European Accessibility Act enforcement in 2026: the cases so far, who is in scope and what to build to

What does European Accessibility Act enforcement look like in October 2026?#

More than a year after 28 June 2025, enforcement means regulator investigations and court orders rather than fines, so a product selling into the EU should already meet WCAG 2.1 AA. That is the short answer, and each section below adds one piece of the record to it.

The record so far has three parts. First, national regulators are testing live websites. Sweden's Post and Telecom Authority (PTS) and the Netherlands Authority for Consumers and Markets (ACM) both started in 2025. Second, disability associations in France have taken four grocers to court. One case has produced an order with a daily penalty. Third, the technical yardstick moved in September 2026, when a new version of the European standard adopted WCAG 2.2.

Meanwhile, the fines that many teams were waiting for have not arrived. A July 2026 review by Auditsu found no fine issued under any national version of the Act anywhere in the EU. But the same review describes legal activity in at least seven member states. In short, European Accessibility Act enforcement is a process that is already running. A fine is its last step, not its first.

The yardstick matters as much as the cases. AccessibleEU, the Commission's accessibility centre, wrote on 7 September 2026 that the current reference remains version 3.2.1 of the standard. That holds until the Commission cites the new version in the Official Journal. Since that older version is built on WCAG 2.1 Level AA, it is the floor a regulator measures against today.

Source: Post- och telestyrelsen (15 October 2025, 3 March 2026); Autoriteit Consument & Markt (March 2026); Auditsu year-one review (July 2026); AccessibleEU (7 September 2026).

Has anyone been fined under the European Accessibility Act yet?#

No fine has been issued yet, but Sweden's PTS had opened 28 supervision cases into e-commerce services by March 2026, eleven of them in a single round. Supervision cases are where fines would come from, so the count is the number to watch.

PTS announced its first planned supervision of online shops on 15 October 2025. That first round looked at large retailers established in Sweden. It checked three parts of each website: the home page, a product page and the search function. But apps were left out of that round. Then, on 3 March 2026, PTS added eleven more cases and wrote that "PTS har totalt startat 28 tillsynsärenden", meaning 28 cases in total.

The cases are proactive. Auditsu's review notes that PTS opened them on its own initiative, with no complaint behind them. So a shop can be inside an investigation before any customer has written in. PTS also says it checks that information on how the service works is given in an accessible way. That is a document a product team can prepare now.

The penalty ceilings are real, even if unused. For example, the Auditsu review puts the Swedish maximum at SEK 10 million and the Dutch one at EUR 900,000 or 10% of turnover. Those ceilings sit at the end of the supervision pipeline. In practice, the first year produced cases, deadlines and test rulings, and that is how most new regimes start.

What did the Dutch regulator find when it tried to order from the largest webshops?#

When the Dutch ACM tested about 100 of the largest webshops, 61 percent could not take an order from someone using assistive technology. And the regulator's test was not a score. It was whether a disabled customer could finish a purchase.

The ACM published the result in March 2026. Its sample covered roughly 100 of the largest Dutch webshops, plus the sites of the largest telecom and energy providers. In its words, "61 procent van de grootste Nederlandse webwinkels" is not digitally accessible. In other words, a person with a visual impairment could not place an order on most of them.

The causes the ACM named in March 2026 are ordinary defects. One was an order button that a keyboard could not reach. Another was an inaccessible CAPTCHA, the puzzle that asks a user to prove they are human. Beyond those, the ACM found "serious problems" on a further 33% of the sites it checked. On those sites an order was possible but took much more effort.

So the test is one any product team can run on its own checkout this week. Put the mouse away and tab from the product page to the confirmation page. Then try the same path with screen-reading software such as NVDA or VoiceOver. Our guide to accessibility testing walks through that method. Also note what the ACM does next: it points the worst performers among the largest companies at their faults first, and companies that do not improve then risk enforcement.

What have the French courts decided so far?#

A French court in Caen ordered Carrefour in June 2026 to make its website and app accessible within six months, at EUR 500 for each day of delay. That order came one month after a court in Lille went the other way on a different grocer.

