Turns Out · November 10, 2026 · 11 min read

European Accessibility Act for websites: what's enforceable now and how to check your site in a day

Who the European Accessibility Act covers, what it requires of websites, the WCAG level it maps to today, and a one-day self-check for your site.

The European Accessibility Act has applied since 28 June 2025. 16 months later, the e-commerce sites we audit keep failing the same four things: a checkout you cannot complete with a keyboard, form fields with no programmatic label, placeholder text at 3:1 contrast, and a PDF-only returns policy. None of that is exotic. All of it is now consumer law in 27 countries.

The two questions owners ask us are always the same. Am I covered? And which WCAG level do I actually have to hit? The first has a clear answer. The second is where almost every guide on the European Accessibility Act is out of date, because the standard it points to changed in September 2026 and the law has not caught up yet.

Who the European Accessibility Act covers

Directive (EU) 2019/882 is a product-and-service law, not a website law. Websites come in because the listed services are delivered through them. The ones that matter for most readers:

• —E-commerce services — defined in the Directive as a service provided at a distance, through websites and mobile apps, by electronic means and at the consumer's request, with a view to concluding a consumer contract. If a consumer can buy, book or subscribe on your site, you are in.
• —Consumer banking services — online banking, payment interfaces, account opening.
• —Electronic communications services — telephony and messaging providers and their customer portals.
• —Access to audiovisual media services — the websites and apps that give access to streaming and broadcast content.
• —Passenger transport — websites, apps, e-tickets and self-service terminals for air, bus, rail and waterborne transport.
• —E-books and dedicated reading software.

Three scope rules decide the edge cases. Microenterprises providing services are exempt: fewer than 10 persons and an annual turnover or balance sheet of no more than €2 million. Services only; a microenterprise that manufactures a product in scope still has to comply. Location of the company does not matter: a US or UK store that offers goods to consumers in Germany is offering a service in Germany. Pure B2B is outside: the Directive protects consumers, so a portal where only businesses contract is not covered, though a site with both audiences is covered for the consumer part.

Then there is the transition rule people misread. Article 32 lets service contracts concluded before 28 June 2025 run unchanged until 28 June 2030. That protects an existing contract, not an existing website. A store that went live in 2024 and sells to a new customer today is forming a new contract today.

What the EAA actually requires of a website

Annex I of the Directive sets functional requirements, not a technical checklist. For the website or app through which a service is delivered, the information and interface have to be made perceivable, operable, understandable and robust. Those are the four WCAG principles, word for word, but the Directive stops there.

Two obligations sit on top of the functional ones. Under Article 13, the service provider has to assess how the service meets the requirements and publish that assessment in the general terms and conditions or an equivalent document. In practice that is the accessibility statement, and on the sites we audit it is the most commonly missing artifact. Under Article 14, you may invoke a disproportionate burden or a fundamental alteration, but only after an assessment you document and keep for five years, redone when the service changes or an authority asks.

Which WCAG level the European Accessibility Act maps to

Article 15 of the Directive gives a presumption of conformity to anything that meets a harmonised standard whose reference the Commission has published in the Official Journal. For digital accessibility that standard is EN 301 549, maintained by ETSI, CEN and CENELEC. The chain is EAA → harmonised standard → EN 301 549 → the WCAG version that edition of EN 301 549 incorporates. Here is the state of that chain as of November 2026:

• —EN 301 549 V3.2.1 (March 2021) — incorporates WCAG 2.1 Level A and AA in clause 9. It is the edition cited under the Web Accessibility Directive for public-sector sites, the one every pre-2026 EAA guide points at, and still the only version with any Official Journal citation. Under the EAA itself, nothing is cited yet.
• —EN 301 549 V4.1.1 (2 September 2026) — updates clause 9 to WCAG 2.2 Level A and AA, marks 4.1.1 Parsing as void, and adds Annex ZB mapping the standard to the EAA's Annex I. As we write, it has not been cited in the Official Journal under the EAA. ETSI's planning points to a citation in late 2026; treat that as an expectation and verify at the time of reading.
• —What V4.1.1 adds for a website — six new success criteria: 2.4.11 Focus Not Obscured (Minimum), 2.5.7 Dragging Movements, 2.5.8 Target Size (Minimum), 3.2.6 Consistent Help, 3.3.7 Redundant Entry and 3.3.8 Accessible Authentication (Minimum). The three WCAG 2.2 AAA criteria are informative only.

Our rule for WCAG compliance work is simple: build to WCAG 2.2 AA now. Every WCAG 2.1 AA criterion is still in 2.2, so there is no scenario in which the 2.2 work is wasted, and the six new criteria are cheap compared with the checkout rework most sites need anyway. If a contract or a lawyer insists on naming a level, name “WCAG 2.2 AA, assessed against EN 301 549 V4.1.1 once cited, V3.2.1 until then.”

What is enforceable now

Enforcement is national. Each member state transposed the Directive into its own law, named market surveillance authorities and set its own penalties. Article 30 only requires that penalties be “effective, proportionate and dissuasive”, and Article 29 lets consumers and the organizations representing them take a non-compliant provider before courts or administrative bodies.

Two countries show how concrete this already is. In Germany the Barrierefreiheitsstärkungsgesetz (BFSG) applies from 28 June 2025, and the Länder created a joint enforcement body, the Marktüberwachungsstelle der Länder für die Barrierefreiheit (MLBF) in Magdeburg, fully responsible since 26 September 2025. Section 37 BFSG sets the fines: up to €100,000 for offering a non-compliant service or placing a non-compliant product on the market, and up to €10,000 for the information and documentation offenses. Headline guides quote the €100,000; it is the ceiling for the non-compliant service itself, while paperwork offenses such as missing information sit in the €10,000 group.

