EAA market surveillance is the machinery each EU country uses to check whether products and services meet the European Accessibility Act, follow up complaints, and order fixes when something falls short. There is no single EU regulator and no central fine schedule. Instead the directive tells all 27 member states to appoint their own authorities, and it splits the job in two: physical products (ATMs, ticket machines, e-readers) go through formal market surveillance, the same system that polices CE-marked goods, while services (online shops, banking apps, e-books) get a lighter compliance check (Covington / Global Policy Watch). Both routes start the same way in practice: a complaint or an inspection, then a request to see your documentation, then a deadline to fix what's found. Penalties come last and are set nationally. This post explains who does the checking, how a case actually moves, what an authority can compel, and what regulators in Germany, Sweden, and the Netherlands are doing right now.
Who actually enforces the EAA?
Not the European Commission, and not one agency. Each member state designates its own competent authorities and sets its own penalties (Directive (EU) 2019/882). Many countries name more than one, so a single company selling across the EU can face several authorities with different procedures and different maximum fines (Covington / Global Policy Watch).
Two kinds of body do the work. For products, it's a market surveillance authority, the type of regulator that already inspects toys and electrical goods for CE conformity. For services, it's whichever authority each country picks to check service compliance, handle complaints, and confirm that a provider has corrected the problem. In Germany the Länder built a shared body for both, the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF), based in Magdeburg (activeMind.legal). In Sweden the telecom regulator PTS runs the service side (Eye-Able). Same directive, 27 different front doors.
How is market surveillance different for products and services?
The distinction matters because "market surveillance" is really the products regime, and most wcagc.com readers are on the services side. Getting the two mixed up is where a lot of vendor copy goes wrong.
Products carry heavier upfront obligations. A manufacturer draws up technical documentation and an EU declaration of conformity, and a market surveillance authority can demand that paperwork, test the product, and pull it from the market if it fails (Covington / Global Policy Watch). This is the classic CE machinery, applied to accessibility.
Services are lighter on paper but not off the hook. There's no product to seize and no CE mark. Instead the directive requires member states to appoint authorities that check whether services comply, follow up complaints or reports of non-compliance, and verify that corrective action was actually taken (Covington / Global Policy Watch). The standard behind both is the same: EN 301 549, whose current referenced version maps to WCAG 2.1 Level AA for web content. Meeting the relevant clauses gives you a presumption of conformity.
What happens when a complaint comes in?
Most service cases so far have started with a complaint, and the law gives that complaint teeth. A consumer or a group representing them can report a non-compliant service to the competent authority, and the authority is obliged to follow it up (Directive (EU) 2019/882). Germany makes the route explicit: under § 32 BFSG, consumers and disability organisations can ask the MLBF to open a market surveillance investigation, with appeal rights if the authority declines (activeMind.legal).
A typical case moves in stages. The authority selects a target (from a complaint or its own sweep), reviews specific pages, writes to the operator describing what fails, and sets a deadline to remediate. Sweden's PTS shows the pattern in numbers: it opened its first supervisory cases in October 2025 and reviewed a narrow slice of each site (the homepage, a product page, and the search function) rather than auditing everything at once. By the time it reported, it had also received 124 public complaints, 110 about services and 14 about products (Level Access, Eye-Able).
If I had to name where the first real trouble comes from, it isn't a fine. It's a single complaint from a real user, on a checkout or a login page, that an authority now has a legal duty to chase. That's a much lower bar to clear than a full national audit.
What can a surveillance authority actually do to you?
For services the sequence is corrective, not punitive-first. The authority tells you what's wrong and gives you a window to fix it. Penalties enter only if you ignore the deadline or the problem is serious, and even then the amounts are national, not set by the EU. The directive only requires penalties to be "effective, proportionate and dissuasive" (Directive (EU) 2019/882).
Those national ceilings vary widely. Germany's BFSG caps fines at €100,000 for serious violations and €10,000 for lesser ones (activeMind.legal). France runs higher, and several countries add separate sanctions for failing to publish an accessibility statement at all. The honest read a year in: the sharpest tool used so far has been court-ordered remediation deadlines, not headline fines. French courts ordered Carrefour to make its site and app accessible within six months, with a daily penalty for delay after that (Deque).
There's a second exposure that has nothing to do with the accessibility work itself: overstating your compliance. In April 2025 the US Federal Trade Commission finalised a $1 million order against the overlay vendor accessiBe for claiming its product could make any site conformant (FTC). A confident claim you can't back up is its own liability, on either side of the Atlantic.
What are national authorities doing in 2026?
Enough to make this concrete rather than theoretical, though it's uneven by country.
