EAA Compliance Checklist 2026: The Deadline Has Passed, Here Is What to Do Now

Short answer: The European Accessibility Act (Directive (EU) 2019/882) has applied since 28 June 2025, so in 2026 the question is no longer when it starts but how compliant you are and what you can prove. It covers consumer-facing digital products and services such as e-commerce, consumer banking, passenger transport interfaces and e-books, with the technical bar set by EN 301 549, which incorporates WCAG for web content. Microenterprise service providers (fewer than 10 employees and turnover or balance sheet not exceeding EUR 2 million) are exempt from the service requirements; everyone else in scope is expected to conform now. If you are late, the defensible position is a dated audit, a prioritized remediation plan and an honest accessibility statement, because national enforcement typically starts with complaints and evidence requests.

This article is for general information only and is not legal advice. EAA enforcement is implemented separately by each EU member state, so confirm specifics with qualified counsel in the markets you serve.

Table of contents

• Where the EAA stands in 2026
• Who is in scope, and the microenterprise exemption stated precisely
• The standard: EN 301 549 and how it relates to WCAG
• The EAA compliance checklist: 12 items
• If you are late: building a defensible catch-up posture
• Non-EU sellers into the EU: why the EAA reaches you
• Where scanning and statement tooling fit in
• Frequently Asked Questions
• Sources

Where the EAA stands in 2026

The European Accessibility Act was adopted in 2019 as Directive (EU) 2019/882, member states transposed it into national law, and its main application date was 28 June 2025. That date has passed. For products and services offered to consumers after it, the requirements are live obligations, not upcoming ones.

What changes in 2026 is the enforcement picture. The EAA is a directive, enforced through national law in each of the 27 member states, each of which designates its own authorities and sets its own penalty framework. In practice that means three things for a digital team:

• Enforcement is decentralized and uneven. The authority, the complaint procedure and the penalty scale differ between member states, and you are exposed separately in each one you sell into.
• Complaints are a primary trigger. Consumers and disability organizations can raise inaccessibility with national authorities. A single blocked checkout flow can become a documented complaint file.
• Transitional provisions exist, but they are narrow. The directive allows some continuity for service contracts concluded before 28 June 2025 and for products and self-service terminals lawfully in use before that date; these windows cover legacy assets, not current website or app releases, and whether one applies to you is a question for counsel.

For a fuller walkthrough of the directive itself, see our European Accessibility Act guide.

Who is in scope, and the microenterprise exemption stated precisely

The EAA defines its scope by product and service category, not by industry label. The digital surfaces most companies need to worry about sit on the services side.

Two scope notes matter more than the table:

E-commerce is deliberately broad. The directive treats e-commerce as a service provided at a distance, through websites and mobile applications, at a consumer's request, with a view to concluding a consumer contract. If EU consumers can buy from your site, assume the shopping journey is in scope.

The microenterprise exemption applies to service providers, and the headcount and the financial condition must both hold. A microenterprise under the EAA is an enterprise that employs fewer than 10 persons and has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million. Microenterprises providing services are exempt from the EAA's service accessibility requirements. The financial condition is an either/or test (turnover or balance sheet), but it must hold together with the headcount test: a 6-person agency with EUR 5 million turnover and a EUR 5 million balance sheet total is not exempt, and neither is a 40-person shop with EUR 1 million turnover. The full exemption is for services; microenterprises dealing with products get relief from certain documentation duties, not a blanket pass.

Separately, the directive's disproportionate burden mechanism lets an in-scope company limit conformance only on the basis of a documented assessment that authorities can review: an argued, evidenced position, not an opt-out checkbox.

The standard: EN 301 549 and how it relates to WCAG

The EAA's requirements are functional, and the practical way to demonstrate conformance is the harmonized European standard EN 301 549. For web content and mobile applications, EN 301 549 incorporates the W3C's Web Content Accessibility Guidelines, with current versions aligning with WCAG 2.1 Level AA.

