The European Accessibility Act for websites: scope, requirements, proof

If your website sells to consumers in the EU, or is how you provide them with banking, passenger transport, e-books or another service the Act lists, the European Accessibility Act applies to it, through your country’s law, from 28 June 2025, unless you are a micro-enterprise (see below). The Act (Directive (EU) 2019/882) sets functional requirements: websites must be “perceivable, operable, understandable and robust”. It does not mention WCAG at all. WCAG enters through a harmonised standard, EN 301 549, and no version of that standard is cited under the Act yet. This guide follows the chain from the Directive’s articles to what you test and what you keep as evidence, with each step sourced.

The Act is a Directive, so it binds you through your country’s national law. The articles below are the Directive’s; national laws transpose them and add the enforcement detail.

Who the Act covers

The services that reach a website

Article 2(2) lists the services the Act applies to when they are “provided to consumers after 28 June 2025”:

• electronic communications services (a), and services providing access to audiovisual media services (b);
• air, bus, rail and waterborne passenger transport (c), where the list starts with “(i) websites” and includes apps, electronic tickets and travel information;
• consumer banking services (d);
• e-books and dedicated software (e);
• e-commerce services (f).

E-commerce is the one most websites fall into. Article 3(30) defines it as “services provided at a distance, through websites and mobile device-based services by electronic means and at the individual request of a consumer with a view to concluding a consumer contract”. If consumers can buy from you or otherwise enter into a contract through your site, it is very likely an e-commerce service in the Act’s sense.

The website requirement itself is in Annex I, Section III, which Article 4(3) applies to every covered service. Urban, suburban and regional transport are the exception: for them only the self-service terminal provisions apply.

Where you are based does not decide it

The Directive defines a service provider as anyone who “provides a service on the Union market or makes offers to provide such a service to consumers in the Union” (Article 3(4)), and Article 4(1) requires those services to comply with Annex I. Where you are established does not decide it: a business outside the EU that offers covered services to consumers in the EU is covered for those services. How a national authority enforces that against a provider outside the EU is a matter for national law.

If you also sell in the US or Ontario, their rules work differently: we set out how the EU, US and Ontario rules differ, and which can apply to you.

The micro-enterprise exemption

Article 4(5) exempts “microenterprises providing services” from the service requirements “and any obligations relating to the compliance with those requirements”. Article 3(23) defines a micro-enterprise as an enterprise that “employs fewer than 10 persons” and has “an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million”.

Two details are often lost:

• The money limits are alternatives. A business with 8 staff, a EUR 3 million turnover and a EUR 1.5 million balance sheet is still a micro-enterprise on its own figures. If it has partner or linked enterprises, such as a parent company, their figures are added in (a partner’s in proportion to the shareholding), and that can take it over the limits.
• The staff limit is not an alternative. An enterprise with 10 or more annual work units (full-time equivalents over the year) is not a micro-enterprise, whatever its turnover.

The exemption covers services only. A business that also makes or sells covered products keeps those obligations. The Directive’s recital 53 says that to benefit, a micro-enterprise must “genuinely fulfil the requirements” of the EU’s SME Recommendation (2003/361/EC). That Recommendation counts staff in annual work units, with part-time work as a fraction, and adds in linked and partner enterprises. Your country’s law may word the test differently, so check it there. We go through it in a step-by-step check of whether the Act applies to you.

What on a website is outside the Act

Article 2(4) lists website and app content the Act “does not apply to”:

1. pre-recorded time-based media (video and audio) published before 28 June 2025;
2. office file formats (PDFs, documents, spreadsheets) published before 28 June 2025;
3. online maps and mapping services, if the essential information in maps meant for navigation is provided in an accessible digital way;
4. third-party content “that is neither funded, developed by, or under the control of” you;
5. content that qualifies as an archive: it only contains content that is not updated or edited after 28 June 2025.

Two cautions:

• A third-party tool you chose is not excluded just because someone else wrote it. Point (d) covers content you neither fund, develop nor control. In our reading, a checkout, chat or booking tool you pay for, embed or configure is part of how you provide the service, so treat it as in scope unless you are sure it is not.
• The exclusions have no end date, and the 2030 date is something else. Several guides say content published before June 2025 has until 2030 to comply. That mixes up two articles, which do different things. Article 2(4) excludes old media and documents outright, and the Directive sets no end date for those exclusions. Article 32 is a transition for something different: national law gives service providers until 28 June 2030 to keep providing their services with products they lawfully used for similar services before 28 June 2025, and service contracts agreed before 28 June 2025 may continue without alteration until they expire, but no later than 28 June 2030.

New content follows the requirements. A PDF price list you upload today is not covered by point (b), and an archive you keep editing is not an archive.

