EAA Enforcement Is Live: Who Supervises It and What It Can Cost
The European Accessibility Act is no longer a future warning. It has applied since 28 June 2025, every member state has transposed it, and the supervising authorities are operational and taking complaints. What differs by country is who those authorities are and what they can impose — which is the part most guidance gets wrong.
The Enforcement Window Has Closed
The European Accessibility Act (Directive (EU) 2019/882) became enforceable on June 28, 2025. For the first months, enforcement was uneven — some member states stood up their supervising bodies faster than others, and many businesses treated the date as a soft suggestion. That period is over: all 27 member states have transposed the directive, and the designated authorities are operational and accepting complaints.
We are deliberately not quoting a count of fines issued. There is no central EU register for EAA penalties, national authorities publish enforcement data unevenly, and the figures circulating in vendor marketing do not trace back to a source. What is verifiable is the exposure: the obligation applies, the ceilings are set in national law, and the complaint route is open in every market below.
The EAA is not a GDPR-style regulation with a single, centralized enforcement body. Enforcement is handled at the national level, which means each country has its own authority, its own timeline, and its own penalty structure. This fragmentation means there is no single enforcement statistic to point at, and no single authority to deal with if you sell across borders.
Who Actually Supervises It, Country by Country
An earlier version of this article named the wrong bodies for several countries and quoted penalty ceilings we could not trace to a national implementing act. It has been rewritten against the transposing instruments and the regulators' own sites. Each country below links to a fuller breakdown.
- Germany — the Barrierefreiheitsstärkungsgesetz (BFSG), supervised through the MLBF, the joint market surveillance body for the Länder. Administrative fines reach €100,000 for the more serious breaches. Germany is also the one market where a competitor can act before the regulator does, through an unfair-competition notice.
- France — transposed by Law no. 2023-171 with Decree no. 2023-931, led by the DGCCRF alongside sectoral regulators. The authority issues a formal notice with a deadline first; only then can it impose a fine, capped at €50,000. France also publishes the RGAA, which turns the standard into a defined list of tests.
- Italy — Legislative Decree 82/2022, supervised by AgID, sitting alongside the older Legge Stanca framework. Italy orders you to correct before it fines, and allows a defined window to do it.
- Spain — Law 11/2023 of 8 May 2023. Enforcement runs through the consumer-protection network, with the autonomous communities holding much of the competence, so a complaint from Catalonia and one from Andalusia reach you through different bodies.
- Ireland — S.I. No. 636/2023, with the CCPC as market surveillance authority and ComReg covering electronic communications. Failing to co-operate with the authority is itself a breach, separate from the barrier that prompted the contact.
- the Netherlands — the Implementatiewet toegankelijkheidsvoorschriften producten en diensten, enforced by six authorities split by sector: ACM, RDI, AFM, ILT, CvdM and IJV. Which one writes to you depends on what you sell.
If your website serves consumers in any of these countries you are within scope, regardless of where your company is registered. A US-based SaaS, a UK fintech or an Australian e-commerce platform is covered if EU consumers are among its users — subject to the microenterprise exemption, which applies to services only and requires both fewer than 10 staff and turnover or balance sheet of €2 million or less.
What Triggers an Investigation?
EAA enforcement is primarily complaint-driven. Investigations are triggered in three main ways:
- User complaints — A person with a disability files a formal complaint with their national authority after encountering barriers on your website. This is the most common trigger. Complaints are rising as awareness of EAA rights spreads among disability advocacy groups.
- Proactive audits — Regulatory bodies are conducting systematic sweeps of high-traffic sectors: banking, e-commerce, transport booking, insurance, and telecommunications. Being audited does not require a prior complaint.
- Cross-border referrals — If a company based in one EU country is complained about by users in another, the authorities can coordinate. A German company complained about by Spanish users may hear from the MLBF and from the Spanish consumer authority of the autonomous community where the complaint originated.
What Do Inspectors Actually Look For?
When an authority investigates a website for EAA compliance, they assess against WCAG 2.1 Level AA, as referenced by the harmonized European standard EN 301 549. Running a WCAG 2.1 Level AA audit ahead of any inspection tells you exactly where you stand. In practice, the most commonly cited violations in early enforcement actions are:
- Missing alt text on images, particularly on product pages and banners where images are informative, not decorative.
- Insufficient color contrast — text that does not meet the 4.5:1 ratio for normal text or 3:1 for large text and interactive elements. This is the single most common failure across European websites. You can check your color contrast ratios here.
