EAA compliance for SMBs: what has applied since 28 June 2025

The European Accessibility Act (EAA, Directive 2019/882) has applied to private-sector products and services since 28 June 2025. That is now more than a year ago. Member states have transposed it into national law and are publishing enforcement guidance. The shift it created for SMBs was significant: accessibility, which used to be a public-sector and large-enterprise concern, became a normal product-quality obligation for any company selling to EU consumers.

This article is the SMB version. Who is in scope, who is exempt, what you need to do, and what enforcement actually looks like now that the deadline is behind us.

What the EAA actually requires

For websites, mobile apps, and digital services, the EAA points to EN 301 549, the harmonised European standard. EN 301 549 in turn references WCAG 2.1 Level AA for web content. So if your site meets WCAG 2.1 AA, it meets the EAA technical bar for the web.

Beyond the technical conformance, the EAA also requires:

• An accessibility statement describing how the service meets the requirements, what is not accessible and why, and how to provide feedback.
• A feedback mechanism so users can report inaccessibility and request alternatives.
• Documentation showing how the service was designed and tested for accessibility.
• Plain-language descriptions of the accessibility features in the terms of service or pre-purchase information.

Who is in scope

The EAA applies to specific products and services. For SMBs, the relevant categories are:

• E-commerce, any online store selling consumer products or services to EU consumers.
• Consumer banking services including payment accounts and online banking interfaces.
• E-books and dedicated e-reading platforms.
• Transport services, ticketing, real-time information, websites and apps for air, rail, water, and bus services.
• Electronic communications services and emergency communications (covered separately by the EECC).
• Audiovisual media services, websites and apps for streaming, video on demand, and broadcaster catch-up.

The microenterprise exemption

Article 4(5) of the EAA exempts microenterprises providing services from the substantive accessibility requirements. The EU definition of a microenterprise: fewer than 10 employees AND annual turnover or balance sheet under €2 million.

Two important caveats. First, the exemption is for service-side obligations only; microenterprises that manufacture products covered by the EAA still must comply, with lighter documentation duties. Second, the exemption does not cover the underlying obligations under the UN Convention on the Rights of Persons with Disabilities, which many member states have transposed into national anti-discrimination law that applies regardless of company size. In Germany, France, and Spain in particular, expect national accessibility law to bite below the EAA threshold.

What enforcement looks like

Each member state designates national surveillance authorities. Penalties are set in national law and vary widely:

• Germany (BFSG, Barrierefreiheitsstärkungsgesetz): fines up to €100,000 per violation, plus the right of the authority to order the service taken offline.
• France: fines up to €50,000 for repeated breaches, plus per-day penalties for ongoing non-compliance.
• Italy, Spain, Netherlands: variable fines plus injunctions; the Netherlands has been particularly active in pre-EAA enforcement.

The awareness window that many companies were counting on in 2025 has closed. Enforcement so far is predominantly complaint-driven rather than sweep-driven, which is how most EU market-surveillance regimes begin, and authority-initiated checks land first in the highest-volume consumer sectors: e-commerce, banking, travel. For an SMB the decisive factor is usually not the initial finding but whether the complaint was answered in good faith, with a dated remediation plan, or ignored.

What SMBs should actually do

If you are in scope and not a microenterprise, the practical preparation is short.

1. Run a baseline WCAG 2.1 AA audit. Get the list of issues, prioritise the high-severity ones, fix them. Plan for a multi-sprint effort if your site has never been audited before.
2. Publish an accessibility statement. Even if the site is not yet fully accessible, the statement is a hard requirement. Be honest about what works and what doesn’t, regulators reward good faith and punish silence.
3. Add a feedback channel. A specific email address (e.g., accessibility@yourdomain.com) and a stated SLA (e.g., respond within 5 business days). Document the responses; you may need them later.
4. Set up continuous monitoring. The most common failure pattern is not a non-compliant launch, it is an EAA-compliant site that introduces a regression six months later when marketing adds a new component or product launches a new flow. Continuous scanning is how SMBs stay above the line without staffing a compliance team.

The accessibility-statement template

A workable template covers: which standard you target (WCAG 2.1 AA), the date of your most recent self-assessment, known limitations and the timeline to fix them, the feedback channel, and the alternative methods of access available to users who cannot use the website. Member-state authorities (Germany’s BFIT-Bund, France’s DINUM, the Netherlands’ Logius) publish official templates; pick one and adapt it.

How Veracly approaches the EAA

Veracly generates an EAA-aligned report from the same scan that produces your GDPR, ADA, and UK Equality Act reports, and each issue maps to the specific clause and the recommended developer fix. Be precise about what that scan is: axe-core run against the machine-testable WCAG 2.1 and 2.2 A and AA rules, at a single 1280×800 desktop viewport. It is not a test against EN 301 549 as a whole — that standard also covers hardware, documentation, support services, and real-time text — and it is not a conformance assessment. Keyboard operation, PDFs, third-party video embeds, and the 29 WCAG criteria that are not machine-testable stay on your manual list, and we say so in the report rather than scoring them silently.

On the accessibility statement, the scan tells you whether you have one, not what it says. We check that a statement exists and is reachable on your own domain; if it is missing you get a critical finding pointing at the W3C’s statement generator. We do not draft the statement for you, because the conformance status, the known limitations, the remediation timeline, and the competent enforcement contact are claims only your organisation can make — and a generated claim about your own conformance is the one thing a regulator will actually test. Run a free scan: it covers one page, on any tier the analyzers are identical, and the paid tiers add pages, AI explanations for every finding rather than just the top three, evidence screenshots and generated remediation.

See also: WCAG 2.1 AA accessibility audit explained · What is a website compliance audit?