This is good news if you have an existing WCAG program:

• Your WCAG 2.1 AA work is the core of EAA web conformance. The success criteria you have audited and fixed for other markets map directly onto EN 301 549's web clauses.
• WCAG 2.2 is a sensible engineering target for new work. WCAG 2.2 adds nine success criteria over 2.1, including focus appearance, dragging alternatives and accessible authentication; building to 2.2 AA today means no retrofitting later.
• EN 301 549 goes beyond web pages. It also covers non-web documents (for example PDF invoices in your purchase flow), software, hardware interfaces and support services; a native app or a call-center channel is part of the same conformance story.

One detail teams often miss: the first interactive element an EU visitor meets is usually the cookie consent banner, and an inaccessible one can block the whole session for keyboard and screen-reader users. See our accessible cookie banner guide.

The EAA compliance checklist: 12 items

This checklist is one you can walk through with engineering, legal and content owners in a single session. Items 1–3 establish where you stand, 4–7 fix and document, 8–12 keep you conformant.

1. Confirm scope and exemptions in writing. List your EU-facing products and services against the directive's categories. Record whether the microenterprise exemption or a transitional provision applies, and have counsel confirm edge cases; a one-page scope memo prevents months of ambiguity.

2. Inventory the digital estate. Every website, subdomain, mobile app, checkout flow, PDF template, embedded third-party widget and kiosk interface that EU consumers touch. You cannot audit what you have not listed.

3. Run a baseline audit against EN 301 549 / WCAG. Combine automated scanning across the full estate with manual expert testing of representative pages. Date the report and keep it: the baseline is the anchor of your compliance file and of every progress claim you make later.

4. Manually test the critical user journeys. Registration, login, search, payment, account management and contact, tested end to end with keyboard only and with a screen reader. Journey-level blockers are found by hands on keys, not by automation alone.

5. Prioritize defects by user impact. Blockers on purchase, payment and authentication flows first, then systemic template and component issues, then content-level fixes. Starting with what stops users from transacting also reads best to a reviewing authority.

6. Fix the design system, not just the pages. A contrast defect fixed once in the button component is fixed everywhere. Systemic fixes are how remediation scales and how accessibility enters your engineering process.

7. Publish an honest accessibility statement. State your conformance status, the standard you evaluate against, known limitations, the date of the last assessment and a way to reach you. Honesty matters more than polish: documented partial conformance with a plan beats an overclaim. You can prepare one with our accessibility statement generator.

8. Stand up an accessible feedback and support channel. Users need a working way to report barriers, and those reports need routing to the team that can fix them. Track them like defects, with timestamps: this loop is your early-warning system before a complaint reaches an authority.

9. Put accessibility into procurement and third-party contracts. Your checkout is only as accessible as your payment provider's iframe, your chat widget and your consent banner. Require EN 301 549 or WCAG conformance information from vendors, test their components in your own audits, and add accessibility clauses to new contracts.

10. Add regression monitoring. Accessibility decays with every release. Scheduled automated scans, CI checks where feasible and periodic manual re-audits of the critical journeys keep the conformance you paid to reach.

11. Train the people who ship content and code. Alt text, heading structure, form labels, contrast and focus management are daily decisions made by editors and developers, not by the audit vendor. Short, role-specific training prevents the defect classes scanning keeps finding.

12. Keep the compliance file. Scope memo, dated audits, remediation plan with owners and dates, progress records, statement versions, vendor conformance documents and training logs, all in one place. When a national authority or a large B2B customer asks where you stand, this file is the answer.

If you are late: building a defensible catch-up posture

Many in-scope companies were not conformant on 28 June 2025 and are not fully conformant today. If that is you, panic is not a strategy, but neither is silence. The defensible posture has three parts:

A documented plan. A remediation roadmap with named owners, dates and priorities, approved at a level that can allocate budget.

Dated progress. Baseline audit, follow-up scans, closed-defect counts, release notes referencing accessibility fixes. Enforcement in most member states involves dialogue and correction before penalties, and what you can demonstrate shapes that dialogue.

