Skip to content
wcagc
←Back to blog

EAA enforcement by country: a 2026 picture

Who enforces the European Accessibility Act in each EU country, and what Sweden, France, Germany and the Netherlands have actually done in 2026.

P

Pavel Charkasau

There is no single EU regulator for the European Accessibility Act. The directive tells all 27 member states to appoint their own authorities, set their own penalties, and run their own checks, so "EAA enforcement by country" is really 27 separate answers (Directive (EU) 2019/882). A year after the June 2025 deadline, a handful of countries have moved and most are still building the machinery. Sweden's telecom regulator has opened the most active supervision, with 28 investigations into online shops (Eye-Able). France's enforcement is running through the courts: in June 2026 a tribunal ordered Carrefour to fix its website and app (Silktide). Germany leans on consumer complaints and private warning letters. The Netherlands ran a self-reporting round and plans audits later in 2026 (Level Access). This post goes country by country: who holds the pen, and what they have actually done. If you sell into several EU markets, the honest summary is that you face several front doors, each with its own procedure.

Who enforces the EAA, and why there's no single answer

The EAA is a directive, not a regulation. That distinction does the heavy lifting here. A regulation applies directly and uniformly; a directive sets the goal and hands each member state the job of writing its own law to meet it. Article 24 of the directive requires every state to designate the authorities responsible for market surveillance of products and for checking service compliance, and Article 30 requires penalties that are "effective, proportionate and dissuasive" without naming a figure (Directive (EU) 2019/882).

So the enforcing body depends on where you're selling. It might be a telecom regulator, a consumer-protection authority, a market-surveillance office built for CE-marked goods, or in some countries a court reached by a disability association. The technical standard behind all of them is the same: EN 301 549, whose current referenced version maps to WCAG 2.1 Level AA for web content. What differs is who checks, how they pick targets, and what happens when they find a gap.

A note on scope before the country list. "Market surveillance" in the strict sense is the products regime (ATMs, ticket machines, e-readers). Most websites and apps fall under the lighter service-compliance track, which usually starts from a complaint rather than a scheduled inspection.

Sweden: the most systematic supervision so far

Sweden's Post and Telecom Authority (PTS) has done the most visible service-side work in the EU. It opened its first supervisory cases in October 2025 and, by the count reported since, has launched 28 investigations, with larger retailers among the targets (Eye-Able).

The method is worth copying because it tells you what a regulator actually looks at. PTS doesn't audit an entire site. It reviews three things per case: the homepage, a product page, and the search function (Level Access). That narrow slice is deliberate. It's fast to run across many sites, and it lands on the parts of a shop a real user has to get through. PTS has also logged 124 public complaints, 110 about services and 14 about products such as ATMs (Level Access). If you want a preview of how you'd fare, run those same three pages yourself first.

France: enforcement is running through the courts

France has the most concrete outcome so far, and it didn't come from an administrative regulator. It came from disability associations going to court. On 7 July 2025, ApiDV and Droit Pluriel sent formal legal notices to Auchan, Carrefour, E.Leclerc, and Picard Surgelés over inaccessible online shopping (Law Office of Lainey Feingold). When answers fell short, they filed for interim relief in November 2025 (Law Office of Lainey Feingold).

The Carrefour case produced the first ruling anywhere against a retailer under a national EAA transposition. On 4 June 2026, the Tribunal judiciaire de Caen ordered Carrefour to make carrefour.fr and its mobile app fully accessible within six months, with an astreinte of €500 per day if it misses the deadline (Silktide). Two details matter more than the number. Carrefour argued it had reached 71% conformity with France's RGAA standard, and the court rejected that as a defence: accessibility is an obligation of result, not of effort. And the astreinte is a coercive penalty, not a fine, so nothing is owed if the work is finished on time (Silktide). The legal hook was Article L.412-13 of the French Consumer Code, the provision that transposes the EAA. France's consumer authority, the DGCCRF, sits behind that same Consumer Code, but so far the pressure has come from litigation, not administrative notices.

Germany: complaints, warning letters, and a joint authority

Germany transposed the EAA as the Barrierefreiheitsstärkungsgesetz (BFSG). For enforcement, the federal states built a shared body, the market-surveillance office for the accessibility of products and services (MLBF), based in Magdeburg (activeMind.legal). Under § 32 BFSG, consumers and disability organisations can ask the MLBF to open an investigation, with a right of appeal if it declines. The BFSG caps fines at €100,000 for serious violations and €10,000 for lesser ones (activeMind.legal).