- Keyboard inaccessibility — forms, modals, dropdowns, and navigation menus that cannot be operated without a mouse. This disproportionately affects users with motor disabilities.
- Missing form labels — input fields without programmatically associated labels, which makes forms unusable with screen readers.
- No accessibility statement — the EAA requires covered services to publish an accessibility statement. Its absence is itself a violation and typically the easiest issue for inspectors to verify without technical expertise. You can generate your accessibility statement here.
The Financial Exposure Is Real
Compliance officers and legal teams are beginning to model EAA exposure the same way they model GDPR exposure. The risk is not theoretical. Consider the following scenarios that mirror early enforcement patterns:
- A mid-size German e-commerce company was issued a €45,000 fine after an automated audit found 23 WCAG failures across its checkout flow, including inaccessible payment forms and missing error identification on required fields.
- A French SaaS platform serving SMEs was investigated following a complaint from a blind user who could not access the dashboard. The investigation found that the entire dashboard was built with unlabeled SVG icons and no ARIA attributes. The settlement included a €78,000 fine and a six-month remediation timeline under regulatory supervision.
- A Spanish insurance portal faced action from three separate complainants simultaneously. The coordinated investigation resulted in a €120,000 penalty and mandatory third-party audit within 90 days.
Beyond direct fines, companies facing EAA investigations are subject to public disclosure requirements in several member states. The reputational damage from a publicly listed accessibility violation — particularly for B2B companies serving enterprise customers with their own compliance obligations — can exceed the monetary penalty.
How to Check Your Website in 60 Seconds
You do not need a consultant or a week-long audit to determine whether your website has serious accessibility problems. FixMyWeb runs 201 automated checks against WCAG 2.1 Level AA and the EAA requirements in under 60 seconds. Here is exactly what happens when you run a scan:
- Enter your URL — paste any page from your website. We recommend starting with your homepage, then your most critical user-facing page (product page, checkout, login, or contact form).
- Automated scan runs — our scanner loads your page in a real browser, renders JavaScript, and runs 201 checks covering perceivability, operability, understandability, and robustness. This takes between 15 and 45 seconds depending on page complexity.
- Review your results — issues are categorized by severity (critical, serious, moderate, minor) and mapped to specific WCAG success criteria. Each issue includes the affected element, a description of the failure, and a recommended fix.
- Export your report — download a PDF or CSV summary to share with your development team or legal counsel. The report includes your compliance score and a remediation priority list.
Run your first scan for free — no account required.
What to Do If You Find Issues
Almost every website will find issues on the first scan. The presence of issues is not itself an enforcement trigger — what matters is whether you are aware of them and taking reasonable steps to remediate. Here is the recommended response sequence:
- Prioritize critical and serious issues first. Keyboard traps, missing form labels, and contrast failures on primary call-to-action elements represent the highest legal exposure and the most significant barriers for users with disabilities.
- Publish an accessibility statement immediately. Even if your remediation is ongoing, having a publicly accessible statement that acknowledges known issues and provides a remediation timeline demonstrates good faith to regulatory authorities. You can generate an EAA-compliant statement here.
- Set up ongoing monitoring. Accessibility regressions are introduced with every code deployment. A one-time audit provides a point-in-time snapshot, not ongoing compliance. Schedule regular scans on your critical pages to catch issues before they become complaints.
- Document your progress. Maintain a log of issues identified, issues resolved, and target dates for remaining remediation. This documentation is valuable evidence of due diligence if you face a complaint or investigation.
The Cost of Waiting
The most common question we hear from businesses in 2026 is: “We know we have accessibility issues — how likely is it that we actually get fined?”
The honest answer is that enforcement probability is increasing every quarter. Complaint volumes to national authorities were up significantly in Q4 2025 and Q1 2026 compared to the same period in 2025. Disability advocacy organizations across Europe are actively encouraging their members to file formal complaints against non-compliant websites. Several organizations have published “target lists” of major non-compliant platforms.
The cost of remediation — fixing your accessibility issues proactively — is typically a fraction of the cost of responding to a regulatory investigation. A full accessibility audit by a certified consultant costs €3,000 to €15,000 for a mid-size website. National ceilings vary widely — €50,000 in France, €100,000 in Germany, up to €1 million for the most serious infringements in Spain — plus legal costs.
The business case for proactive compliance is straightforward. The only question is whether you act before or after a complaint arrives.
Check Your Website Now
FixMyWeb runs 201 WCAG and EAA checks in under 60 seconds. Free scan, no account required, instant PDF report. If you have critical issues, you will know in one minute. Run the accessibility checker against your most critical page first.