EAA Deadline & Penalties: What Businesses Must Know

The European Accessibility Act's compliance deadline — 28 June 2025 — is behind us. If your e-commerce store, banking app, e-book platform, or transport booking site still has unresolved accessibility issues, you're not in a "get ready" phase anymore; you're in an "at risk" phase. This article covers what changed on that date, who actually enforces the rules, what penalties look like in practice, and what to do next.

The deadline has passed

Directive (EU) 2019/882 — the EAA — was adopted in 2019 and gave member states until 2022 to write it into national law. The date that mattered for businesses was 28 June 2025: the day the substantive obligations became enforceable. For most digital products and services covered by the directive (see what the European Accessibility Act is and who it applies to for the full list), conformance with EN 301 549 and WCAG 2.1 AA is no longer optional homework — it's a live legal requirement, checked the same way any other consumer-protection or product-safety rule is checked.

What hasn't changed is that enforcement is uneven and still ramping up. Some national authorities began proactive audits within weeks of the deadline; others are still working through complaint-driven cases first. Assume your industry and country will get more, not less, scrutiny over time.

Who enforces it

The EAA doesn't create a single EU regulator. Each member state designates its own market surveillance authority (or authorities) to enforce the directive within its territory, following the same pattern used for other EU product-safety and consumer-protection law. In many countries this responsibility sits with an existing consumer-protection or telecoms regulator, sometimes split between the authority handling products and the one handling services.

Practically, this means:

• Enforcement priorities differ by country — some authorities focus first on banking and e-commerce, others on transport.
• A complaint from a single user with a disability can trigger an investigation, not just a proactive sweep.
• Cross-border sellers can, in principle, be investigated by the authority in any member state where they serve consumers.

Example penalty regimes

Because enforcement is national, penalty structures vary by country. Illustrative patterns in how member states have structured consequences for non-compliance:

• Corrective orders first, fines second — many authorities start with a formal notice requiring fixes within a set period before any fine is issued.
• Tiered fines by severity and company size — several countries cap fines by reference to company turnover or set fixed maximum amounts, with repeat or severe non-compliance attracting the top of the range.
• Market withdrawal — for products, not just websites, authorities can require a non-compliant product to be withdrawn from sale until it's fixed.
• Public disclosure — some regimes allow or require publication of enforcement decisions, which carries reputational cost independent of any fine.

Because exact figures and procedures differ by country, the reliable way to know your exposure is to check the transposition law and enforcement authority for each EU country where you have meaningful customer volume, rather than relying on a single EU-wide number.

Grace periods for services

Not everything had to be fixed by 28 June 2025. The directive includes limited transition arrangements:

• Self-service terminals (ATMs, ticket machines, check-in kiosks) already in service before the deadline can generally keep operating until the end of their economic lifetime, up to a maximum set by national law.
• Service contracts already in place before the deadline may continue unmodified until they expire, typically capped at several years, after which any renewal or new contract must be compliant.
• Microenterprises providing services (fewer than 10 staff, turnover or balance sheet under €2 million) remain exempt from the service obligations on an ongoing basis — see what the EAA is for the details of that exemption.

None of these apply to new products, new websites, or redesigned services launched after the deadline — those need to be compliant from day one.

Action plan

If you're not confident you'd pass an audit today, the fastest path to reducing exposure is:

1. Get a baseline. Run a free scan of your website against WCAG 2.1 AA and EN 301 549 to see where you stand right now, rather than guessing.
2. Fix what blocks core tasks first — checkout, account creation, login, and any legally required disclosures. These are the issues most likely to generate a user complaint.
3. Check your specific country's enforcement posture. If you have meaningful traffic from a country with active enforcement, prioritise that market.
4. Work through our WCAG 2.1 AA checklist systematically rather than fixing issues ad hoc.
5. Document everything. A dated record of what you tested, what you found, and what you fixed is your best evidence of good-faith compliance if you're ever investigated.

For a full step-by-step audit process, see how to check if your website is EAA compliant.