The EAA Has Applied for Five Months. Here Is What Enforcement Looks Like So Far.

The European Accessibility Act has applied to e-commerce services since June 28, 2025, and enforcement is now producing real court orders, not warnings. If you sell to EU consumers, the deadline is behind you, and the grace period for existing services runs to June 28, 2030 only for services already in use.

What applied, and when

The European Accessibility Act, Directive 2019/882, has applied since June 28, 2025. It covers e-commerce services explicitly, which the directive defines as services provided at a distance, through websites and apps, at the individual request of a consumer, to conclude a contract. That is a webshop, a SaaS checkout, a booking flow. It applies whether or not the business is based in the EU: if you offer to consumers in member states, it reaches you, in the same way GDPR does. The technical benchmark is EN 301 549, which incorporates WCAG 2.1 Level AA for web content, and a revision aligned with WCAG 2.2 AA was published in September 2026.

The timeline matters because the grace period is narrower than most teams assume. Services already in lawful use before June 28, 2025 may continue until June 28, 2030, but anything placed on the market after that date had to comply from day one. A new store, a new checkout flow, or a major rebuild does not get the grace period. If you launched or rebuilt after June 2025, the obligation is already fully in force.

Who is actually in scope

Every business selling online to EU consumers, with one exemption that is smaller than it sounds. Microenterprises, fewer than 10 employees and under 2 million euros in turnover or balance sheet, are exempt from the service requirements. That is an and, not an or: a business with 12 employees is in scope even with low turnover, and a business with 3 million euros in turnover is in scope even with five employees. There is no small-business exemption for e-commerce as a category, unlike for other services, which is the detail most summaries get wrong.

The scope covers the whole purchase journey: browsing, search and filtering, cart, checkout, payment, order confirmation, and customer support. A storefront that is accessible on the homepage and broken at checkout is not compliant. The obligation also includes an accessibility statement, published and kept current, describing the service accessibility and how to report problems. France fines the missing statement separately, at 25,000 euros a year, which is a penalty for a document, not for a barrier.

The enforcement record so far

Enforcement is national, so it varies by member state, but the direction is consistent and the early cases target large operators. In France, the DGCCRF investigated more than 20 large online retailers in early 2026 and planned corrective or punitive follow-up for half of them. In June 2026 a French court ordered Carrefour France to make its website and app fully accessible within six months under daily penalty payments, after the company stated it met 71 percent of the criteria. Germany set fines up to 100,000 euros per violation under its transposing law, and its cease-and-desist ecosystem activated immediately after the deadline.

The pattern to notice is that enforcement starts with the biggest targets and the most visible failures, then spreads. Sweden and Denmark began active market surveillance of digital products in October 2025. The cases so far are about large retailers, but the law does not limit itself to them, and the market surveillance authorities can order corrective action and ultimately removal of the service from the market. A storefront that waits for a letter addressed to it specifically is waiting for the wrong signal.

The three things to fix first

First, the checkout: keyboard access, form labels, error identification, and focus management through payment. That is where the purchase happens and where the failures cost both sales and compliance. Second, the accessibility statement: publish it, keep it honest about what is and is not accessible, and include a way to report problems. A statement that claims full compliance the site does not have is worse than no statement, because it is a false claim in writing. Third, the images and documents: alt text on product images, captions on video, accessible PDFs for anything a customer has to read to complete a purchase. Those three cover the failures regulators find first, and they are also the failures customers hit first.

Frequently asked questions

Does the EAA apply to a US store with EU customers?

Yes. The directive covers services offered to consumers in EU member states, regardless of where the business is based. If EU customers can buy from your store, it is in scope, in the same way GDPR applies to non-EU businesses.

What is the microenterprise exemption, exactly?

Fewer than 10 employees and annual turnover or balance sheet total of no more than 2 million euros, both conditions together. E-commerce services do not get a broader small-business exemption. A business with 12 employees or 3 million euros in turnover is in scope.

What standard do I actually have to meet?

The directive sets functional requirements: perceivable, operable, understandable, robust. The harmonised standard that makes those testable is EN 301 549, which incorporates WCAG 2.1 Level AA for web content, with a WCAG 2.2-aligned revision published in September 2026.

Is there really a grace period until 2030?

Only for services already in lawful use before June 28, 2025, which may continue until June 28, 2030. New services, new stores, and major rebuilds after that date had to comply immediately. Do not plan around the grace period unless your service genuinely predates the deadline unchanged.