The cases began with associations, not a regulator. According to the Auditsu review, the associations ApiDV and Droit Pluriel sent formal notices in July 2025. When the grocers let a September deadline pass, the associations filed emergency injunctions in November 2025. The four companies were Auchan, Carrefour, E. Leclerc and Picard.

The Lille ruling of 5 May 2026 turned on scope. France's national rule sets a EUR 250 million revenue threshold for this duty, and Auchan's e-commerce arm earned EUR 144 million in 2024, per the Auditsu review. So the court dismissed the claim, even though it noted the site was only 41% compliant with the French standard. But the associations have appealed to the Douai court of appeal. They argue that the national threshold contradicts the directive's own EUR 2 million line.

Then, on 4 June 2026, the Caen court ruled against Carrefour. Auditsu reports it as the first ruling under a national EAA law to go against a retailer, and the first to cover a mobile app. As a result, the lesson from France is that scope is what gets argued. Whether the site worked was not in dispute in either case.

Is your product in scope, or does the microenterprise exemption apply?#

The services exemption covers only microenterprises, meaning fewer than 10 people and no more than EUR 2 million in turnover or balance sheet, so most product companies are in. Check the service type first, then the two size numbers.

The covered services include e-commerce, banking, e-books, passenger transport and telephony, according to the European Commission. So a subscription app that sells to consumers online is an e-commerce service.

Ireland's transposition regulations show how the test reads in national law. They define e-commerce as services provided at a distance, through websites and mobile device-based services, with a view to a consumer contract. They define a microenterprise as one with fewer than 10 persons and an annual turnover, or a balance sheet total, of no more than EUR 2 million. Then they say the service duties "shall not apply to a service provided by a microenterprise". But that wording covers services only. A microenterprise that makes a covered product is still bound by the product rules.

Take a worked example. A consumer subscription app has 40 staff and EUR 6 million in turnover, and it sells into Sweden, the Netherlands, Ireland and France. With 40 staff it fails the headcount test, and EUR 6 million is three times the EUR 2 million line, so it is in scope. Its checkout then answers to PTS in Sweden and the ACM in the Netherlands. In Ireland, the regulations name the Competition and Consumer Protection Commission for e-commerce services. And in France, the associations have shown they will go to court.

This is general information on the law as published, not legal advice. Confirm scope in each member state against that state's own transposition, with counsel, because France has already shown that national thresholds can differ.

What do the 2030 and 20-year transition windows actually cover?#

The transition windows protect service contracts for up to five years and self-service terminals for up to 20, never the website or app a company ships today. They are narrower than many teams assume.

Regulation 38 of the Irish text sets them out. First, service contracts agreed before 28 June 2025 may continue unchanged until they expire, but for no longer than 5 years from that date. Second, self-service terminals already in use may stay in service until the end of their useful life, but "no longer than 20 years after their entry into use". Third, a provider may keep using products it already used to provide a similar service until 28 June 2030.

The third window is the one people misread. It covers products a provider was already using, such as the hardware behind a service. But it does not say that a website or app keeps a grace period. Meanwhile, PTS and the ACM have tested live webshops since 2025, which shows how the regulators read it. So the checkout you ship today has no window at all.

Should you build to EN 301 549 v3.2.1 or the new v4.1.1?#

Build to WCAG 2.2 AA now, because EN 301 549 v4.1.1 adds six WCAG 2.2 requirements and becomes the reference once the Official Journal cites it. If you build to the older version alone, a second round of fixes follows.

EN 301 549 is the European standard for accessible digital products, published by the European Telecommunications Standards Institute (ETSI). Version 4.1.1 came out in September 2026. AccessibleEU says it adopts WCAG 2.2 for websites, software and documents, adds six new requirements from WCAG 2.2, and removes the obsolete 4.1.1 Parsing criterion. It is also the first version written with the Act in mind, with a new annex that maps its clauses to the law.

For now, though, version 3.2.1 and WCAG 2.1 AA remain the legal floor. Once the Commission cites version 4.1.1, meeting it will give a presumption of conformity with the Act. Therefore the cheaper course is to test against WCAG 2.2 AA now and pass both versions at once.