What the Act requires of a website

The general requirements: Annex I, Section III

Section III applies to every covered service except urban, suburban and regional transport. For a website, the core is point (c): “making websites, including the related online applications, and mobile device-based services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust”.

Those four words are the four principles of WCAG (the Directive’s recital 47 takes them from the Web Accessibility Directive), which is why WCAG, through EN 301 549, is the usual way to test the requirement. Section III also asks for:

• information about how the service works (point (b)), including, in (vii), electronic information needed to provide the service, made perceivable, operable, understandable and robust;
• accessible support (point (d)): “where available”, support services (help desks, call centres, technical support, relay services and training) give information on the service’s accessibility and its compatibility with assistive technologies, “in accessible modes of communication”.

E-commerce specifics: Annex I, Section IV, point (g)

For an online shop, Section IV adds three requirements:

1. provide the accessibility information about the products and services you sell, when the responsible economic operator gives it to you;
2. make identification, security and payment functionality, when it is part of the service, “perceivable, operable, understandable and robust”;
3. provide identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust.

The checkout, sign-in and payment steps are named on purpose. They are often where a third-party component sits, and they are part of your service.

Keeping it that way: Article 13

Article 13 turns the requirements into ongoing duties for service providers:

• design and provide the service to the requirements (13(1));
• have procedures so the service “remains in conformity”, taking account of changes to the service, to the requirements, and “in the harmonised standards or in technical specifications” (13(3)). Once a version of EN 301 549 is cited under the Act, a later revision of it is exactly such a change; until then, moving your own test benchmark from WCAG 2.1 to 2.2 is good practice rather than this duty;
• when the service does not conform, correct it, and “immediately inform the competent national authorities” with details of the non-compliance and the corrective measures (13(4));
• on a reasoned request, give the authority the information needed to demonstrate conformity (13(5)).

Where WCAG comes in

The presumption of conformity

Article 15(1) is the link between the law and a technical standard: services that conform to “harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union, shall be presumed to be in conformity with the accessibility requirements of this Directive in so far as those standards or parts thereof cover those requirements”.

So the standard does not create your duty. It gives you an accepted way of showing that you meet it. Only a standard cited in the Official Journal under this Directive, or a technical specification the Commission adopts under Article 15(3), gives that presumption (Article 15(1) and (4)). Neither exists yet.

The versions of EN 301 549

• V3.2.1 (2021) adopts WCAG 2.1. It is cited under the Web Accessibility Directive by Implementing Decision (EU) 2021/1339, for public-sector sites. It is not cited under the European Accessibility Act.
• V4.1.1 (published September 2026) adopts WCAG 2.2. ETSI revised it “to become a harmonised standard” for both Directives. Its Table A.1 lists the 57 requirements that apply where the ICT “is, or includes, a web page”: the 55 WCAG 2.2 Level A and AA success criteria, plus clause 9.6 on conformance and a new clause 9.7 on user preferences. Read the row-by-row changes in V4.1.1.

Article 15(3) lets the Commission adopt technical specifications instead, but only if no harmonised standard is cited and, in addition, either standardisation has stalled (undue delays, or no standards organisation accepted the request) or the Commission can show that a specification meets the requirements in Annex II of Regulation (EU) No 1025/2012, apart from the one that it be developed by a non-profit organisation. It has not adopted any for the Act.

What to test against meanwhile

There is no presumption to be had yet, so the practical question is which benchmark covers you best. Our recommendation is WCAG 2.2 Level AA, with 4.1.1 Parsing kept on the list.

• WCAG 2.2 contains every WCAG 2.1 criterion except 4.1.1 Parsing, which 2.2 removed.
• W3C notes that authors bound to WCAG 2.0 or 2.1 “may need to continue to test and report 4.1.1”.
• Testing 2.2 Level AA plus Parsing therefore covers the web-page WCAG rows of both V3.2.1 and V4.1.1. V4.1.1 also adds clause 9.7 on user preferences, which is not in WCAG, so test that too.

A web page is not the whole of EN 301 549. Downloadable documents, real-time communication and the information you give about your service have clauses of their own, each applying only if your site has that feature, and in V4.1.1, Table A.5 applies the functional performance criteria in clause 4 to all ICT, a website included, each where its condition is met. We map the EN 301 549 clauses that apply to a website separately.

How to show your website meets it

The Act asks for evidence, not a badge. Four kinds of record do the work.

1. The Annex V information

Article 13(2) requires service providers to “prepare the necessary information in accordance with Annex V” and to “explain how the services meet the applicable accessibility requirements”. Annex V says where it goes, “in the general terms and conditions, or equivalent document”, and what it contains, where applicable:

• a general description of the service in accessible formats;
• the descriptions and explanations needed to understand how the service operates;
• a description of how the Annex I requirements are met.