In Ireland the Competition and Consumer Protection Commission (CCPC) is the market surveillance authority for all products in scope and for e-commerce and e-books, with sector regulators covering banking, telecoms, transport and media; it says it will take a proportionate approach, with particular support for microenterprises and SMEs.

What we cannot tell you is how many fines have been issued. Vendor trackers disagree, and as of mid-2026 we could not find a primary source confirming a single fine under any national EAA law. The trackers agree on the mechanism, though. Enforcement is complaint-driven, and the complaints come from the places where a disabled customer actually gets stuck: the checkout, the login, the appointment form, the PDF invoice. If your accessibility work has to be prioritized, that is the order.

How to check your site in a day

You do not need an auditor to find out whether you have a problem. 10 checks, each with a one-minute test and the WCAG 2.2 criterion it maps to, run on three pages: home, a product or service page, and the checkout or main form.

• —Keyboard navigation (2.1.1) — unplug the mouse. Tab through the page, open every menu, add to cart, complete the form. Anything you cannot reach or operate is a failure.
• —Visible focus and focus order (2.4.7, 2.4.3) — while tabbing, you should always see where you are, in the visual order. A focus ring hidden by outline: none is the most common fail we see.
• —Contrast (1.4.3) — body text needs 4.5:1 against its background, large text 3:1. Check placeholder text and disabled-looking buttons that are actually enabled; both usually fail.
• —Alt text (1.1.1) — every informative image needs a text alternative; decorative images need alt="". Product photos with alt="image" count as missing.
• —Forms and labels (1.3.1, 3.3.2) — click each label; the matching field should focus. A placeholder is not a label. Required fields must be announced as required, not only colored red.
• —Error messages (3.3.1, 3.3.3) — submit a form empty. The error must be text that names the field and the fix, announced to a screen reader, not only a red border.
• —Captions (1.2.2) — any video with speech needs synchronized captions; auto-generated ones count only once someone has corrected them.
• —Zoom and reflow (1.4.4, 1.4.10) — zoom the browser to 200%: nothing should be cut off. At 400% (roughly a 320 px viewport) content should reflow into one column with no horizontal scrolling.
• —Motion (2.2.2, 2.3.1) — carousels and animations running longer than five seconds need a pause control, nothing may flash more than three times a second, and prefers-reduced-motion should be honored.
• —Language attribute (3.1.1) — the html element needs a correct lang attribute. A German store with lang="en" gets read in an English accent by every screen reader.

Pair the manual pass with an automated scan; axe-core runs from the command line in under a minute per page:

npx @axe-core/cli https://example.com/checkout --tags wcag2a,wcag2aa,wcag21a,wcag21aa,wcag22aa

A few things we advise against. Overlay widgets, the one-line scripts that promise compliance, do not change your HTML, so they cannot fix a missing label or an unreachable button; the Overlay Fact Sheet, signed by hundreds of accessibility practitioners, documents the problems. Do not publish an accessibility statement as a PDF nobody updates; Article 13 expects it to describe the service as it is. Do not treat 2030 as your deadline; it protects old contracts, not your storefront. And do not fix the home page first; fix the path to money, because that is where complaints start.

How this compares with the ADA for US readers

The US has no equivalent of the EAA for private websites. The Americans with Disabilities Act got its first technical web standard in April 2024, and only for state and local governments: the Department of Justice's Title II rule adopts WCAG 2.1 Level AA. In April 2026 the DOJ issued an interim final rule pushing the compliance dates back by about a year, to 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller ones.

For private businesses under Title III there is still no technical standard in regulation; ADA website compliance is enforced through lawsuits, and courts and settlements have typically used WCAG as the benchmark. The practical difference is that in the EU a national authority can act on a consumer complaint and microenterprises are exempt; in the US, Title III applies regardless of headcount and the risk arrives as a lawsuit.

European Accessibility Act questions website owners ask

Does the European Accessibility Act apply to companies outside the EU?

Yes, if you offer in-scope services to consumers in the EU. The Directive regulates the service as provided in the member state, not the provider's registered office. A UK or US store shipping to EU consumers is providing an e-commerce service there.

Do I have to meet WCAG 2.2 for EAA compliance?

Not as a matter of citation yet. No edition of EN 301 549 is cited under the EAA so far; the only cited edition, V3.2.1 under the Web Accessibility Directive, incorporates WCAG 2.1 AA. V4.1.1 with WCAG 2.2 AA was published in September 2026 and is expected to be cited under the EAA soon. Since 2.2 contains everything in 2.1, building to 2.2 AA is the safe choice either way.

Is a B2B website covered by the EAA?

Not for the B2B part. The Directive covers services provided to consumers. A site where only businesses contract is outside scope; a site with a consumer storefront and a trade portal is in scope for the storefront. Member-state laws can go further, so check the transposition in your main market.

Is my existing website exempt until 2030?

No. The 28 June 2030 date in Article 32 applies to service contracts concluded before 28 June 2025. Each new order from a consumer is a new contract, so a live store is in scope today regardless of when it launched.

If you want a second pair of eyes after the one-day check, our accessibility service covers the audit, the Article 13 statement and the fixes. We are engineers, not attorneys. Confirm what applies to you with your lawyer.