The W3C's summary of WCAG 2.2 lists the six new criteria at Level A and AA. Each one lands on a surface most products already have:

Source: W3C Web Accessibility Initiative, "What's New in WCAG 2.2", accessed 2 October 2026.

Notice the last row. The ACM named an inaccessible CAPTCHA as a cause of failed orders, and WCAG 2.2 now names the same defect at login.

Does the ADA Title II web rule change anything for an EU-selling product?#

Only if you also sell to US state or local governments, whose ADA Title II web deadlines moved in April 2026 to 2027 and 2028. For everyone else, it is a US rule that does not reach an EU sale.

Title II of the Americans with Disabilities Act (ADA) covers US public entities. Its web rule, codified at 28 CFR 35.200, requires their web content and mobile apps to meet WCAG 2.1 Level A and AA. That includes content provided "through contractual, licensing, or other arrangements", so a vendor's product can be caught by the public body's duty. Then, on 20 April 2026, the Justice Department published an interim final rule that pushed both compliance dates back.

Under 28 CFR 35.200 as amended in April 2026, public entities with a population of 50,000 or more must comply from 26 April 2027. Then smaller ones and special districts follow from 26 April 2028. Because both rules point at WCAG, a product built to WCAG 2.2 AA also meets the 2.1 AA bar the US rule sets. So one build serves both markets.

What should a product team have in place this quarter?#

Have three things ready before a regulator or association writes: a published accessibility statement, a dated audit against EN 301 549, and a fix plan with owners. Enforcement so far starts with a notice and a window to fix, so what you can show on that day decides how it goes.

First, the accessibility statement. PTS says it checks that information on how the service works exists and is given accessibly. A public statement at a stable URL, scoped to the real product, answers that question before it is asked.

Second, the dated audit. Test the journeys a regulator tests: search, a product page, the cart and the checkout, on both web and app. But a home page scan is not an audit. Our list of web accessibility testing tools covers what each tool catches, and what still needs a person.

Third, the fix plan with owners. In France the associations sent formal notices first, and went to court only after a deadline passed with no fix, per the Auditsu review. Likewise, the ACM speaks to companies before it enforces. So a plan with names and dates turns that first notice into a conversation. Also keep each audit dated, because every release can undo an earlier fix.

As with scope, this is general information on the law, not legal advice. When a notice from a regulator arrives, bring in counsel for that member state.

When is the European Accessibility Act not a fit for your product?#

The EAA is the wrong frame for a microenterprise service, a business-only tool outside the listed services, or a public-sector site, which answers to the Web Accessibility Directive. In each case, a different rule or a different reason should drive the work.

For a microenterprise service, the exemption in the Irish text applies, so the Act does not bind you. But build to WCAG 2.2 AA anyway if you plan to grow past 10 people or EUR 2 million. The duty starts the day you cross the line.

If you build an internal or business-only tool, check the Commission's list of covered products and services first. Since the Act names consumer services, a tool sold only to companies may sit outside it. In that case, the better driver is what your customers' procurement teams ask for.

For a public-sector website or app, the Web Accessibility Directive is the rule, not the EAA. AccessibleEU notes that the new version of the standard will give a presumption of conformity under both laws. So the technical target is the same, even though the legal route differs. And if you also sell to US public bodies, the consequences guide sets the US triggers beside the EU ones.

Where to go from here#

Testing the six new WCAG 2.2 criteria is the next step, and the posts below cover how to test, which tools to use and what remediation costs. Start with whichever question your team cannot answer yet.

The method is in how accessibility testing works. Then compare the testing tools by what they catch. When the question turns to budget, see what website accessibility costs. And for the wider risk picture across the US and the EU, read what an inaccessible website can cost you.

If you want a team to do the work, there are two routes. One is WCAG and ADA compliance work to bring a product to WCAG 2.2 AA. The other is an accessibility testing engagement for an audit against EN 301 549. Still, everything above can be done in house. The WCAG 2.2 text and the standard itself are free to read, and they are enough on their own.