It also asks for information “demonstrating that the service delivery process and its monitoring ensure compliance”. Article 13(2) adds that the information must be public “in written and oral format”, accessible to persons with disabilities, and kept for as long as the service runs.

The Act does not prescribe a form for it, but it does fix the place: the terms and conditions or an equivalent document. Many businesses also publish it as an accessibility page linked from their terms; whether that page counts as an “equivalent document” is for your national law, so check it. Our template for the Annex V information sets out each point, with the fields only you can decide.

2. An Article 14 assessment, if you rely on one

Article 14 limits the requirements where meeting them would mean a “fundamental alteration” of the service or a “disproportionate burden”. It is not a blanket opt-out:

• you make the assessment yourself, and for the burden you apply Annex VI’s criteria: net compliance costs against your overall operating and capital costs; your estimated costs and benefits against the estimated benefit for persons with disabilities, given how much and how often the service is used; and net compliance costs against net turnover;
• you document it, keep the results for five years after the service was last provided, and give a copy to the authority on request (14(3));
• you renew a disproportionate-burden assessment when the service changes, when the authority asks, and at least every five years (14(5));
• you cannot claim the burden if you received external funding to improve accessibility (14(6));
• you inform the authority when you rely on it (14(8)); micro-enterprises are excepted from that step.

3. The procedures that keep you conformant

Article 13(3) asks for procedures, and Annex V point 3 asks you to show your monitoring. In practice that means a written answer to three questions. Who checks accessibility when the site changes? Against what? And what happens to a defect once it is found?

4. Test records

Your test records are the evidence behind the other three. A useful record says:

• what was tested: which pages, templates and journeys, and at which screen sizes. On a large site, a sample built from your page templates keeps this manageable;
• against what: the standard, its version and the level, for example WCAG 2.2 Level AA;
• how: automated checks, manual review, keyboard-only use, and testing with assistive technologies such as screen readers;
• when, and what changed since: dated results, defects found, and when each was fixed and re-tested.

Automated testing is one input to that record, not the whole of it. Some criteria can be measured in the browser, such as contrast, missing text alternatives and focus hidden under a sticky header. Others need a person, for example whether alternative text describes the image well or whether an error message helps, and checking that a site works with screen readers and other assistive technologies needs testing with them. No automated tool can establish full conformance with EN 301 549.

In our audits, a finding from a WCAG-mapped rule carries its WCAG criterion and the matching EN 301 549 clause. Each audit also lists the criteria it could not decide as “not tested” rather than counting them as passes. That keeps the automated part of your record honest about what it covers.

Who enforces it

The Act leaves enforcement to the member states, within a common frame.

• Authorities check services. Under Article 23, each member state designates authorities that check services’ compliance (including any Article 14 assessment), follow up complaints, and verify that corrective action was taken.
• People and organisations can act. Article 29 requires that consumers can take action under national law before the courts or competent administrative bodies, and that public bodies, associations and other organisations with a legitimate interest can act on the consumer’s behalf or in support, with the complainant’s approval.
• Penalties are national. Article 30 has member states lay down the penalties, which must be “effective, proportionate and dissuasive” and “accompanied by effective remedial action”. They take account of “the extent of the non-compliance, including its seriousness” and “the number of persons affected”.

The Directive sets no amounts, so any figure you read comes from one country’s law. Look up your own country’s transposing law and the authority it names.

What not to rely on

• An overlay or widget on its own. The requirements apply to the service you build and run. A script added on top of a page does not replace testing that page and fixing what the tests find.
• A score. A number from an automated tool says how many things that tool measured and found. It is not a measure of conformance, and the Act does not ask for one.
• “WCAG 2.1 Level AA is the EAA standard.” No WCAG version is named in the Directive, and no standard is cited under it. Your national law or your authority’s guidance may name one, so check it. V3.2.1’s WCAG 2.1 is the public-sector benchmark; V4.1.1’s WCAG 2.2 is the candidate for both.
• A one-off test. Article 13(3) asks for procedures that keep the service conformant as it changes. A test from launch day does not describe the site you run today.

A website checklist for the Act

Print it, or copy it into your own tracker. Each row names its source.

Where to go from here

For the standard itself, read:

• EN 301 549 V4.1.1: what changes: the web-page rows that changed, clause 9.7, and the standard’s dates.
• EAA vs ADA vs AODA: scope, enforcement and WCAG criteria: the EU, US and Ontario rules side by side, for a site that sells abroad.

To see where one of your pages stands against WCAG 2.2, with each measured finding labelled by its WCAG criterion and EN 301 549 clause, scan a page of your site for free, without signing up.