Do I have to report in every country where I provide services, or only where I am established?

In every country where you offer the service. This is set out in Article 13(4) of the directive, which refers to the competent authorities in the plural: in some countries there is one, in Romania there are seven, and in Greece it depends on your sector. There is no central contact point and no lead supervisory authority, so you must report separately in each country.

I only provide services in one or two EU countries. What is my deadline?

The deadline for each country where you provide services, and these deadlines differ. If you provide services in the Netherlands, ACM applies 1 week for an impact rated “critical” or “serious” and 1 month for “moderate” or “minor”, unless you resolve the issue within that period. If you provide services in Sweden, PTS considers 14 days sufficient. In Lithuania, the law specifies 5 working days. If you provide services in France, Germany, Belgium or one of the nineteen other countries, the only requirement is “immediately”, with no number of days to rely on. If you provide services in two countries with different deadlines, the shortest one will determine your schedule in practice.

When does that period start?

In most countries, this is not specified. Bulgaria states “from the identification of the shortcoming” and Lithuania “from the day on which you became aware of it”. In the Netherlands, ACM says nothing about this and only AFM states “after identification”. For most countries, “the clock starts as soon as you know” is therefore an interpretation of the word “immediately”, not a literal rule.

We are based in France. How does it work there?

Since November 2025, DGCCRF has provided an online form that allows you to report non-conformance yourself or invoke an exemption. France does not specify a deadline: the décret only states “immédiatement”. Note that since January 2026, DGCCRF has also been investigating the reliability of organisations that sell accessibility audits, so ask a provider about its method and its limitations.

We provide services in Germany or Austria. Where do I report?

In Germany, you report to the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF), and in Austria to the Sozialministeriumservice, which is explicitly named in Austrian law. Both laws state “unverzüglich” without specifying a number of days. MLBF does have a page and a contact form for businesses, but no form that structures the report: there are no fields for the nature of the shortcoming or the measures taken. You must therefore write your own text that meets the requirements of Article 13(4).

Does a finding from a scan immediately constitute a shortcoming that I have to report?

No. An automated finding requires confirmation and sometimes manual review before you can conclude that your service does not meet the requirements. A scan is a starting point for that assessment, not a substitute for it.

Do I need an audit or certification mark?

No. ACM expressly states that an independent WCAG audit or inspection is not mandatory and that a certificate, label or certification mark is not required. No other supervisory authority we reviewed says otherwise.

Does this also apply to small businesses?

This concerns services that you provide to consumers. As a service provider, you are exempt if you have fewer than 10 employees and annual turnover or an annual balance sheet total of no more than 2 million euros. The number of employees is the strict threshold: from 10 people onwards, the exemption no longer applies, regardless of your financial figures. On the financial side, you only need to remain below one of the two thresholds.

What if I provide services to EU customers from outside the EU?

The rules also apply in that case. For services, the directive does not provide for an authorised representative, as that concept exists only for products. You therefore have the obligation, but no designated contact point in the Union, and no supervisory authority publishes how it deals with this.

13 August 2026

The reporting obligation under the accessibility law: where must you report?

This article was translated from Dutch. Where the two differ, the original is the one to go by. Read the authoritative version

The European Accessibility Act contains an obligation that is rarely discussed: if your service does not conform to the accessibility requirements, you must report this yourself to the competent authorities in every Member State where you offer that service. Not only in the country where you are established, and there is no central reporting channel. We investigated what has become of that obligation in all 27 Member States. Three countries have set a specific number of days: the Netherlands (1 week or 1 month, depending on the severity), Sweden (14 days) and Lithuania (5 working days). Most Member States do have a reporting channel, but only one through which someone else can report you.

What exactly the law requires

Article 13(4) of the Directive states that, if the service does not meet the accessibility requirements, service providers must immediately inform the competent national authorities of the Member States in which the service is provided, giving a detailed description of the nature of the shortcoming and the measures they have taken.

Three things in that sentence are counterintuitive. The determining factor is provision, not establishment: if you provide services from France to Dutch customers as well, you must report in both countries. There is no one-stop shop of the kind found in data protection legislation, so anyone providing services in five countries must make five reports. And there is no authorised representative for services, so a provider from outside the EU is subject to the rules but has no designated contact point in the Union.

