European Accessibility Act: How 27 EU Countries Enforce It

The European Accessibility Act has applied in all 27 EU member states since 28 June 2025, but each country enforces it through its own law, regulator and penalties. We read the national transposing laws: maximum fines for non-compliant e-commerce services range from €7,500 per breach in France to €1 million in Spain, and no regulator fine has yet been published anywhere.

Sixteen months in, the first real pressure has come from the courts, not regulators. In June 2026 a French judge ordered Carrefour France to make its online grocery site and app fully accessible within six months. Regulators in the Netherlands, Czechia and Sweden have started testing online shops. This report sets out what the Act requires, how every member state has written it into law, and what it means for pharmaceutical, medtech and online pharmacy businesses. It is based on the national legal texts and official regulator publications, checked on 15 October 2026. It is not legal advice.

What the European Accessibility Act requires

The European Accessibility Act (Directive (EU) 2019/882) sets common accessibility requirements for a list of products and services sold to consumers. Member states had to transpose it by 28 June 2022 and apply it from 28 June 2025.

Services covered (Article 2(2)): electronic communications; services providing access to audiovisual media; elements of air, bus, rail and waterborne passenger transport (websites, apps, e-tickets, travel information and self-service terminals); consumer banking; e-books and dedicated software; and e-commerce services. Answering emergency calls to 112 is also covered.

Products covered (Article 2(1)): consumer computers and operating systems, payment terminals, ATMs, ticketing and check-in machines, interactive information terminals, smartphones and other consumer terminal equipment, and e-readers.

E-commerce is defined as services provided at a distance, through websites and mobile apps, at the individual request of a consumer with a view to concluding a consumer contract. Recital 43 says the obligations should apply to the online sale of any product or service. In practice that means the whole buying journey: product pages, search, the basket, payment, identification and the information a consumer needs to complete a purchase.

What a service provider must do:

• Design and provide the service to meet the accessibility requirements in Annex I, which follow the principles that a service must be perceivable, operable, understandable and robust.
• Publish information on how the service meets those requirements, in its general terms and conditions or an equivalent document, in accessible written and oral formats (Article 13 and Annex V).
• Take corrective measures when the service does not conform and immediately inform the competent authorities (Article 13(4)).
• If relying on the "disproportionate burden" or "fundamental alteration" exception, document the assessment, keep it for five years, review it at least every five years and notify the relevant authority in each member state concerned (Article 14). A firm that received external funding for accessibility cannot rely on the burden exception.

Exemptions and transition periods: microenterprises providing services are exempt (Article 4(5)). Services may keep using products that were lawfully in use before 28 June 2025 until 28 June 2030, and service contracts agreed before that date can continue unchanged until they expire, for no longer than five years. Member states may allow self-service terminals to stay in use for up to 20 years.

Non-EU businesses: the directive defines a service provider as anyone who provides a service on the Union market or offers it to consumers in the EU. A company based in the UK, the US, the Gulf or elsewhere that sells online to EU consumers is therefore within scope, a reading shared by law firm Bird & Bird.

The first court cases: France's online grocery lawsuits

The clearest test of the new rules so far is a set of civil actions brought by disability organisations, not regulators. On 7 July 2025 the associations apiDV and Droit Pluriel, supported by the lawyers' collective Intérêt à Agir, sent formal notices to Auchan, Carrefour, E.Leclerc and Picard Surgelés over online grocery sites and apps that blind and partially sighted shoppers could not use. In November 2025 they started urgent interim proceedings against all four.

