Accessibility is not an audit: what article 13(3) actually asks for
Ask ten site owners what the European Accessibility Act requires and most will say “an audit”. The directive never uses that word for services. Article 13(3) asks for procedures that keep the service in conformity, and annex V point 3 asks you to be able to show that your delivery process and the monitoring of it are what guarantee that conformity. A report describes a moment. The law asks about a mechanism.
What article 13(3) says
Service providers must ensure that procedures are in place so that the provision of services remains in conformity with the applicable accessibility requirements. Three kinds of change have to be adequately taken into account:
- changes in the characteristics of the provision of the service
- changes in the applicable accessibility requirements
- changes in the harmonised standards or technical specifications by reference to which the service is declared to meet the requirements
The first one is the obvious one: you ship a new checkout, a new template, a new booking flow. The second and third are the ones almost nobody has a mechanism for.
The third one is the trap
Conformity under this directive is presumed when you comply with harmonised standards whose references have been published in the Official Journal, and only in so far as those standards cover the requirements (article 15). Under this directive no such reference has been published so far, so that presumption is not available today. The standard used in practice is EN 301 549, a European standard for accessible ICT that points websites to WCAG. It is harmonised under the directive for public sector websites (2016/2102), not under this one.
Which means the yardstick can move without you touching a line of code. If the standard your statement rests on gets a new version, article 13(3) says you take that into account. Not eventually. As a procedure you already have.
Annex V point 3, the sentence people skip
Annex V is mostly known for the three content items: describe the service, explain how it works, explain how it meets the requirements. There is a fourth sentence, and it asks for something categorically different. You provide information demonstrating that the service delivery process and its monitoring ensure compliance.
That is not a finding. It is a description of how you work, backed by evidence that you actually work that way.
And then article 13(5)
On a reasoned request from a competent authority, you provide all the information necessary to demonstrate the conformity of the service. Note who is doing the demonstrating. Not the regulator proving you failed. You, showing you did the thing.
That is a documentation problem before it is a testing problem, and it is the reason a single PDF from last year is a weak answer.
What an audit is good for, and what it is not
A point-in-time assessment is the right instrument for one job: finding out where you stand right now, in depth, including everything a machine cannot judge. Nothing here replaces that.
What it cannot do is answer the question the directive actually asks, which is about continuity. Between two audits, the only honest statement about your site is that you do not know.
Where we sit in this, plainly
We re-test registered domains on a schedule that depends on the plan, from daily to monthly, and each re-test records what changed since the last one: what was resolved, what is no longer detected by automated re-testing, what is new, and what came back. That history is the raw material for a process description under annex V point 3.
It is not the process description itself. That document is yours, because it describes how your organisation works, and we are not going to write a claim about your organisation for you. What we can do is make sure the measurement history behind it is not a folder of PDFs nobody can reconcile.
An honest caveat about the measurement: automated testing covers part of the standard. Our scanner tests 31 of the 55 WCAG AA criteria by machine, in full or in part; the rest needs human review, and we say so in every report.
Every process description starts somewhere, and the first measurement takes 60 seconds.
Start the free scanFrequently asked questions
- Does the EAA require an audit?
- Not in those words. For services it requires procedures that keep the service in conformity (article 13(3)) and information showing that the delivery process and its monitoring ensure that conformity (annex V point 3).
- How often do I have to re-check?
- The directive sets no interval. It ties the obligation to change: in your service, in the requirements, and in the standards. So the honest answer is whenever one of those three moves, which is why a fixed calendar reminder is a poor substitute for a procedure.
- What happens if the standard changes?
- Your presumption of conformity is tied to the standard you applied. A new version is exactly the third category of change in article 13(3), and it has to be taken into account.
- Is a scan report enough?
- It is evidence of a measurement, not evidence of a process. You need both, and the second one is a document you write.
- Who has to demonstrate conformity?
- You do, on a reasoned request from a competent authority (article 13(5)).
Sources
Wexlo scans websites for accessibility and is open about what automated testing does and does not see. This article is information, not legal advice.