The European Accessibility Act: what it requires, who is exempt, and which WCAG version actually counts
In force since June 2025, enforced by 27 separate national authorities, and misreported almost everywhere on the question of which standard applies today.
This is a technical summary, not legal advice. The EAA is a directive: each member state has written its own law implementing it, and penalties, enforcement bodies and procedures differ by country. If you need to know your exposure, ask a lawyer in the relevant jurisdiction.
The short version
- Applies since 28 June 2025. All 27 member states have transposed it into national law.
- Covers businesses offering certain products and services to EU consumers — including businesses headquartered outside the EU.
- For websites and apps, compliance runs through EN 301 549, which points at WCAG.
- The microenterprise exemption is real but narrow, and applies to services only.
- Penalties are set nationally. Reported figures in national implementations reach up to €100,000 or a percentage of annual turnover, depending on the country.
Who it covers
The EAA does not cover every website. It covers specified products and services:
- E-commerce
- Banking and consumer financial services
- Passenger transport — air, bus, rail, waterborne
- Telecommunications services
- Audiovisual media services and streaming
- E-books and dedicated reading software
- Hardware with user interfaces: computers, operating systems, smartphones, ATMs, ticketing and check-in machines, TV equipment
The trigger is offering these to consumers in the EU. A Korean or American company selling to EU consumers is in scope; being outside the EU is not an exemption.
Which standard applies — and this is where most write-ups are wrong
The EAA itself does not name WCAG. It sets functional accessibility requirements, and conformance with a harmonised standard cited in the Official Journal gives a presumption of conformity. For digital products and services, that standard is EN 301 549.
Right now the legal reference is EN 301 549 v3.2.1 (2021), which is based on WCAG 2.1 Level AA.
EN 301 549 v4.1.1 was published in September 2026. It adopts WCAG 2.2 as the benchmark for websites, software and digital documents, adds six new requirements from WCAG 2.2, and drops the retired 4.1.1 Parsing criterion. But it has not yet been cited in the Official Journal, so it does not yet carry the presumption of conformity. Until the Commission cites it, v3.2.1 remains the reference.
The practical consequence for anyone planning work now: build to WCAG 2.2 AA. It is a superset of 2.1 AA, so you satisfy today's legal reference and tomorrow's at the same time, and you avoid doing the work twice when v4.1.1 is cited.
The six additions in WCAG 2.2 AA are worth knowing by name, because they are the gap between a site that was compliant in 2024 and one that will be:
| Criterion | Level | In one line |
|---|---|---|
| 2.4.11 Focus Not Obscured (Minimum) | AA | Sticky headers must not hide the focused element |
| 2.5.7 Dragging Movements | AA | Anything draggable needs a single-pointer alternative |
| 2.5.8 Target Size (Minimum) | AA | 24×24 CSS pixels, with exceptions — explained here |
| 3.2.6 Consistent Help | A | Help mechanisms appear in the same relative order across pages |
| 3.3.7 Redundant Entry | A | Do not make users re-enter information they already gave |
| 3.3.8 Accessible Authentication (Minimum) | AA | No cognitive function test without an alternative — password managers must work |
The exemptions, and how narrow they are
Microenterprises
A microenterprise is one with fewer than 10 employees and annual turnover or balance sheet total not exceeding €2 million. Both conditions must hold. Exceed either and the exemption is gone — immediately, with no grace period.
It also applies to services only, not products. A six-person company running an online shop is exempt as a service provider; a six-person company manufacturing e-readers is not.
Disproportionate burden
Article 14 allows you to claim that a specific requirement imposes a disproportionate burden. It is not a way to opt out:
- It is per requirement, not blanket. You still comply with everything that is not disproportionate.
- You must document the assessment against the criteria in Annex VI, and produce it to authorities on request.
- It must be reassessed at least every five years.
- Lack of priority, time or knowledge does not count. Cost is weighed against benefit to people with disabilities, not against your convenience.
Legacy content
Content published before 28 June 2025 generally has until 28 June 2030. Anything published after June 2025 must comply from launch. Self-service terminals already in service may continue to the end of their economic life.
A practical checklist
In the order that gets you the most reduction in risk per hour spent.
-
Confirm you are in scope
Which of your services fall in the listed categories, in which member states, and are you above the microenterprise thresholds? Write the answer down — you may have to show your reasoning.
-
Run an automated scan on your highest-traffic journeys
Home, search, product, cart, checkout, account. This finds roughly a third of the problems in minutes and tells you how bad the situation is. It does not tell you that you are compliant.
-
Fix contrast and form labels first
They are consistently the most common failures, they are cheap to fix, and they block the most users. This is where automated findings convert most directly into fixed barriers.
-
Test the checkout with a keyboard only
Unplug the mouse and complete a purchase. Anything that traps focus or cannot be reached is a hard barrier no scanner reliably catches.
-
Test with a screen reader
NVDA on Windows and VoiceOver on macOS are free. An hour here finds problems that no tool will ever surface — alt text that is accurate but useless, headings that lie about structure.
-
Publish an accessibility statement
Say what conforms, what does not, and how to report a problem. Several member states expect one, and it is evidence of good faith if anyone asks.
-
Put it in the build, not the audit
A scan in CI on every pull request costs almost nothing and stops regressions. One annual audit finds the same problems repeatedly.
What an automated scan can and cannot tell you
Automated testing detects roughly a third of accessibility barriers. That proportion is worth internalising, because a great deal of compliance marketing is built on blurring it.
| A tool can decide | A person must decide |
|---|---|
| Contrast ratios | Whether alt text describes the right thing |
| Missing labels and accessible names | Whether the reading order makes sense |
| Heading level jumps | Whether headings describe the content |
| Invalid ARIA roles and missing state | Whether a keyboard user can finish the task |
| Targets below 24×24 with no clearance | Whether an error message actually helps |
No tool and no overlay can make you compliant, and any vendor claiming otherwise is selling you liability. Automated accessibility overlays in particular have been the subject of repeated legal complaints. A scan is a starting point and a regression guard, not a certificate.
A11yScope is a free Chrome extension that runs the automatable WCAG 2.2 AA checks on whatever page you are looking at, and reports the cases it cannot decide as needing review rather than guessing at them.