UEFA's lack of oversight upon delegation of private safety and security matters, deference of all such matters in the public space to policing authorities, and simply not following its own safety, security and service requirements, was a recipe for the failures which occurred,'' the report said.

"Senior officials at the top of UEFA allowed this to happen, even though the shortcomings of its model were widely known at senior management level.''

The long-time CEO of UEFA Events, Martin Kallen, is named often in the report, including as a representative at security planning meetings, and is broadly criticized by the panel.

UEFA's Head of Safety & Security Operations, Zeljko Pavlica, who was at the game, is not identified by name in the 220 pages.

"On the evidence, the panel has concluded that the senior management of UEFA Events marginalized the UEFA S&S Unit,'' the report said. French police were blamed in the report for wrongly assuming that Liverpool fans posed a threat to public order, and for using "weaponry'' like tear gas and pepper spray.

The head of the Paris police operation at the game, Didier Lallement, retired about six weeks later.

The report team was chaired by a former sports minister of Portugal, Tiago Brandao Rodrigues, and included match security experts who formerly worked for UEFA and fan groups.

They criticized French public officials for an ongoing "misconception about what actually happened and a complacency regarding what needs to change.''

"This is particularly acute given the proximity of the (2023) Rugby World Cup and Olympic and Paralympic Games and the importance of the Stade de France to both events,'' the report said. The Champions League final was moved to Paris at three months' notice after UEFA stripped Russia of hosting the game in St. Petersburg because of the military invasion of Ukraine.

The report also said "several key stakeholders have not accepted responsibility for their own failures but have been quick to attribute blame to others.''

"Institutional defensiveness, putting reputation and self-interest above truth and responsibility, prevents progressive change,'' the report said. "A healthy organization welcomes scrutiny and criticism based on evidence, an unhealthy one hides behind prejudice and baseless assertions, and contributes to a carousel of blame, where it is everyone else's fault.''

A law firm representing more than 600 Liverpool supporters said those affected were due compensation.

"Liverpool fans have waited eight months for answers as to how and why the horrific events they experienced on 28 May 2022 unfolded," Clare Campbell and Jill Paterson, partners at Leigh Day, said.

"While we have not seen a full copy of the report, early indications suggest that its conclusion echoes what Leigh Day have said all along, fans were seriously let down by UEFA. "At this stage, we still strongly believe that UEFA need to compensate Liverpool fans for their experience on the day and the losses, suffering and injuries they have experienced and continue to deal with.

The investigation panel said they agreed with the view that "collective actions of (Liverpool) supporters was probably instrumental in protecting vulnerable people and averting what might well have been more serious injuries and deaths.''

UEFA pledged Monday to "announce separately a special refund scheme for fans.''

The next Champions League final is hosted in Istanbul, Turkey, on June 10.