4 August 2026

EAA enforcement across Europe: five countries, five routes (August 2026)

The European Accessibility Act has applied since 28 June 2025, and site owners keep asking the same question: is anyone actually enforcing it? The answer is yes, but rarely in the form people expect. Enforcement is arriving through four different mechanisms, and only one of them is a regulator issuing a penalty: courts acting on cases brought by disability organisations (France), regulators measuring and confronting companies (the Netherlands, Sweden), competitors sending cease-and-desist letters (Germany), and older national accessibility law that already has teeth (Spain).

Below is the state of play per country, with a source for every claim.

Who the law applies to

The EAA covers consumer-facing digital services in the EU. Think of:

• online shops and other e-commerce services
• banking and payments
• ticketing and travel information
• e-books and the apps used to read them

There is an exemption for micro-enterprises, and it is worth reading precisely, because it is stricter than it looks on headcount and more generous than it looks on the money. In the words of the directive itself (article 3, point 23), a micro-enterprise employs fewer than 10 people and has an annual turnover or an annual balance sheet total of no more than 2 million euro. The headcount limit is absolute, but on the financial side one of the two figures staying at or under the threshold is enough. Separately, requirements can fall away where meeting them would demand a fundamental alteration of the service or impose a disproportionate burden, but that is an assessment the provider has to make and be able to show.

France: a court, not a regulator

On 4 June 2026 the tribunal judiciaire de Caen ruled in a case brought by two disability organisations, apiDV and Droit Pluriel, against Carrefour France. The court ordered carrefour.fr and the shopping app to be brought into line with the accessibility requirements, under a penalty of 500 euro for every day of delay. The penalty only starts running six months after the ruling, so around 4 December 2026: Carrefour gets half a year to fix it first. These are interim proceedings (référé), immediately enforceable but not a final judgment on the merits. A month earlier the court in Lille rejected a comparable case against Auchan, so the picture is moving rather than settled (tribunal judiciaire de Caen, 4 June 2026, case RG 25/00691).

The court also turned things down. Suspending the site and the app went too far, because that would hit other consumers too, and publishing the ruling on the Carrefour homepage was judged disproportionate. Of the 50,000 euro in damages claimed, 10,000 was awarded. And the case runs on French consumer law with the RGAA as the yardstick. So this is not an “EAA fine”, and calling it one describes the wrong mechanism.

The number the case turned on came out of Carrefour’s own accessibility statement: 71.21% conformance. The court’s reasoning is that deviating from EN 301 549 raises the presumption that the legal accessibility requirements are not met. That presumption can be rebutted, but then you have to produce the counter-evidence, and Carrefour did not. The ruling lists nineteen points of non-conformance: missing alt text, insufficient contrast, focus that is not visible, form fields without labels, text that does not reflow at 256 pixels, a heading structure that does not hold up. In the words of the ruling (our translation from the French): the e-commerce site concerned cannot be only a little accessible, it has to be accessible in full.

That is worth sitting with if you are about to publish an accessibility statement, because publishing one is not optional (article 13(2), see below). A published statement is not a shield. It is evidence. The lesson is not to stay quiet, it is that the document has to be accurate and kept current, because it will be read back to you.

One more thing about reach: Carrefour falls under this French obligation partly because its turnover is above 250 million euro (article 47 of the French law of 11 February 2005, alongside article L 412-13 of the Consumer Code, in which the EAA is transposed). That threshold is French, and it says nothing about the reach of the EAA itself, which has no turnover threshold of that kind.

There is a third detail that reaches well past France, and it is the one most reporting missed: the route those organisations used is written into the directive itself. Article 29 requires every member state to make sure that public bodies, associations and other organisations with a legitimate interest can bring or support proceedings on behalf of a person affected, with that person’s approval. What happened in Caen is not a French peculiarity. It is a channel the law deliberately opened in all 27 member states, and France was simply first to walk through it.

The DGCCRF, which supervises e-commerce in France, published a first-year review on 25 June 2026. It reports an investigation between April 2025 and March 2026 covering 38 organisations in rail and mobility, three new investigations started in January 2026, and around 100 establishments to be checked during 2026. Since December 2025 consumers can report an inaccessible service through a dedicated route on the SignalConso platform, and those reports feed the targeting of inspections.

One line in that review deserves attention well beyond France: the first of the three new investigations covers e-commerce sites and mobile apps and the practices of the firms that carry out accessibility audits on behalf of companies. The regulator is not only checking the sites. It is checking the people who check the sites. We put ourselves in that group deliberately: our report states which criteria were machine-tested and which need human review, and it never claims a site is compliant.

