An EAA accessibility audit is rarely an inspector at your door. Under the European Accessibility Act (Directive (EU) 2019/882), each member state designates its own authority to check that services meet the accessibility requirements, follow up complaints, and verify that corrective action was taken (Article 23). What usually arrives first is a letter asking you to show your work, because Article 13(5) obliges a service provider, on request, to "provide it with all information necessary to demonstrate the conformity of the service". So preparing means having three things ready before that letter: technical evidence that your service meets EN 301 549 and WCAG 2.1 Level AA, the Annex V information explaining how the service satisfies Annex I, and a record showing you monitor conformance and fix what you find. The law has applied since 28 June 2025 (Article 31). The file an authority asks for covers the period since then, not the fortnight after the letter lands. Most of this is bookkeeping you can start today.
What does an EAA accessibility audit actually check?
Three layers, and teams usually prepare only the first.
The service is checked against the accessibility requirements in Annex I of the directive. For anything web-facing the working technical bar is EN 301 549, which points to WCAG 2.1 Level AA. Conformity with a harmonised standard gives you a presumption of conformity with the law under Article 15, which is why an audit conversation quickly turns into a conversation about success criteria.
The information you publish is checked next. Annex V requires accessibility information in your general terms and conditions or an equivalent document: a general description of the service in accessible formats, the explanations someone needs to understand how the service operates, and a description of how the relevant Annex I requirements are met (Directive (EU) 2019/882, Annex V).
The process is the layer people forget. Article 13(3) requires procedures "so that the provision of services remains in conformity", and Annex V point 3 asks the provider to demonstrate that its service provision and monitoring do exactly that. One PDF from an agency audit in 2024 does not demonstrate monitoring in 2026.
When Sweden's PTS opened its first supervisory cases against larger retailers in October 2025, the initial reviews looked at the homepage, product pages, and the search function, with apps left out of that first pass (Level Access).
Who carries out the audit, and what sets it off?
There is no single EU accessibility regulator. Article 23 tells member states to establish procedures to check compliance of services, follow up complaints, and verify corrective action, then designate the authorities that do it. The body writing to you depends on where you sell.
Two routes lead to a review. The first is regulatory: the Dutch ACM ran a voluntary self-reporting window that closed on 15 October 2025 and has since sent information requests to e-commerce operators internationally. The second is complaint-driven. Sweden's PTS had received 124 public complaints, 110 about services and 14 about products such as ATMs (Level Access; Eye-Able). A user who cannot finish your checkout with a screen reader can start this without any regulator noticing you first.
Germany shows a third path that is not an audit at all. Within weeks of the BFSG applying, law firms sent private warning letters to online retailers under unfair-competition law rather than through the supervisory authority (Level Access). Same evidence file, different envelope.
What documents does the EAA require you to keep?
Article 13(2) is the core obligation: prepare the information set out in Annex V, explain how the service meets the applicable accessibility requirements, make it available "in written and oral format, including in a manner which is accessible to persons with disabilities", and keep it "for as long as the service is in operation".
| What to hold | Where it comes from | How long |
|---|---|---|
| Annex V accessibility information in your terms | Article 13(2), Annex V | As long as the service operates |
| Records of the procedures keeping the service conformant | Article 13(3), Annex V point 3 | Ongoing |
| Any disproportionate burden assessment | Article 14(2)–(3) | 5 years from last provision of the service |
| Notification to the authority when you find non-compliance | Article 13(4) | On discovery |
The disproportionate burden route has its own paperwork. If you rely on it, you must carry out and document the assessment, keep the result for five years, hand a copy to the authority on request, and renew the assessment at least every five years, when the service is altered, or when an authority asks (Directive (EU) 2019/882, Article 14). An undocumented burden claim is not a defence, it is an admission that you never assessed it.
What technical evidence belongs in the file?
Four artefacts cover most requests.
A clause-by-clause conformance record against EN 301 549 is the backbone. Annex C of the standard gives a table format where each applicable clause is marked met, partially met, or not met, with a note explaining the verdict. Our EN 301 549 checklist walks the same clause list if you are building this the first time.
Dated automated scan exports, each with the list of URLs tested and the ruleset version. Keep the raw export, not a screenshot of a score.
Manual test records, naming who tested what and with which assistive technology. Deque's analysis of more than 2,000 audits put automated detection at about 57% of issues by volume, and counting by success criteria instead brings it closer to 30% (Deque). No scanner decides whether your error message is understandable or whether a custom date picker announces sensibly.
A remediation log connecting findings to fixes to dates. That is the artefact demonstrating the Article 13(3) monitoring, and the one almost nobody has.
Here is the opinion I hold after reading a lot of these files: I would rather defend a service at 80% conformance with a dated, honest record behind it than one that claims full conformance and has nothing to show. The first looks like a provider running a process. The second looks like a marketing page.
How do you decide which pages to test?
Use a published methodology rather than inventing a sample, because "we tested the important pages" is hard to defend. The W3C published WCAG-EM 2.0 as a Group Note on 23 July 2026. It sets out five steps: define the evaluation scope, explore the target digital product, select a representative sample set, evaluate that sample, and report the findings.
