3 September 2026

The nine things the EAA asks that are not a scan

Most conversations about the European Accessibility Act end up being about a test score. The directive is not organised that way. Read end to end, it describes a sequence: work out whether you are in scope, meet the requirements, document any exemption you rely on, publish how you comply, keep it that way when things change, show that your process is what keeps it that way, correct and notify when it does not, demonstrate all of it on request, and know who can act against you. Exactly two of those nine are things a scan can do for you.

A note before the list: the grouping into nine steps is ours, not the directive's. The obligations are real and each one is tied to an article. The numbering is a way to read them in the order you would actually meet them.

1. Work out whether you are in scope

The scope article lists the services: e-commerce, consumer banking, e-books, electronic communications, parts of passenger transport. The definition article is where the surprise sits. A service provider is anyone who provides a service on the Union market or makes offers to provide such a service to consumers in the Union (article 3, point 4). Where you are registered does not appear in that sentence.

The micro-enterprise exemption is narrower than most summaries suggest on headcount and wider on money: fewer than 10 people, and an annual turnover or an annual balance sheet total of no more than 2 million euro (article 3, point 23). Ten people and it is gone regardless of the figures.

2. Meet the requirements that apply to your kind of service

Annex I sets general requirements and then adds specific ones per service. For e-commerce, section IV point (g) singles out three things: information about the accessibility of what you sell, and the functionality for identification, security and payment, which has to be perceivable, operable, understandable and robust.

That is the checkout. It is the one part of the standard where a failure does not cost you goodwill, it costs you the order.

3. If you rely on an exemption, that is a file

Requirements apply only so far as compliance does not fundamentally alter the basic nature of the service and does not impose a disproportionate burden (article 14(1)). Invoking that is not a sentence in a meeting. You carry out the assessment against the criteria in annex VI, document it, keep the results for five years, hand a copy to the authority on request, and as a service provider redo it whenever the service changes and in any event at least every five years.

Two details that rarely make it into summaries. If you received funding from anywhere, public or private, to improve accessibility, you cannot rely on the exemption at all (article 14(6)). And the directive's own reasoning says that a lack of priority, time or knowledge is not a legitimate reason.

4. Publish how you comply

Article 13(2) with annex V: you prepare information explaining how the service meets the requirements, and you make it public in writing and orally, in a way that is itself accessible, and keep it for as long as the service is in operation. Annex V says where it goes: the general terms and conditions, or an equivalent document.

It asks for three things. A general description of the service in accessible formats. The descriptions and explanations needed to understand how the service works. And a description of how the service meets the requirements in annex I. The first two are yours to write. Only the third one is a measurement.

5. Keep it conforming when things change

Article 13(3) asks for procedures that keep the service in conformity, and names three kinds of change to take into account: changes in how you provide the service, changes in the requirements, and changes in the harmonised standards by reference to which the service is declared to meet them.

That third one catches people out. The yardstick can move without you touching a line of code.

6. Show that your process is what keeps it that way

Annex V has a fourth sentence that gets skipped. You provide information demonstrating that the service delivery process and its monitoring ensure compliance. Not a finding. A description of how you work, with evidence that you actually work that way.

7. When it does not conform: correct, and notify

Article 13(4): take corrective measures immediately, and inform the competent national authorities of the member states where the service is provided, giving details of the non-compliance and of the corrective measures taken. This is an obligation in the directive, in every member state. Some countries have added deadlines to it; the Netherlands, for instance, works with one week for critical or serious impact and one month for moderate or minor. If your country has not written a deadline down for you, you still have the duty.

8. Demonstrate it on request

Article 13(5): on a reasoned request from a competent authority you provide all the information necessary to demonstrate conformity, and you cooperate on any action taken. Note the direction of proof. Not the regulator showing you failed. You showing you did the work.

9. Know who can act, and what it costs

Article 29 requires every member state to keep two routes open: a consumer can go to the courts or a competent administrative body, and public bodies, associations or organisations with a legitimate interest can bring or support proceedings on behalf of someone affected, with that person's approval. That second route is the one used against a French retailer in June 2026.

As for cost: the directive names no amount anywhere. Article 30 leaves penalties to each member state and asks only that they are effective, proportionate and dissuasive, accompanied by actual remedial action, and that they take into account how serious the breach is and how many people it affects. Any figure you see quoted is national, and worth a source.

Where a scan fits

In two of the nine. It produces the evidence behind step 4's third element, and it is the raw material for step 6. That is it. Steps 1, 3, 5, 7, 8 and 9 are decisions and documentation, and no tool makes them for you.

That is not a reason to skip the measurement. It is a reason to treat it as the first entry in a file rather than a result you read once. And it is worth being wary of anyone who suggests their product covers more of this list than it does.

One honest caveat about the measurement itself: automated testing covers part of the standard. Our scanner tests 31 of the 55 WCAG AA criteria by machine, in full or in part; the rest needs human review, and we say so in every report.

Wexlo scans websites for accessibility and is open about what automated testing does and does not see. This article is information, not legal advice.