WCAG 2.1 vs 2.2: which version applies to me?

Three WCAG versions are in active legal play in 2026. WCAG 2.0 (2008) remains the explicit mandate of AODA and Section 508 in the United States. WCAG 2.1 (2018) adds 17 criteria for mobile, low-vision, and cognitive disability access; it is the EAA’s de facto floor via EN 301 549. WCAG 2.2 (October 2023) adds 9 criteria around focus, drag interactions, help consistency, and authentication. Two regimes have already moved to it: UK public-sector bodies have been monitored against WCAG 2.2 AA since October 2024, and Australia’s Digital Experience Policy has required 2.2 AA of Commonwealth entities since 1 January 2025. The EU and the US have not followed yet.

The result: the standard and the law are out of sync, and the gap differs by jurisdiction. A WCAG 2.2 conformance claim is the best-practice posture and a future-proofed legal floor, but the question of which version is required is jurisdiction-specific.

Jurisdiction-by-jurisdiction map

European Union, EAA

The European Accessibility Act (Directive (EU) 2019/882, in force since 28 June 2025) does not name a WCAG version in its body. Article 15 directs implementation via harmonized standards. The current harmonized standard for ICT accessibility is EN 301 549 v3.2.1 (March 2021), which references WCAG 2.1 AA for web content.

The next revision is close. EN 301 549 v4.1.0 went to draft in November 2025; the version expected to be cited in the Official Journal is v4.1.1, around October 2026, and it tracks WCAG 2.2. Until that citation lands, the EU legal floor for web content under the EAA is WCAG 2.1 AA, but you are planning against a standard that moves in months, not years.

United Kingdom, Equality Act 2010 + PSBAR

The Equality Act’s reasonable-adjustments duty does not name a version, and be careful with anyone who tells you a court has settled the point. There is no reported UK judgment on web accessibility, because these claims settle before judgment. What exists is regulatory guidance, principally the EHRC’s, which is not case law but is what a tribunal would be pointed at.

The Public Sector Bodies Accessibility Regulations 2018 (PSBAR) do not name a WCAG version either. They require the A and AA criteria via EN 301 549 “as amended from time to time,” which is a moving reference by design. In practice the Government Digital Service has monitored public-sector sites against WCAG 2.2 AA since October 2024. Private-sector sites remain judged under the Equality Act reasonable-adjustments duty, with 2.1 AA the conservative benchmark and 2.2 AA the direction of travel.

United States, ADA Titles II and III

ADA Title III itself does not name WCAG. The standard that does exist is a Title II rule, not Title III: the Department of Justice’s April 2024 final rule at 28 CFR § 35.200 (Subpart H) requires WCAG 2.1 AA of state and local government websites and mobile apps. Its compliance dates were pushed back by a DOJ interim final rule on 20 April 2026, to 26 April 2027 for larger public entities and 26 April 2028 for smaller ones. Note the version it locks in: 2.1 AA, not 2.2.

For private-sector Title III defendants there is no rule at all, only litigation. Federal case law has cited both 2.0 and 2.1 AA as the technical standard; the Robles v. Domino’s line works on 2.0 AA as the de facto bar, and more recent cases have moved to 2.1.

Canada, AODA (Ontario)

Ontario’s Integrated Accessibility Standards Regulation §14 explicitly mandates WCAG 2.0 AA for public-sector and large private-sector organizations (over 50 employees). The regulation has not been amended to track 2.1 or 2.2, so the AODA legal floor is 2.0. Practical posture: target 2.1 AA for parity with the rest of the country’s ACA (Accessible Canada Act) trajectory.

Australia, DDA + the DTA policy

The Disability Discrimination Act 1992 references no technical standard whatsoever, and there is no statutory WCAG mandate for the Australian private sector. The version question is answered by policy instead of statute: the Digital Transformation Agency’s Digital Experience Policy has required WCAG 2.2 AA of non-corporate Commonwealth entities since 1 January 2025, and the Australian Human Rights Commission’s April 2025 Guidelines on equal access to digital goods and services point private organisations at 2.2 AA as the benchmark for meeting the DDA. Australia is therefore ahead of the EU and the US on version, not behind them.