Two details matter for an audit file. The structured sample has to cover common views, essential functionality, the different types of content, and the technologies your product relies on. On top of that you add a random sample, and the Note is specific about the size: "The number of samples to randomly select is 10% of the structured sample set." If the random pages surface problem types your structured sample missed, your sample was not representative.
Version 2.0 also widened the scope beyond websites, covering "websites, web apps, e-books, kiosk apps, mobile apps and documents (PDF, Word, EPUB)". A shop's app and its PDF invoices sit inside the same EAA service as its checkout.
Sample the authenticated journey, not the marketing pages. Login, cart, payment, and account settings are where the failures that stop a purchase live, and a homepage-only scan will tell you everything is fine.
What should you fix before the review?
Order the work by what blocks a task, not by issue count. A page with 40 contrast warnings and a working keyboard path is in better shape than a page with 3 issues where one of them is a modal that traps focus.
Start with the barriers that end a journey:
- Controls without an accessible name. A
<button aria-label="">or an icon-only<a>with no text is announced as "button" and nothing else. - Focus that disappears. If
:focus-visibleis suppressed anywhere in checkout, a keyboard user is navigating blind. - Form fields tied to no label, or errors shown only in colour and never associated with the input.
- Dialogs and menus that cannot be closed with Escape or that leave focus behind them.
- Text and interface components below the 4.5:1 and 3:1 contrast ratios of WCAG 1.4.3 and 1.4.11 (W3C).
Then publish or correct the accessibility statement. A statement that names your standard, gives the current conformance position honestly, lists known limitations with target dates, and offers a working feedback contact is doing the Annex V job. One that overclaims while your own scan says otherwise is worse than none, and the FTC's $1 million order against accessiBe over conformance claims is the reminder of why (FTC). Our statement generator drafts one from your scan results that you then review and finish.
What if you cannot fix everything in time?
Say so, in writing, to the right people. Article 13(4) requires a provider who believes a service is not in conformity to immediately inform the competent national authorities, "giving details, in particular, of the non-compliance and of any corrective measures taken". A dated remediation plan with owners is a much better answer to an information request than silence followed by a rushed sprint.
The disproportionate burden exemption exists (Article 14), but it is narrow, it must be assessed against the criteria in Annex VI, and you cannot rely on it for accessibility work funded by third parties. Treat it as a documented, time-boxed position on a specific requirement, never as a general opt-out.
FAQ
Does the EAA require an independent third-party audit?
No. The directive does not mandate an external auditor for services. Article 13 puts the obligation on the provider to prepare the Annex V information and demonstrate conformity on request. An independent audit is one credible way to produce that evidence, but self-assessment against EN 301 549 is what the law asks for.
How long do I have to answer a request from an authority?
The directive does not set one EU-wide deadline. Article 13(5) says you provide the information on request and cooperate on corrective action, while the procedure and the response window come from each member state's national law (Level Access). Check the transposing act in the country whose authority wrote to you.
How often should we re-test?
Often enough to show the monitoring Article 13(3) requires. Continuous or monthly automated scans of the main journeys, plus a manual review whenever you ship a significant change to a purchase or account flow, gives you a defensible record. Any disproportionate burden assessment has its own five-year renewal clock under Article 14(5).
Is an accessibility statement enough to satisfy Annex V?
Usually not on its own. Annex V asks for accessibility information in your general terms and conditions or an equivalent document, and for a demonstration that your service provision and monitoring keep the service conformant. A statement covers the public-facing part; the conformance record and remediation log behind it cover the rest.
Does automated testing prove conformance?
No. Automated checks find roughly 30 to 57% of issues depending on how you count, so they narrow the work rather than finish it. Full conformance needs human review with a keyboard and a screen reader, and any file that claims otherwise will not survive a serious question.
Start the file today
The part of audit preparation that takes months is the history, so the useful move is to start recording now. Run a free scan of your main journeys, keep the export with its date and URL list, then work the WCAG checklist for the criteria a machine cannot decide. Six months of that, plus a statement you can defend, is a stronger answer than any single audit report. More context on scope and obligations sits on our EAA overview.
Written by Pavel Charkasau, founder of WCAG Compliance.
Last updated: 31 August 2026
Sources
- Directive (EU) 2019/882 (European Accessibility Act), EUR-Lex — Articles 13, 14, 15, 23 and 31, plus Annex V and Annex VI. Accessed 31 August 2026.
- WCAG Evaluation Methodology (WCAG-EM) 2.0, W3C Group Note, 23 July 2026 — the five evaluation steps, structured sampling, the 10% random sample, and the digital products covered. Accessed 31 August 2026.
- Web Content Accessibility Guidelines (WCAG) 2.1, W3C — contrast ratios in 1.4.3 and 1.4.11. Accessed 31 August 2026.
- EAA compliance in 2026: how enforcement has evolved, Level Access — Sweden PTS cases and complaint counts, the Dutch ACM self-reporting window and information requests, German warning letters, national response timeframes. Accessed 31 August 2026.
- Sweden audits online shops for digital accessibility, Eye-Able — PTS supervisory investigations and the homepage, product page and search review. Accessed 31 August 2026.
- Automated testing identifies 57% of accessibility issues, Deque — automated coverage figures. Accessed 31 August 2026.
- FTC approves final order requiring accessiBe to pay $1 million, Federal Trade Commission — deceptive conformance claims. Accessed 31 August 2026.