Germany's Länder set up the MLBF as a joint authority in Magdeburg, handling both products and services and taking complaints under § 32 BFSG (activeMind.legal). It runs a risk-based model: rather than auditing everyone at once, it prioritises building a picture of the market and starting with the operators that self-reported partial gaps in 2025.
Sweden's PTS is the clearest example of active service supervision, with 28 investigations opened, major retailers among them, and a three-element review of each site (Eye-Able). The Netherlands ran a self-reporting window that closed in October 2025, sent information requests to operators (including some headquartered outside the EU), and expects formal enforcement in the second half of 2026 (Level Access). Other member states are earlier in the same cycle: set up the authority, gather information, then start supervising.
What should you do before an authority looks at your site?
Have an answer ready for the question a regulator asks first: what does your key user journey look like, and can you show you're managing the known gaps? That's a position you can build in a week, not a scramble you start when the letter arrives.
The practical order is the same one PTS follows. Look at your homepage, a product or service page, and the flows a complaint would target: search, sign-up, checkout. Automated scanning catches the machine-detectable defects fast, but only part of the total. Deque's analysis of more than 2,000 audits found automation identified about 57% of issues by volume, and estimates counting the share of WCAG success criteria put it closer to 30% (Deque). A scanner starts your evidence trail; it doesn't finish it. The rest needs a human: completing checkout with a keyboard, checking focus order, confirming that form errors get announced to a screen reader. Our WCAG checklist covers the manual part a scan can't judge, and publishing an honest accessibility statement records where you are and what you're doing about it. Documented, ongoing effort is the defensible position. A tidy claim you can't support is the one that gets tested.
Frequently asked questions
Who enforces EAA market surveillance?
Each EU member state designates its own competent authorities, and many appoint more than one. Products go through a market surveillance authority (the CE-conformity system); services are checked by whichever authority the country names to handle service compliance and complaints. There is no single EU-wide regulator.
Is market surveillance the same for products and services?
No. Products carry formal obligations — technical documentation, an EU declaration of conformity, and an authority that can test the product and remove it from the market. Services face a lighter compliance check: an authority verifies conformity, follows up complaints, and confirms corrective action was taken.
How does an EAA complaint work?
A consumer or a representative group reports a non-compliant service to the competent authority, which is obliged to follow it up. In Germany this runs through § 32 BFSG. The authority typically reviews specific pages, tells the operator what fails, and sets a deadline to fix it.
What are the penalties under EAA market surveillance?
Penalties are set nationally and must be effective, proportionate, and dissuasive. Germany's BFSG caps fines at €100,000 for serious violations; other countries set different ceilings. In practice the main enforcement so far has been court-ordered remediation deadlines, not large fines.
Does a scanner prove I'll pass market surveillance?
No. Automated tools catch roughly 30–57% of issues depending on how you count; the rest needs manual review. A scan is the start of your evidence, useful for the machine-detectable defects an authority would flag, but full conformance needs a human checking the flows a scanner can't judge.
See where your site actually stands
Regulators are working from complaints and short, targeted page reviews, so it helps to know what they'd see first. Run a free scan to surface the machine-detectable issues on your homepage and key journeys, then work through the manual checklist for what a scanner can't judge. You'll have a real picture to act on, and the evidence to write an honest accessibility statement instead of a guess.
Pavel Charkasau, founder, wcagc.com. Last updated 20 July 2026.
Sources
- Directive (EU) 2019/882 (European Accessibility Act), EUR-Lex — market surveillance of products, compliance of services, complaints follow-up, and "effective, proportionate and dissuasive" penalties set by member states. Accessed 20 July 2026.
- European Accessibility Act: June 2025 deadline has arrived, Covington / Global Policy Watch — no single EU regulator, multiple authorities per state, and the split between product market surveillance and service compliance checks. Accessed 20 July 2026.
- The German Accessibility Improvement Act (BFSG), activeMind.legal — the MLBF joint Länder authority in Magdeburg, complaints under § 32 BFSG, and the €100,000 / €10,000 penalty ceilings. Accessed 20 July 2026.
- EAA compliance in 2026: how enforcement has evolved, Level Access — Sweden PTS cases, the Netherlands ACM self-reporting window and information requests, and expected 2026 enforcement. Accessed 20 July 2026.
- Sweden audits online shops for digital accessibility, Eye-Able — PTS supervisory investigations, the homepage/product-page/search review, and 124 public complaints. Accessed 20 July 2026.
- France's major court decision under the EAA, Deque — the Carrefour ruling: six-month remediation deadline with a daily penalty for delay. Accessed 20 July 2026.
- Automated testing identifies 57% of accessibility issues, Deque — automated coverage figures. Accessed 20 July 2026.
- FTC approves final order requiring accessiBe to pay $1 million, Federal Trade Commission — deceptive conformance claims. Accessed 20 July 2026.