• Auchan (Lille, 5 May 2026): the court dismissed the claims. It found that the turnover of Auchan's French e-commerce company was below the €250 million threshold that triggers the online accessibility duty under article 47 of France's 2005 disability law. According to AFP reporting, the judge still criticised the company's limited interest in accessibility. The associations have appealed.
• Carrefour (Caen, 4 June 2026): the court ordered Carrefour France to make its online grocery website and mobile app fully accessible within six months, or pay a penalty of €500 per day. It rejected Carrefour's argument that its site was 71% compliant, holding that an e-commerce site cannot be only partly accessible (reported by France 3 and handicap.fr). According to Faire-Face, the order relied both on the 2005 law and on article L.412-13 of the Consumer Code, the provision that transposes the EAA. Six months from the order points to early December 2026.
• E.Leclerc (Créteil): the hearing was postponed to 22 September 2026. We found no published outcome. No ruling on Picard has been reported.

The two rulings went in opposite directions because they turned on different legal bases. The 2005 law applies only to large companies, while the EAA duty in the Consumer Code applies to any business above the microenterprise thresholds. Whether Carrefour has appealed has not been reported.

What regulators have done so far

Regulators have so far focused on testing, warnings and guidance rather than fines.

• Netherlands: on 24 March 2026 the consumer regulator ACM reported that on 61% of about 100 of the largest Dutch online shops, plus major telecom and energy providers, an order could not be placed using assistive technology. A further 33% had serious problems. ACM said it would approach the worst performers and that those which do not improve risk enforcement action.
• Czechia: in its April to June 2026 inspection campaign of online shops, the Czech Trade Inspection Authority (ČOI) carried out 47 accessibility checks and found breaches of Act No. 424/2023 in 10 of them, according to its 12 August 2026 report. It did not state the number or size of any fines.
• Sweden: the Post and Telecom Authority (PTS) opened its first supervisory cases on e-commerce services on 15 October 2025, targeting larger Sweden-based online sellers.
• Germany: enforcement sits with the MLBF, a joint market surveillance body of the 16 federal states based in Magdeburg, which has been fully responsible since 26 September 2025. We found no published fine decisions.
• Ireland: the CCPC has published guidance for businesses and microenterprises. Research by the charity Vision Ireland, reported in July 2026, found that only 56 complaints were made under the Act in its first year across Ireland's designated regulators, 52 of them to the CCPC. We found no CCPC prosecution.

At EU level, the European Commission opened infringement proceedings against 24 member states in July 2022 for missing the transposition deadline, referred Bulgaria to the Court of Justice in July 2024, and sent Greece a reasoned opinion in March 2025 over remaining gaps. Bulgaria and Croatia only adopted their laws in 2025.

Country by country: national laws, regulators and maximum fines

The table lists, for each member state, the law that transposes the EAA, the authority that enforces it for e-commerce services, and the top penalty for a non-compliant service. Figures are statutory maximums, usually per breach, not fines actually imposed. Where we could not confirm a figure in the legal text, we say so.

Where penalties are highest, and where they are weakest

The figures are not directly comparable, because some are per breach, some are criminal and some depend on turnover. Read together, they fall into four groups:

• Highest ceilings: Spain (€1,000,000), the Netherlands (€900,000 or 1% of turnover), Sweden (SEK 10 million), Luxembourg (€500,000 criminal fine), Czechia (CZK 10 million) and Croatia (€132,720).
• Turnover-based: Hungary (up to 5%, capped at HUF 500 million), Italy (5% for firms above €500 million) and Slovakia (3%, capped at €30,000).
• Lower or per-breach: France (€7,500 per breach, though breaches can add up), Romania (RON 15,000), Lithuania (€15,000), Slovenia (€10,000), Bulgaria (BGN 40,000) and Portugal (€44,891.81).
• No fixed maximum or none set: Denmark and Finland leave amounts to courts or conditional fines; Latvia's law contains no fine; the amounts for Greece and Malta could not be confirmed in the legal texts.

Several widely shared online figures did not match the legal texts. The Dutch cap is 1% of turnover, not 10%; the 10% figure applies only to unfair commercial practices. France's €50,000 and €25,000 fines belong to the separate 2005 law regime, not the EAA. We found no legal basis for figures such as €300,000 for France or a turnover-based cap for Belgium.

