The first serious accessibility pressure on European e-commerce didn't come from a regulator. Reporting indicates that in Germany, operators began receiving warning letters from law firms shortly after transposition — because German competition law lets private parties pursue non-compliance as an unfair competition claim. Businesses watching official enforcement channels were watching the wrong one.
This article is general information about a regulatory landscape, not legal advice. Obligations vary by member state and by what you sell — take advice on your specific position.
What the Act actually requires
Briefly, since the specifics matter more than the summary.
Directive (EU) 2019/882 became enforceable on 28 June 2025, after a transition period many organisations treated as optional. It covers a defined set of products and services sold to EU consumers — explicitly including e-commerce, banking services, e-books, transport ticketing and telecoms.
The technical benchmark is EN 301 549, the harmonised European standard, which incorporates WCAG 2.1 Level AA for web content. That's unusually helpful as regulation goes: the target is a documented, testable standard rather than a matter of interpretation. If your site doesn't meet WCAG 2.1 AA, you have a specific, auditable answer to where you stand.
Two scope points that catch people out:
It follows the market, not the company. Like data protection rules before it, the Act applies to any business placing covered products or services on the EU market, regardless of where it's registered. An e-commerce operation shipping into the EU with no European entity is still in scope.
The microenterprise exemption is narrower than assumed. It requires fewer than ten employees and turnover or balance sheet total not exceeding €2 million — both conditions, not either. Eight staff with turnover above the threshold is not exempt.
What actually happened in year one
The honest summary: enforcement is real, uneven, and mostly hasn't looked like fines yet.
| Where | What was reported |
|---|---|
| Germany | Private warning letters to e-commerce operators via unfair competition law; authorities reportedly testing sites proactively rather than awaiting complaints |
| France | First EAA-related litigation reported filed in November 2025 |
| Sweden | Market surveillance of digital products reportedly began October 2025 |
| Denmark | Began contacting businesses about compliance around the same period |
| Netherlands | Active enforcement anticipated during the second half of 2026 |
Two patterns worth extracting. First, most authorities appear to be prioritising remediation over immediate penalties — notification, investigation, corrective action, with fines as escalation. Second, that grace is bounded: the directive requires penalties to be "effective, proportionate and dissuasive," language that specifically prevents regulators from issuing warnings indefinitely.
VULTR
High-performance cloud infrastructure — VPS, bare metal and GPU servers with hourly billing worldwide.
Best for: Developers deploying cloud VPS, bare metal & GPU
The year-one reading The absence of large public fines is not evidence that nothing is happening. It's what the first phase of a remediation-first enforcement regime looks like from outside.
Twenty-seven regimes, not one law
The structural fact that determines your actual exposure, and the one most summaries flatten.
The EAA is a directive, so each member state transposed it into national law with its own enforcement authority, penalty structure and complaint mechanism. Germany routes through its federal network agency; France splits responsibility across multiple bodies depending on service type; Italy uses its digital agency. The list goes on, differently, twenty-seven times.
Which means if you sell into five EU countries, you answer to five systems — five sets of investigative practice, five penalty structures, five timelines. A complaint in any one of them brings that country's regulator to you.
The practical consequence for planning: your exposure is set by the strictest market you operate in, not the average. Compliance planned around a lenient jurisdiction leaves you exposed everywhere else.
A caution about the fine figures
Worth stating plainly, because the numbers circulating are less solid than they appear.
Published comparisons of national penalties vary considerably between sources for the same countries. Some figures come from primary legislation; others are summaries of summaries. Several are statutory ceilings for the most serious repeated violations rather than typical outcomes, and at least one detailed comparison explicitly cautions that its figures should be verified against local law.
So treat any specific number you read — including in this article — as indicative rather than reliable. What is well-supported is the shape: maxima ranging from tens of thousands to over a million euros depending on jurisdiction, some states tying penalties to turnover, and sanctions extending well beyond fines to include market withdrawal, service suspension, mandated audits and public naming.
The financial penalty is frequently not the largest cost anyway. Being ordered to withdraw a service from a market, or being named publicly, generally hurts more.
Why most businesses are still behind
Reporting a year on suggests substantial non-compliance persists. The reasons are worth understanding because they're mostly structural rather than negligent.
It was treated as a deadline rather than a programme. Accessibility isn't a project that completes. Every new page, template, campaign landing page and third-party widget can reintroduce problems. Organisations that remediated once in early 2025 have drifted since.
Third-party components carry the risk inward. Chat widgets, booking systems, review displays, payment interfaces, cookie banners. You're accountable for the experience on your site regardless of who built the component, and several common categories are notoriously poor.
Overlay tools were mistaken for solutions. Automated accessibility widgets have been widely marketed as compliance in a line of JavaScript. Accessibility practitioners and disability advocacy organisations have been consistently critical of these, and they do not substitute for the underlying standard being met.
Nobody owned it after launch. The classic pattern: an agency delivered a compliant site, the client's team has been adding content since, and nobody checked whether the additions maintained the standard.
The commercial case, separately
Worth making on its own terms, because compliance framing produces minimum-viable responses.
Accessible sites are better sites for everyone. The requirements — proper heading structure, sufficient contrast, keyboard operability, labelled form fields, captions, meaningful link text — overlap almost entirely with what makes an interface usable under ordinary conditions: bright sunlight, a cracked screen, a noisy environment, tiredness.
Several specifics also improve commercial performance directly. Labelled, well-structured forms reduce errors and abandonment, which is a straightforward conversion gain on any checkout — the ground covered in conversion-focused design. Clear heading hierarchy and descriptive link text serve navigation and comprehension, which is where accessibility overlaps with information architecture almost completely.