The new criteria in WCAG 2.2

The 9 success criteria added in 2.2:

• 2.4.11 Focus Not Obscured (Minimum), keyboard-focused elements must not be entirely hidden behind sticky headers, cookie banners, or other overlays.
• 2.4.12 Focus Not Obscured (Enhanced), AAA version of the above.
• 2.4.13 Focus Appearance, focus indicators must meet minimum size and contrast (AAA, not required for AA).
• 2.5.7 Dragging Movements, any drag interaction must have a single-pointer alternative (a button, a tap).
• 2.5.8 Target Size (Minimum), interactive targets must be 24×24 CSS pixels or have sufficient spacing.
• 3.2.6 Consistent Help, help mechanisms appear in the same relative order on every page.
• 3.3.7 Redundant Entry, information the user already entered must be auto-populated or available for selection on subsequent forms.
• 3.3.8 Accessible Authentication (Minimum), no cognitive-function-only authentication (no “solve a CAPTCHA puzzle” without an alternative).
• 3.3.9 Accessible Authentication (Enhanced), AAA version.

Most of the new AA criteria (2.4.11, 2.5.7, 2.5.8, 3.2.6, 3.3.7, 3.3.8) are cheap to satisfy on most sites. The focus-not-obscured rule is the one that catches most teams off-guard: a sticky header that overlaps a focused link is a 2.4.11 failure that did not exist under 2.1.

What Veracly tests against

Veracly assesses every scan against WCAG 2.2 AA — the 2.0, 2.1 and 2.2 A/AA rule sets plus axe-core’s best-practice pack, run together as one superset. It is worth being precise about what that buys you, because the honest answer is narrower than the headline.

In the automated toolchain the only machine-testable 2.2 AA criterion is SC 2.5.8 Target Size (Minimum), and we do score it. A target-size failure deducts from your EAA, ADA, UK Equality Act and AODA scores exactly as a 2.1 failure would. It is not quarantined as an above-floor nice-to-have, so if you are reading a Veracly score against an EU or US legal floor of 2.1 AA, be aware that a 2.2-only finding is already inside the number.

The other eight 2.2 additions — focus-not-obscured, focus appearance, dragging alternatives, consistent help, redundant entry, accessible authentication — are not machine-testable, and we do not currently list them in the report’s manual-review section either. That section covers 29 WCAG 2.1 criteria and stops there. The 2.2 additions are unassessed rather than flagged: treat them as your own manual work, and do not read a clean Veracly report as evidence you have met them.

One jurisdiction, and only one, gets a separate legal-floor number: AODA. On that card the headline score is the full WCAG 2.2 AA superset, so it can be compared like for like with your EAA and ADA cards, and next to it sits a legal-floor score that strips the 2.1- and 2.2-only deductions and leaves WCAG 2.0 AA — Ontario’s actual statutory requirement under IASR §14. That paired display is a direct response to this version mismatch: one number is what most readers expect to see, the other is what an Ontario regulator will measure. No other rule pack emits a second number, so on the EAA, ADA, UK and Australian cards there is one score and it is the 2.2 superset.

Planning recommendation

Target 2.2 AA. In the UK public sector and for Australian Commonwealth entities it is already the requirement rather than the aspiration. Everywhere else the 2.1 AA legal floor is a floor, not a ceiling, and the 2.2 work is small enough that splitting the deployment is rarely worth the engineering coordination. The exception: if your team is already at 2.1 AA and considering whether to budget for 2.2, prioritize the high-leverage 2.2 criteria (focus-not-obscured, target size, accessible authentication) over the others.

See also: WCAG 2.1 AA accessibility audit explained · Does my SMB need to comply with the EAA?