Note: not every Member State has transposed that cross-border wording. Malta and Slovakia have done so literally. Greece, Estonia and Luxembourg mention only their own authority in their national legislation. The obligation under the Directive remains applicable, but you will not find it in the wording of their legislation.

Three countries put a time limit on it

The word “immediately” appears in virtually every national transposition, from *unverzüglich* in Germany to *immediatamente* in Italy. Three countries have quantified it.

The Netherlands: 1 week if the impact is “critical” or “serious”, 1 month if it is “moderate” or “minor”. If you resolve it within that period, you do not have to report it. The Netherlands is the only country that differentiates the deadline according to severity.
Sweden: 14 days. This is not stated in the law but in guidance from the regulator PTS, which interprets “immediately” as without undue delay and allows multiple shortcomings to be grouped together.
Lithuania: 5 working days, specified in the law itself, calculated from the day on which you became aware of the shortcoming.

Two countries omit the time-related word entirely. Finland and Portugal require you to report, but do not specify any point in time. The remaining 22 use the wording from the Directive without defining it more precisely.

Hardly anyone says when the clock starts running. Two countries do: Bulgaria stipulates “from the identification of the shortcoming” and Lithuania “from the day on which you became aware of it”. This is the key reason why this obligation works differently from what people think. It does not depend on an inspection or a letter, but on your own knowledge.

The reporting channel that exists is usually the wrong one

Comparing the countries showed that “there is a reporting channel” can mean two very different things, and that the distinction goes precisely to the heart of the matter.

A self-report is what the law requires: you report your own shortcoming, together with the measures you have taken. A complaints channel is the reverse: someone else reports your site. Italy, Slovenia, Estonia, Denmark, Poland, Malta and Croatia do have a portal, but only for the latter. A company that wants to meet its obligations properly therefore reaches a dead end at precisely the facility that does exist.

Sweden shows another way of doing this: PTS presents the two routes side by side as two separate e-services, one for the company reporting itself and one for the user submitting a complaint. Finland has a similar dedicated route. France has an online form for the declaration of non-conformity. Germany only has a contact form with no fields for the nature of the shortcoming or the measures taken, so there you write your own free text that meets the legal requirements.

You can recognise a complaints channel by one field. If the form asks for the *reported undertaking*, it is not intended for those reporting themselves, no matter how often it is described elsewhere as a reporting portal.

Why you should not rely on summaries here

We checked this for each country in the national legislation or on the regulator’s own website, and that proved necessary. Circulating overviews repeatedly turned out to name the wrong authority, cite penalty amounts that do not appear in the relevant law, or quote a deadline that is correct but applies to something else.

The last of these is the most common pattern: a number that is correct, but placed in the wrong category. A deadline for responding to a complaint, a deadline for remediation after the notification, a conformance date, or a deadline that applies only if you invoke an exemption. All four look like a notification deadline, and none of them is one. If you copy something like this, you schedule an obligation that does not exist, or miss the obligation that does.

We also had to revise our own initial framework several times along the way. That is why a source is provided below this article for each claim, and why we prefer to state “not established” for a country rather than make an assumption.

“I’ll just wait until I hear something”

That is an understandable conclusion, and you are right on one point: we were unable to find a published fine under accessibility law in any Member State. At the end of March 2026, Sweden had twenty-eight ongoing supervisory cases against online shops, without an order. Germany explicitly describes sanctions as a last resort.

But there is one country where we do know how many companies report themselves, and that figure is higher than you might think. For 2025, the Swedish regulator reports 322 notifications of shortcomings by market participants themselves, alongside 114 reports from the public. Sweden is no larger than the Netherlands. Where the portal works and the deadline is specific, the notification obligation is therefore simply being used.

Even so, waiting has a different effect from how it feels. The notification obligation starts from the moment you know, not from the moment someone contacts you. Waiting therefore pauses nothing, it builds up a period during which you did not meet the requirements and did not report. Once enforcement does take place, the question asked retrospectively is: since when did you know, and what did you do?

In addition, the first financial incentive in Europe came not from a regulator but from a court, at the request of two advocacy organisations. That route is available without any action by a regulator.

To be fair, if you have a small online shop that only delivers within your own country and does not participate in tenders, then waiting to see what happens is not unreasonable at this point. The situation changes for agencies that receive the question from their client rather than from a regulator, and for shops that deliver to multiple countries and therefore face not one unclear obligation, but four.