Statement honesty. Your accessibility statement should say what is true: which parts conform, which do not yet, and when you expect them to.

None of this makes non-compliance compliant or eliminates enforcement risk, but it puts you in the position authorities and customers treat more favorably: the company that measured, planned and moved.

Non-EU sellers into the EU: why the EAA reaches you

The EAA follows the market, not the company registry. If you provide an in-scope service to consumers in the EU, the obligations attach regardless of where your company is established. A US SaaS with an EU consumer tier, a UK retailer shipping to Ireland, or a Turkish e-commerce brand with a European storefront all face the same question: is the EU-facing journey accessible?

For internationally operating teams, the efficient move is to treat accessibility as one engineering program serving multiple legal regimes. Turkey is a live example: Presidential Circular 2025/10 made web and mobile accessibility binding for a broad set of sectors with WCAG 2.2 Level A as the standard, and its first-wave deadline has also passed. If you operate in both markets, read our guide to Turkey's Circular 2025/10 for international companies and run both workstreams on one inventory and one fix pipeline, with separate documentation outputs.

Where scanning and statement tooling fit in

No tool makes an organization EAA-compliant, and a vendor that promises otherwise is telling you something about the vendor. What tooling can honestly do is support the program: measure where you stand, help you remediate faster and document the trail your compliance file rests on.

Automated scanning covers machine-detectable defect classes (missing alt text, contrast failures, label and structure defects) across an entire estate at a frequency manual audits cannot match, producing the dated conformance trend item 12 needs; manual expert testing remains necessary for judgment-dependent criteria. It is also worth understanding what overlay widgets can and cannot fix before relying on one; we wrote a candid comparison in overlay vs scanner.

cerez.io's accessibility toolkit combines automated WCAG scanning with an on-page assistance widget and an accessibility statement generator, so a team working through this checklist can baseline the estate, monitor regressions release by release and keep the statement current. It supports, measures and documents the work; the conformance itself is engineered by your team.

Frequently Asked Questions

Is the EAA already enforceable in 2026?

Short answer: Yes. The directive's main application date was 28 June 2025, and member states' national implementing laws are in force. Enforcement sits with national authorities, so procedures and penalties vary by country, and activity ramps up complaint by complaint rather than in a single EU-level sweep.

Does the EAA apply to companies outside the EU?

Short answer: Yes, if you provide in-scope products or services to consumers in the EU. The obligations follow the market: a non-EU e-commerce site selling to EU consumers is in scope regardless of where the company is established.

Is WCAG 2.1 AA enough for EN 301 549?

Short answer: For web content, current versions of EN 301 549 align with WCAG 2.1 Level AA, so genuine 2.1 AA conformance covers the standard's web clauses. EN 301 549 also covers non-web documents, software and support services, and WCAG 2.2 AA is the sensible forward-looking target for new work.

What is the microenterprise exemption?

Short answer: Service providers that employ fewer than 10 persons and have an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million are exempt from the EAA's service accessibility requirements. The headcount condition and the financial condition must both hold, and microenterprises dealing with products only get relief from certain documentation obligations.

What happens if I am not compliant yet?

Short answer: National enforcement generally starts with complaints, information requests and correction orders, and what you can demonstrate shapes the outcome. The defensible posture is a dated baseline audit, a prioritized remediation plan, visible progress and an honest accessibility statement. That does not remove enforcement risk, but it materially changes your position.

Sources

• Directive (EU) 2019/882, the European Accessibility Act
• W3C, Web Content Accessibility Guidelines (WCAG) 2.2
• W3C, Web Content Accessibility Guidelines (WCAG) 2.1
• Presidential Circular 2025/10, Official Gazette of Turkey, 21 June 2025, issue 32933 (PDF, Turkish)

If the EAA deadline caught your team unprepared, start with the measurement step: a baseline scan tells you where you stand today. Start free with an automated WCAG scan and an accessibility statement for your site, or review plans and pricing. This article is for information purposes and is not legal advice.