And the same structural clarity that assistive technology depends on is what automated systems parse — accurate headings, semantic markup and text alternatives feed the machine-readability discussed in making your site machine-readable. A site built for screen readers is generally a site AI crawlers can also read properly.
There's also a market-size argument that gets stated badly. Roughly a fifth of the population has some form of disability, but the more useful framing is that accessibility barriers exclude people situationally and temporarily as well as permanently — which is a considerably larger group than any disability statistic captures.
Where the risk concentrates for marketers
Because marketing teams frequently introduce the problems and rarely own the remediation.
- Campaign landing pages built outside the main site, on a different tool, to a deadline. These routinely bypass whatever standards the main site meets — and they're the pages paid traffic lands on, as covered in landing page design.
- Video without captions or transcripts. Increasingly common and increasingly published at volume.
- Images without meaningful alt text, particularly product images, which is an e-commerce exposure directly relevant to product page work.
- Text baked into images, which is unreadable to assistive technology and to machines generally.
- Colour used alone to convey meaning — sale flags, status indicators, form errors.
- Interactive elements that only work with a mouse, including carousels, dropdowns and modals.
None of these require developer intervention to prevent. They require someone in the content and campaign process knowing they matter, which is a training and process question rather than a technical one.
What to do now
- Determine whether you're in scope, honestly. Market presence, not company location. Both microenterprise conditions, not either.
- Audit against EN 301 549, which references WCAG 2.1 AA. Automated tools catch perhaps a third of issues; manual testing including keyboard navigation and screen reader checks finds the rest.
- Publish an accessibility statement. Several jurisdictions treat its absence as a distinct violation, and it's among the cheapest items on this list.
- Prioritise by user journey, not by issue count. A blocking problem in checkout matters more than fifty contrast issues in a footer.
- Fix the process, not just the pages. Accessibility checks in your publishing workflow, in campaign QA, in template design. Otherwise you'll be doing this again next year.
- Audit third-party components and raise it with vendors. Their non-compliance becomes your exposure.
- Assign an owner with a review cadence. This is the step that determines whether any of the above holds.
- Take proper advice if you operate across multiple member states, since the variation is exactly where general guidance stops being useful.
Point five is the one that separates organisations that stay compliant from those that remediate repeatedly. Accessibility drifts by default — every published page is an opportunity to reintroduce a problem, which makes it structurally similar to the maintenance discipline needed after any significant site change.
If an audit returns a list longer than your team can work through alongside everything else, that's a build capacity question rather than a compliance strategy question — and it's where a web development partner who has done remediation before is considerably faster than learning the standard from scratch under time pressure.
The short version
Enforcement became real on 28 June 2025 and the first year has been remediation-first rather than fine-heavy — but the absence of large public penalties isn't evidence that nothing is happening. The most notable development is that in Germany, pressure arrived via law firms using unfair competition law rather than via regulators, so watching official enforcement channels can miss your actual exposure. There is no single EU regime: twenty-seven national systems mean your exposure is set by the strictest market you sell into, and the fine figures circulating vary enough between sources that they should be treated as indicative only. The standard itself is refreshingly concrete — EN 301 549, which incorporates WCAG 2.1 AA — so you can convert an unknown into a documented list with an audit. And fix the process rather than the pages, because accessibility drifts every time something new is published.
Not sure whether your site would survive an accessibility audit?
We audit against the standard, fix what fails, and build the process that keeps it compliant.
Explore Web Development →Frequently asked questions
Does the European Accessibility Act apply to businesses outside the EU?
Yes. Like data protection rules before it, the Act attaches to the market rather than to where a company is registered. Any business placing covered products or services on the EU market, or offering them to EU consumers, falls within scope regardless of where it is based. This catches a substantial number of organisations that assumed a directive with European in the name did not concern them, including e-commerce operations that ship into the EU without any European entity or office.
What standard does EAA compliance actually require?
The technical benchmark is EN 301 549, the harmonised European standard, which incorporates WCAG 2.1 Level AA for web content. In practice this means a website, application, e-commerce platform or booking interface that does not meet WCAG 2.1 AA is unlikely to satisfy the requirements. That is a well-documented and testable standard rather than a vague obligation, which is genuinely helpful — the target is specific enough to audit against rather than being a matter of interpretation.
Who is exempt from the European Accessibility Act?
The main exemption covers microenterprises providing services, defined as employing fewer than ten people and having annual turnover or a balance sheet total not exceeding two million euros. Both conditions apply rather than either, which makes the exemption narrower than many assume — a company with eight staff and turnover above the threshold is not exempt. There are also provisions relating to disproportionate burden and fundamental alteration, but these require documented justification rather than being available on assertion.
How is the European Accessibility Act being enforced?
Through twenty-seven separate national regimes rather than one European authority, which produces markedly uneven exposure. Different member states designated different bodies, set different penalty structures and are moving at different speeds. Reporting from the first year indicates market surveillance beginning in some countries during late 2025, early litigation in France, and active enforcement anticipated in other states through 2026. Most authorities appear to be prioritising remediation before penalties, though the directive requires that sanctions ultimately be dissuasive.
Can private parties take action over accessibility non-compliance?
In some jurisdictions, yes, and this has proved to be a faster route than regulatory action. Reporting indicates that in Germany, e-commerce operators began receiving warning letters from law firms shortly after transposition, because German competition law allows private parties to pursue non-compliance as an unfair competition claim. That means exposure does not depend on a regulator opening an investigation, and businesses monitoring only official enforcement activity may be watching the wrong channel entirely.