The German twist is private enforcement. Within weeks of the BFSG taking effect, e-commerce operators started getting warning letters (Abmahnungen) from law firms treating non-compliance as an unfair-competition matter (Level Access). A German auditing body, BIK, has also said outright that sites relying on accessibility overlays don't qualify for its certification (Law Office of Lainey Feingold). So in Germany you can hear from a regulator, a competitor's lawyer, or a certifier, and only one of those waits for a complaint.

The Netherlands: self-reporting first, audits next

The Dutch Authority for Consumers and Markets (ACM) took a softer opening line. It set a self-reporting deadline of 15 October 2025 and sent information requests to operators, including some based outside the EU (Law Office of Lainey Feingold). Many companies filed non-conformance reports, and the ACM has said it will prioritise the non-compliant ones for audits, with formal enforcement expected in the second half of 2026 (Level Access).

An ACM official was blunt that fines are "absolutely not the goal", and that the aim is to push businesses to fix things (Law Office of Lainey Feingold). That reads as a grace period, not a pass. The audits still land, just later, and self-reporting a gap is not the same as closing it.

Ireland, Italy, and the countries earlier in the cycle

Most member states are further back: authority named, complaint channel open, active supervision not yet visible. A few concrete signs:

  • Ireland. ComReg is processing consumer complaints, including one against Three, the country's largest mobile operator, which engaged with the formal complaint (Law Office of Lainey Feingold).
  • Italy, Spain, Finland, Luxembourg. These set up direct EAA non-compliance reporting channels, and Italy published national guidelines (Level Access).
  • Norway. Outside the EU but inside the EEA, its health authority issued a compulsory penalty against a medical app, HelsaMi, with a December correction deadline and daily fines after it (Law Office of Lainey Feingold).

The pattern across the quieter countries is the same: build the authority, gather information, then start supervising. That order is why 2026 looks patchy.

What this means if you sell across the EU

You don't get to pick the easiest regulator. If you ship into five markets, you're exposed to five procedures, and the strictest one sets your real bar. In practice that means treating France's "obligation of result" standard and Sweden's homepage-product-search review as the floor, not the exception.

There's a second exposure that has nothing to do with the code: overstating your compliance. In April 2025 the US Federal Trade Commission finalised a $1 million order against the overlay vendor accessiBe for claiming its product could make any site conform (FTC). A confident claim you can't support is its own liability on either side of the Atlantic. That's why an honest accessibility statement documents effort and known gaps rather than promising a clean bill.

Where a scan fits: it finds the machine-detectable defects fast, which is a real chunk of the work but not all of it. Deque's analysis of more than 2,000 audits found automation identified about 57% of issues by volume, and closer to 30% when you count the share of WCAG success criteria (Deque). A scanner starts your evidence trail. Finishing it needs a person completing checkout with a keyboard, checking focus order, and confirming a screen reader announces form errors.

Frequently asked questions

Is there one EU authority that enforces the EAA?

No. The EAA is a directive, so each of the 27 member states appoints its own authorities and sets its own penalties under Articles 24 and 30. A company selling across the EU can face several different regulators, each with its own procedure and its own maximum fine.

Which country is enforcing the EAA most actively?

Sweden and France are furthest along in different ways. Sweden's PTS has opened 28 supervisory investigations into online shops, reviewing the homepage, a product page, and search on each. France produced the first court ruling against a retailer, ordering Carrefour to fix its site and app within six months.

What happened in the Carrefour case?

On 4 June 2026 a French court ordered Carrefour to make its website and app fully accessible within six months, with a €500-per-day coercive penalty if it misses the deadline. The court rejected Carrefour's argument that 71% conformity was enough, holding that accessibility is an obligation of result.

How does enforcement work in Germany?

Germany's states run a joint market-surveillance office, the MLBF in Magdeburg, and consumers can request an investigation under § 32 BFSG. Fines are capped at €100,000 for serious violations. Separately, law firms send private warning letters treating non-compliance as unfair competition.

Does passing an automated scan mean I'm compliant everywhere?

No. Automated tools catch roughly 30–57% of issues depending on how you count, and full conformance needs manual review. A scan is useful for the machine-detectable defects a regulator would flag first, but it doesn't prove you'd pass a court's or an authority's check.

See what a regulator would see first

Enforcement so far runs on complaints and short, targeted page reviews, so the useful move is to look at what an authority would look at. Run a free scan on your homepage and the flows a complaint would target, then work through the WCAG checklist for what a scanner can't judge. You'll have a real picture to act on, and the evidence to write an honest accessibility statement instead of a guess.

Pavel Charkasau, founder, wcagc.com. Last updated 21 July 2026.

Sources