19 August 2026

The reporting obligation for an inaccessible website: fix it within 1 week or 1 month, otherwise report it to ACM

If your online shop or online service does not work for everyone, ACM says you must fix it immediately. If you cannot do so within 1 week for a critical or serious problem, or within 1 month for a moderate or minor problem, you must report it to ACM. If you resolve it within that period, you do not need to report anything. An independent audit or certification mark is not mandatory.

Most articles about the European Accessibility Act focus on fines. That is understandable, and it is also precisely why the obligation that already applies today is being overlooked. Because there is one, it is specific, and it is clearly stated on the website of the Autoriteit Consument en Markt.

What it says verbatim

The ACM puts it this way: if your e-commerce service or electronic communications service is not accessible, you must fix this immediately. If you cannot, you must report it. There are two deadlines, depending on the severity of the problem.

• 1 week: you must report problems with a critical or serious impact to the ACM within 1 week.
• 1 month: you must report problems with a moderate or minor impact to the ACM within 1 month.

You must either fix it or report it, not both

This is consistently summarised incorrectly, and the distinction matters considerably. Both deadlines state that reporting is not necessary if you have already fixed the problem within that period. It is therefore a fix-or-report deadline, not an unconditional reporting obligation. The clock runs towards a choice: fixed or reported.

In practice, that means something uncomfortable. You cannot fulfil this obligation without knowing what is broken and how serious it is, because without those two pieces of information, you do not know which of the two deadlines applies. If you do not measure, you do not know whether you still have a week today or are already too late.

The four severity levels, and the gap in them

Critical, serious, moderate and minor. The ACM uses these four terms to determine the deadline, but does not define them. That is a genuine gap, and talking around it helps no one.

The AFM publishes the same four-level classification and does provide a bridge: as a guideline, the impact can be determined based on the level of the WCAG criteria, with a level A criterion having a serious or critical impact and a level AA criterion having a moderate or minor impact. That is useful, but be precise about what it is: it is guidance from a different regulator, not an explanation from the ACM of its own deadline.

When does the deadline start?

The ACM does not say. No starting point is given for the 1 week and 1 month deadlines. In its version, the AFM writes after detection, but once again, that is the other regulator. Anyone who gives you a definitive answer here is making it up.

By comparison, some Member States do specify this. Lithuania counts from the day on which you became aware of the non-conformity, and Bulgaria from the day it was identified. In the Netherlands, this remains open, which is a reason to record the date and time of every finding yourself, rather than hoping it does not matter.

An audit is not mandatory, and neither is a certification mark

This is the passage we would prefer to skip, because we sell scans and reports. However, the ACM is absolutely clear about it: you do not need to have proof of accessibility for your website or app, an independent WCAG audit or assessment is not mandatory, and a certificate, label or certification mark is not required.

So no, you are not required to buy a report. What you do need is to know what is going on, because otherwise you can neither fix it nor report it meaningfully. You can do that with a scan, a manual review, your own developers, or a combination of these. Anyone who tells you that the law prescribes their product is selling you something on false grounds.

How unique is the Dutch deadline?

Less unique than is often claimed, but unique in one respect. We reviewed the transposition in all 27 Member States. Three countries specify a concrete number of days: the Netherlands, Sweden with 14 days and Lithuania with 5 working days. Sweden immediately requires a caveat, because those 14 days are not set out in the law itself but in guidance from the regulator PTS; the wording of the law says immediately. Lithuania does set it out in the law. The other 22 countries only reproduce the wording of the directive, while Finland and Portugal do not specify any timeframe at all.

Where the Netherlands does stand alone is in differentiating the deadline according to severity. Nowhere else does the notification deadline depend on how serious the problem is.

Take care when reading other summaries: six deadlines are circulating that look like notification deadlines but are not, such as Finland's two weeks (responding to user feedback), Poland's 30 days (consumer complaint) and Slovakia's deadline of a year (fixing the issue after notification). We initially fell into that trap ourselves too.

What this means in practice

• Know what is broken. Without findings that have a severity level, you do not know which deadline applies.
• Record the date and time of every finding. The ACM leaves the starting point open, so your own records are what you have.
• Preferably fix the issue within the deadline. The notification requirement then lapses, and that is the least expensive route.
• If that is not possible, submit a notification. Notifying is not an admission of negligence, but the route prescribed by the law itself.
• Do you supply in more countries? The notification obligation under Article 13(4) then applies in every Member State where you supply, and the deadlines differ by country.

An automated scan is a starting point, not an end point. Ours tests 31 of the 55 WCAG 2.2 AA criteria, in full or in part; the rest requires a person. That is enough to know whether something is wrong and how serious it is, but not enough to conclude that nothing is wrong.

About the sources without a link: we consulted those texts ourselves with the relevant regulator or in the national legislation, but we only include a link if we have checked it ourselves at the time of writing. In an article like this, a link that redirects somewhere else over time is worse than no link.

This article is for information purposes and does not constitute legal advice. We consulted the cited texts ourselves with the regulators and in the national legislation, but rules change and your situation may differ. If you are unsure about your own obligations, consult the competent authority or a lawyer. Wexlo scans websites for accessibility and is transparent about what automated testing can and cannot detect.