EAA compliance for SMBs: what changes 28 June 2025

The European Accessibility Act (EAA, Directive 2019/882) takes effect for private-sector products and services on 28 June 2025. Member states have transposed it into national law and are starting to publish enforcement guidance. The shift this creates for SMBs is significant: accessibility, which used to be a public-sector and large-enterprise concern, becomes a normal product-quality obligation for any company selling to EU consumers.

This article is the SMB version. Who is in scope, who is exempt, what you need to do, and what enforcement is going to look like.

What the EAA actually requires

For websites, mobile apps, and digital services, the EAA points to EN 301 549, the harmonised European standard. EN 301 549 in turn references WCAG 2.1 Level AA for web content. So if your site meets WCAG 2.1 AA, it meets the EAA technical bar for the web.

Beyond the technical conformance, the EAA also requires:

• An accessibility statement describing how the service meets the requirements, what is not accessible and why, and how to provide feedback.
• A feedback mechanism so users can report inaccessibility and request alternatives.
• Documentation showing how the service was designed and tested for accessibility.
• Plain-language descriptions of the accessibility features in the terms of service or pre-purchase information.

Who is in scope

The EAA applies to specific products and services. For SMBs, the relevant categories are:

• E-commerce — any online store selling consumer products or services to EU consumers.
• Consumer banking services including payment accounts and online banking interfaces.
• E-books and dedicated e-reading platforms.
• Transport services — ticketing, real-time information, websites and apps for air, rail, water, and bus services.
• Electronic communications services and emergency communications (covered separately by the EECC).
• Audiovisual media services — websites and apps for streaming, video on demand, and broadcaster catch-up.

The microenterprise exemption

Article 4(5) of the EAA exempts microenterprises providing services from the substantive accessibility requirements. The EU definition of a microenterprise: fewer than 10 employees AND annual turnover or balance sheet under €2 million.

Two important caveats. First, the exemption is for service-side obligations only; microenterprises that manufacture products covered by the EAA still must comply, with lighter documentation duties. Second, the exemption does not cover the underlying obligations under the UN Convention on the Rights of Persons with Disabilities, which many member states have transposed into national anti-discrimination law that applies regardless of company size. In Germany, France, and Spain in particular, expect national accessibility law to bite below the EAA threshold.

What enforcement will look like

Each member state designates national surveillance authorities. Penalties are set in national law and vary widely:

• Germany (BFSG, Barrierefreiheitsstärkungsgesetz): fines up to €100,000 per violation, plus the right of the authority to order the service taken offline.
• France: fines up to €50,000 for repeated breaches, plus per-day penalties for ongoing non-compliance.
• Italy, Spain, Netherlands: variable fines plus injunctions; the Netherlands has been particularly active in pre-EAA enforcement.

The realistic enforcement pattern, drawn from how other EU directives have rolled out: initial 6–12 months of awareness and complaint-driven enforcement, followed by authority-initiated audits in the highest-volume sectors (e-commerce, banking, travel), with fines focused on companies that received a complaint and did not respond in good faith.

What SMBs should actually do

If you are in scope and not a microenterprise, the practical preparation is short.

1. Run a baseline WCAG 2.1 AA audit. Get the list of issues, prioritise the high-severity ones, fix them. Plan for a multi-sprint effort if your site has never been audited before.
2. Publish an accessibility statement. Even if the site is not yet fully accessible, the statement is a hard requirement. Be honest about what works and what doesn’t — regulators reward good faith and punish silence.
3. Add a feedback channel. A specific email address (e.g., accessibility@yourdomain.com) and a stated SLA (e.g., respond within 5 business days). Document the responses; you may need them later.
4. Set up continuous monitoring. The most common failure pattern is not a non-compliant launch — it is an EAA-compliant site that introduces a regression six months later when marketing adds a new component or product launches a new flow. Continuous scanning is how SMBs stay above the line without staffing a compliance team.

The accessibility-statement template

A workable template covers: which standard you target (WCAG 2.1 AA), the date of your most recent self-assessment, known limitations and the timeline to fix them, the feedback channel, and the alternative methods of access available to users who cannot use the website. Member-state authorities (Germany’s BFIT-Bund, France’s DINUM, the Netherlands’ Logius) publish official templates; pick one and adapt it.

How Veracly approaches the EAA

Veracly generates an EAA-aligned report from the same scan that produces your GDPR, ADA, and UK Equality Act reports. The scan tests against EN 301 549/WCAG 2.1 AA, and each issue maps to the specific clause and the recommended developer fix. The output includes a draft accessibility statement keyed to your actual scan results, so you can publish something defensible in days rather than months. Run a free scan.

See also: WCAG 2.1 AA accessibility audit explained · What is a website compliance audit?