Ireland: what the CCPC enforces

Ireland transposed the Act through S.I. No. 636/2023. The CCPC is the market surveillance authority for all covered products and the compliance authority for e-commerce services and e-books. ComReg covers electronic communications, Coimisiún na Meán covers access to audiovisual media, the Central Bank covers consumer banking, and the National Transport Authority and Irish Aviation Authority cover transport.

Breaches are criminal offences. On summary conviction the penalty is a class A fine of up to €5,000 and/or up to six months' imprisonment. On conviction on indictment it is a fine of up to €60,000 and/or up to 18 months. Courts must weigh the seriousness of the breach and the number of services and people affected, and directors and officers can be personally liable. The CCPC has published guidelines for microenterprises and says it takes a proportionate approach.

What it means for pharma, medtech and online pharmacies

Online pharmacies and health e-shops. The directive contains no exclusion for health or pharmacy. Because it covers the online sale of any product or service to consumers, an online pharmacy or health e-shop that sells to the public is in scope unless it is a microenterprise. Italian law firm Portolano Cavallo takes the same view, including for online booking of services such as vaccinations. How the rules apply to the dispensing of prescription medicines has not been clarified, and medicine product information such as package leaflets is not an EAA category.

A warning from Sweden. In an August 2026 report, Sweden's PTS found that pharmacy websites had the most accessibility errors per page of the nine sectors it monitored, about 15 times as many as government agencies. PTS linked this partly to complex filters and product information in e-commerce, and noted that pharmacy and bank sites also improved most during 2025.

Medical devices. Devices are not a listed category. Recital 51 says covered products and services do not automatically fall under medical device law. According to Bird & Bird, the Act may still apply where a device or accessory also falls into a listed category, for example consumer terminal equipment used for remote monitoring or virtual consultations.

Health apps. Apps through which consumers buy health services on a subscription or payment basis may count as e-commerce services. The position of free, non-transactional health information apps is unclear. Public-sector health websites and apps fall under the separate Web Accessibility Directive, not the EAA.

Recruitment, B2B and corporate sites. The Act protects consumers. Corporate websites, investor pages and business-to-business ordering portals are not in scope unless they sell to consumers, although many companies apply the same standards across all their sites.

WCAG, EN 301 549 and what automated checks can find

The directive itself does not mention WCAG or EN 301 549; its Annex I sets functional requirements. The usual route to showing conformity is a harmonised standard cited in the EU's Official Journal. ETSI published EN 301 549 V4.1.1 in September 2026, prepared to support the EAA and aligned with WCAG 2.2. It gives a presumption of conformity only once it is cited in the Official Journal, which had not happened as of 15 October 2026. In practice, many national authorities and companies use WCAG 2.1 or 2.2 level AA as the working benchmark; Italy's AgID guidelines, for example, are reported to use WCAG 2.1 AA.

The scale of the problem is large. The WebAIM Million 2026 study found detectable WCAG failures on 95.9% of the top one million home pages, with an average of 56.1 errors per page. The most common were low-contrast text, missing image descriptions, missing form labels and empty links.

Automated tools find only part of the problem. A UK Government Digital Service test of ten free tools found the best single tool caught about 40% of 143 known barriers, and 29% were missed by every tool. Tool vendor Deque reported that automated testing covered 57% of issues by volume in its own audits. Manual testing with keyboards and screen readers remains necessary. A site without detected errors is not necessarily accessible.

What businesses selling online should do now

1. Check whether you are in scope: do you sell to consumers in the EU online, and are you above the microenterprise thresholds?
2. Test the full purchase journey: search, product pages, basket, checkout, payment, login and order confirmation, with automated tools and with keyboard-only and screen-reader testing.
3. Publish the required accessibility information for your service, as Article 13 and Annex V require, in accessible formats.
4. Document any exception you rely on, review it at least every five years and notify the authority in each country where you sell, where your national law requires it.
5. Fix and monitor: record corrective actions and re-test after every significant site change.

