The European Accessibility Act (Directive 2019/882) became enforceable on 28 June 2025. It is the first EU-wide law that puts accessibility requirements on private-sector digital products, not only on public bodies.
Most of what is written about it is either a law-firm summary that never touches code, or a vendor page that ends in "buy our overlay". This is the middle: what it asks for, and what you actually have to change.
Who it applies to
The EAA covers products and services offered to consumers in the EU. For web work, the list that matters is e-commerce, consumer banking, e-books, electronic communications, transport ticketing and booking, and access to audiovisual media services.
Two things surprise people. First, it is about where your customers are, not where you are — a UK or US business selling to EU consumers is in scope. Second, "e-commerce" is read broadly: if a consumer can buy from you online, you are likely in it.
The microenterprise exemption, precisely
Microenterprises are exempt from the obligations on *services* — fewer than 10 staff and under €2 million annual turnover or balance sheet total. Both conditions, not either.
Two caveats do a lot of work here. The exemption applies to service providers, not to manufacturers of products. And an agency building a site for a client in scope does not inherit the client's exemption: the obligation follows the business offering the service to consumers.
What "accessible" means in practice
The Act itself is written in functional terms — perceivable, operable, understandable, robust — and does not name a technical standard. The harmonised standard that supplies the detail is EN 301 549, and its web chapter restates WCAG 2.1 Level A and AA.
That gives you a usable target: conform to WCAG 2.1 AA and you have a presumption of conformity. WCAG 2.2 AA is a superset of the criteria that matter here and is what we scan against, so aiming at 2.2 costs you nothing and leaves you ahead of the next revision.
- —WCAG 2.1 Level A and AA — the substantive requirement.
- —An accessibility statement describing conformance, known gaps and a contact route.
- —A feedback mechanism so users can report a barrier.
- —Records showing you test and fix, not a one-off audit from two years ago.
The part teams underestimate
Accessibility is not a project that finishes. Every release can reintroduce a failure that was fixed last quarter: a new hero section with a low-contrast overlay, a redesigned form that swaps labels for placeholders, a third-party widget that arrives without keyboard support.
Enforcement bodies ask what your process is, not only what an audit said. A dated record of continuous testing is worth considerably more in that conversation than a PDF from a single engagement.
Enforcement so far
Each member state designates its own market-surveillance authority and sets its own penalties, so there is no single EU-wide fine. Through the second half of 2025 most authorities were building capacity; several have since started handling complaints and issuing formal notices.
The realistic near-term risk for most businesses is not a fine out of nowhere. It is a complaint, followed by a deadline to remediate, followed by public pressure — and, for agencies, a client who wants to know why their site was signed off in this state.
A sequence that works
If you are starting from nothing, the order matters more than the effort. Fixing the top four failure classes usually moves a site further than a month of scattered work.
- doScan the pages that carry money and obligations first: checkout, sign-up, contact, account.
- doFix contrast, missing alt text, unlabelled fields and unnamed links. These are most of what automated testing finds, and they are cheap.
- doWalk the same pages with the keyboard only. That catches focus order, traps and invisible focus, which no scanner sees.
- doPublish an accessibility statement, including the parts that are not fixed yet. Being honest about a known gap is not an admission of guilt; silence is worse.
- doPut a scan on a schedule so the next release cannot quietly undo the work.
Questions
- Does the EAA apply to a business outside the EU?
- If you offer products or services to consumers in the EU, yes. The obligation follows the market you sell into, not where you are established.
- Is WCAG 2.1 AA enough, or do we need 2.2?
- EN 301 549 currently restates WCAG 2.1 A and AA, so 2.1 AA is the legal target today. WCAG 2.2 adds nine criteria on top; meeting them costs little extra and future-proofs you against the next revision of the standard.
- Does an accessibility overlay make us compliant?
- No. Overlays do not fix the underlying markup, and litigation in the US has repeatedly involved sites that had one installed. Fix the code.
- We are a microenterprise. Can we ignore this?
- The exemption covers service providers with fewer than 10 staff and under €2 million turnover. It does not cover product manufacturers, and it does not transfer from a client to the agency building their site. It is also worth remembering that the exemption is from the law, not from the customers you are turning away.
Keep reading