What a breach costs in France is not printed as an amount in any single document, which is why the figures you see quoted rarely come with a source. The chain runs like this: article R451-4 of the Consumer Code makes an accessibility breach a fifth-class offence; article 131-13 of the penal code sets that at 1,500 euro, or 3,000 euro on repeat; and article 131-41 multiplies the maximum by five for legal persons. That gives 7,500 euro per breach and 15,000 euro on repeat, per breach rather than per site. The reason you have to go country by country for this is that the directive sets no amounts at all: article 30 leaves penalties to each member state, requiring only that they are effective, proportionate and dissuasive, that they come with actual remedial measures, and that they scale with the severity of the breach and the number of people affected.

The Netherlands: the regulator measured first

On 24 March 2026 the Dutch regulator ACM published a study of around a hundred of the largest Dutch webshops and the sites of major telecom and energy providers. At 61%, placing an order using assistive technology was impossible, for instance because a checkout button could not be operated with a keyboard or a captcha was inaccessible. At a further 33% ordering was possible but took considerably more effort. ACM is pointing the worst performers at their shortcomings rather than fining them, and warns that companies which do not improve risk enforcement.

The Dutch route also makes visible an obligation that applies across the EU and that almost no site owner knows about. Article 13(4) of the directive says that when your service does not meet the requirements, you take corrective measures immediately and notify the competent national authority yourself, describing the non-conformity and what you did about it. We checked all 27 member states, and only three put a clock on it. The Netherlands: within one week for critical or serious impact, within one month for moderate or minor impact, unless you fix it inside that window. Sweden: 14 days, set out in regulator guidance rather than in the act itself. Lithuania: five working days, written into the law and counted from the day you learned of the non-conformity. Everywhere else the national law says nothing more precise than “immediately”, and Finland and Portugal do not even say that. So if you are reading this outside those three countries, you have the same duty without a number to plan against. We wrote about the Dutch situation in detail in a separate Dutch-language article.

Germany: competitors do the enforcing

Germany has needed no regulator so far. German law firms report two waves of competitor cease-and-desist letters: the first from August 2025, roughly six weeks after the deadline, with settlement demands around 595 euro, and a second wave running since February 2026 with demands around 2,700 euro.

The honest caveat belongs right next to that: no German court has yet ruled whether the German accessibility act counts as a market conduct rule under section 3a of the unfair competition act, which is the basis these letters rely on. The letters are real and the cost of answering them is real, but their legal footing has not been tested.

Spain: older law, same machinery

In 2024 the Audiencia Nacional upheld a 90,000 euro penalty against the airline Vueling for an inaccessible website, imposed by the Spanish government after years of documented shortcomings. That case predates the EAA entirely. It matters here because it shows the enforcement machinery already exists in a member state, and that a website can carry a penalty of that size without any new European law being involved.

Sweden: inspections in rounds

The Swedish regulator PTS is working through e-commerce services in rounds, starting with larger operators established in Sweden, and continuing through 2026. Consumers can report accessibility shortcomings to PTS directly.

PTS does publish the size of that programme. By 3 March 2026 it had opened 28 supervision cases against e-commerce retailers, up from 17 in late November 2025, and it names the companies in each announcement. What we could not find anywhere on its pages is a quarterly count of self-notifications or consumer complaints. So if you see a specific complaint figure quoted for Sweden, ask where it comes from before you repeat it.

Two obligations that are easy to miss

The first one is a publication duty. Article 13(2) and annex V require a service provider to set out, in the terms and conditions or an equivalent document, how the service meets the accessibility requirements: a description of the service in accessible formats, an explanation of how it works, and how it satisfies the requirements. That information has to be public, available in writing and orally, presented in a way that is itself accessible, and kept for as long as the service runs. This is not the voluntary badge people put in a footer. It is a document the law expects to exist.

The second one is the paperwork behind the escape hatch. If you rely on the disproportionate burden exemption, article 14 says you have to carry out the assessment against the criteria in annex VI, document it, keep it for five years, hand a copy to the authority on request, and as a service provider redo it at least every five years and whenever the service changes. And if you received funding from anywhere, public or private, to improve accessibility, you cannot invoke the exemption at all.

One line from the directive’s own reasoning is worth quoting to anyone who plans to lean on that exemption: a lack of priority, time or knowledge is explicitly not a legitimate reason. The exemption is for cases where the numbers genuinely do not work, and it asks you to show the numbers.

What this means if you run a website

The mechanism differs per market, but the exposure has the same shape everywhere: a court, a regulator, a competitor or a customer can ask you to show where your service stands. In each of the five countries above, the party asking had documentation and the company answering mostly did not.

So start with knowing where you stand, and be careful with anyone who promises more than that. An honest caveat about our own tooling: automated testing covers part of the standard. Our scanner tests 30 of the 50 WCAG AA criteria by machine, in full or in part; the rest needs human review, and we say so in every report.

Wexlo scans websites for accessibility and is open about what automated testing does and does not see. This article is information, not legal advice.