Priya Life Science publishes its own accessibility statement, setting out how this site is tested and where known issues remain.

Beyond the EU

The Act has not yet been incorporated into the EEA Agreement. The EFTA lists it as under scrutiny by Iceland, Liechtenstein and Norway, and Norwegian sources reported in January 2026 that it was not in force in Norway. The United Kingdom is not covered, but UK businesses that sell to EU consumers are.

Frequently Asked Questions (FAQ)

Conclusion and Outlook

The European Accessibility Act is now law in every member state, but enforcement is uneven: penalty ceilings differ by a factor of more than 100, several countries rely on courts or correction orders, and regulators have so far chosen testing and warnings over fines. The first pressure points are civil lawsuits by disability organisations, which do not depend on regulators acting.

The next dates to watch are the end of Carrefour's six-month compliance period in early December 2026, the outcomes of the Leclerc case and the Auchan appeal, and the citation of EN 301 549 V4.1.1 in the Official Journal. Further ahead, the transition period for services using older products ends on 28 June 2030, and the European Commission's first report on how the Act is working is due by the same date. For businesses selling online to EU consumers, including pharmacies and health e-shops, the practical message is to test the full purchase journey now rather than wait for the first fine.

Sources: Directive (EU) 2019/882 (EUR-Lex); national transposing laws: Austria (BaFG § 36, jusline.at), Belgium (Chamber bill 55K3433/001), Bulgaria (State Gazette 31/2025, damtn.government.bg), Croatia (Narodne novine 89/2025), Cyprus (Law 57(I)/2024, cylaw.org), Czechia (Act 424/2023 Coll., zakonyprolidi.cz), Denmark (Act 801/2022, retsinformation.dk), Estonia (Riigi Teataja; Sorainen), Finland (Act 306/2019 as amended, Finlex; Traficom), France (Decree 2023-931, Journal Officiel; Access42), Germany (BFSG § 37, gesetze-im-internet.de), Greece (Law 4994/2022 articles 22 and 26, taxheaven.gr), Hungary (Act XVII of 2022 and Decree 605/2022, njt.jog.gov.hu), Ireland (S.I. No. 636/2023, irishstatutebook.ie; CCPC), Italy (Legislative Decree 82/2022, normattiva.it; AgID), Latvia (likumi.lv), Lithuania (e-seimas.lrs.lt; WIDEN), Luxembourg (Law of 8 March 2023, public.lu), Malta (S.L. 627.03 and Cap. 413, legislation.mt), Netherlands (Stb. 2024, 87; Whc article 2.15, wetten.overheid.nl), Poland (Dz.U. 2024 item 731), Portugal (Decree-Law 82/2022, Diário da República; Garrigues), Romania (Law 232/2022, Monitorul Oficial 743/2022), Slovakia (Act 351/2022, slov-lex.sk), Slovenia (ZDPSI, Uradni list), Spain (Law 11/2023 and RDL 1/2013, BOE), Sweden (SFS 2023:254, riksdagen.se). Enforcement and context: ACM (24 March 2026), ČOI (12 August 2026), PTS (15 October 2025 and August 2026), CCPC (26 June 2025), European Commission (IP/24/3801; Greece reasoned opinion, March 2025), EFTA EEA-Lex, AFP via handicap.fr (May and June 2026), France 3 Normandie and Faire-Face (11 June 2026), Intérêt à Agir (November 2025), Roscommon People (1 July 2026), ETSI EN 301 549 V4.1.1, WebAIM Million 2026, UK Government Digital Service (2017), Deque (2021), Bird & Bird (2025 and January 2026), Portolano Cavallo (October 2025). All checked 15 October 2026. This article is for information only and is not legal advice.

Cover image: AI-generated illustration of a person using a laptop with a braille display; it does not show a real person, company or website.