Frequently asked questions

Do I have to report in every country where I provide services, or only where I am established?: In every country where you offer the service. This is set out in Article 13(4) of the directive, which refers to the competent authorities in the plural: in some countries there is one, in Romania there are seven, and in Greece it depends on your sector. There is no central contact point and no lead supervisory authority, so you must report separately in each country.
I only provide services in one or two EU countries. What is my deadline?: The deadline for each country where you provide services, and these deadlines differ. If you provide services in the Netherlands, ACM applies 1 week for an impact rated “critical” or “serious” and 1 month for “moderate” or “minor”, unless you resolve the issue within that period. If you provide services in Sweden, PTS considers 14 days sufficient. In Lithuania, the law specifies 5 working days. If you provide services in France, Germany, Belgium or one of the nineteen other countries, the only requirement is “immediately”, with no number of days to rely on. If you provide services in two countries with different deadlines, the shortest one will determine your schedule in practice.
When does that period start?: In most countries, this is not specified. Bulgaria states “from the identification of the shortcoming” and Lithuania “from the day on which you became aware of it”. In the Netherlands, ACM says nothing about this and only AFM states “after identification”. For most countries, “the clock starts as soon as you know” is therefore an interpretation of the word “immediately”, not a literal rule.
We are based in France. How does it work there?: Since November 2025, DGCCRF has provided an online form that allows you to report non-conformance yourself or invoke an exemption. France does not specify a deadline: the décret only states “immédiatement”. Note that since January 2026, DGCCRF has also been investigating the reliability of organisations that sell accessibility audits, so ask a provider about its method and its limitations.
We provide services in Germany or Austria. Where do I report?: In Germany, you report to the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF), and in Austria to the Sozialministeriumservice, which is explicitly named in Austrian law. Both laws state “unverzüglich” without specifying a number of days. MLBF does have a page and a contact form for businesses, but no form that structures the report: there are no fields for the nature of the shortcoming or the measures taken. You must therefore write your own text that meets the requirements of Article 13(4).
Does a finding from a scan immediately constitute a shortcoming that I have to report?: No. An automated finding requires confirmation and sometimes manual review before you can conclude that your service does not meet the requirements. A scan is a starting point for that assessment, not a substitute for it.
Do I need an audit or certification mark?: No. ACM expressly states that an independent WCAG audit or inspection is not mandatory and that a certificate, label or certification mark is not required. No other supervisory authority we reviewed says otherwise.
Does this also apply to small businesses?: This concerns services that you provide to consumers. As a service provider, you are exempt if you have fewer than 10 employees and annual turnover or an annual balance sheet total of no more than 2 million euros. The number of employees is the strict threshold: from 10 people onwards, the exemption no longer applies, regardless of your financial figures. On the financial side, you only need to remain below one of the two thresholds.
What if I provide services to EU customers from outside the EU?: The rules also apply in that case. For services, the directive does not provide for an authorised representative, as that concept exists only for products. You therefore have the obligation, but no designated contact point in the Union, and no supervisory authority publishes how it deals with this.

Where to report it, by country

Below are the places we found on the regulator’s own domain. Where a country is missing, we were unable to find a reporting route for businesses. That does not mean that one does not exist.

Reporting routes for businesses

Six countries deserve separate mention because the obligation exists there, but the reporting channel does not. Greece has not yet designated a competent authority for e-commerce services: the law leaves this to a ministerial decision that does not exist. Lithuania requires you to report in the manner determined by the regulator, but that manner has never been determined, even though Lithuania has the strictest deadline in the Union. In Slovakia, Malta and Italy, only the complaints channel exists. And Belgium does name a recipient, the Economische Inspectie, but the implementing decree that would regulate the format does not exist.

You cannot derive any rights from this overview. It is provided for information purposes only, is not exhaustive, and is a snapshot as at August 2026. Government websites regularly change their structure and addresses. It remains your responsibility to check whether a link leads to a complaints form rather than a self-reporting form, or whether a page has since been moved. If in doubt, always rely on the competent authority in the country where you provide your services.

Sources

This overview is not exhaustive and is for information purposes only. For each country, we consulted the national legislation or the regulator's own website, but legislation changes and one source was not accessible. Check your own situation with the competent authority. Wexlo scans websites for accessibility and is transparent about what automated testing can and cannot detect. This article provides information, not legal advice.