Is your website breaking EU accessibility law? What the EAA means for small businesses

Most small business owners we speak to have never heard of the EAA. That is understandable — it was written for regulators, and the coverage aimed at businesses has mostly been enterprise consultancies selling remediation packages. But the deadline has already passed, and the scope is wider than people assume.

This is the plain-English version: who it covers, what it actually asks for, and the five things worth fixing first if you sell anything online to a customer in Europe.

Does it apply to me?

Three questions decide it.

1. Do you sell to consumers in an EU member state?

Not "are you based in the EU" — do you sell there. A US shop that ships to France is covered. A UK clinic taking bookings from customers in Ireland is covered. Enforcement began across all 27 member states, and the directive reaches manufacturers, service providers, importers and distributors, which means responsibility can attach at more than one point in a chain.

2. Is what you sell in scope?

The clearest category for small businesses is e-commerce. If people can buy something on your site, you are in scope. Also covered: banking and financial services, telecoms, passenger transport ticketing, audiovisual media services, and e-books. Professional services with an online transactional element sit in a greyer area, and the safe assumption is that if a consumer can complete a purchase or booking, you should treat yourself as covered.

3. Are you big enough to be caught?

Microenterprises get a partial exemption, but the bar is low: fewer than 10 employees and annual turnover under €2 million. Cross either threshold and the exemption falls away. A ten-person agency, a busy restaurant group, a growing online shop — all above the line.

What does it actually require?

The EAA itself does not list technical rules. It points at a harmonised standard, EN 301 549, which in practice means the Web Content Accessibility Guidelines at Level AA. WCAG 2.1 AA is the baseline most guidance references, with 2.2 AA the direction of travel.

That sounds abstract. In practice it comes down to a handful of things that either work or do not.

Everything must work with a keyboard

Not everyone uses a mouse. Tab through your own site right now, without touching the trackpad. Can you reach the menu? Open it? Complete the contact form? Get through checkout? If focus disappears somewhere — a common symptom of a custom dropdown or a modal — that is a barrier, and on an e-commerce site it is the kind that blocks a purchase entirely.

Text must be readable

Colour contrast between text and its background needs to reach 4.5:1 for normal text. Pale grey on white fails this constantly, and it is the single most common issue we find. It is also among the easiest to fix — it is a colour value in a stylesheet.

Images need alternative text

Every image that carries meaning needs a description. Decorative images should be marked as decorative so screen readers skip them. Product photos on a shop absolutely need real descriptions, not "IMG_4417".

Forms need labels

A placeholder inside a box is not a label. It vanishes as soon as someone types, and screen readers handle it inconsistently. Every field needs a proper label, and error messages need to say what went wrong in words.

Video needs captions

If you publish video, it needs captions. If you publish audio, it needs a transcript.

You need an accessibility statement

Missing or incomplete accessibility statements are among the issues regulators have flagged. It is a page describing your site's accessibility position, known limitations, and how someone can report a problem. It takes an afternoon and its absence is conspicuous.

What happens if you ignore it?

Each member state enforces through its own national law — Germany's BFSG, for example. Penalties range from written warnings to substantial fines depending on the country. Disability advocacy groups have already brought legal action against major retailers, and market surveillance has started in several countries.

For a small business, the realistic risk is not a dawn raid. It is a complaint, followed by a deadline to fix things, followed by escalation if you do not. Which is manageable — if you have started.

The "disproportionate burden" exemption

Businesses can claim exemption from specific requirements where compliance would impose a disproportionate burden. This is not a get-out. It has to be assessed, documented and justified, and "we did not want to spend the money" is not an assessment. Good faith under the EAA means demonstrable, documented progress — so a dated plan showing what you are fixing and when is worth considerably more than silence.

The five things to fix first

If you do nothing else, do these. They cover the majority of what an automated audit will flag and most of what a real user will hit.

1. Run your site through a free checker. Lighthouse is built into Chrome — open DevTools, run the Accessibility audit. It catches contrast, missing labels and missing alt text in about thirty seconds.
2. Fix colour contrast. Usually a handful of values in one stylesheet.
3. Tab through your key journeys. Homepage to product to checkout, or homepage to contact form to submit. Fix wherever focus gets lost.
4. Add alt text to every meaningful image. Product photos first, because those are the ones blocking a purchase.
5. Publish an accessibility statement. Say where you are, what you know is not yet fixed, and how to contact you about it.

The part nobody mentions

Accessibility work overlaps heavily with things you would want anyway. Proper heading structure helps screen readers and helps search engines. Real text instead of text-in-images is readable by assistive technology and indexable by Google. Labelled form fields reduce abandonment for everybody, not just people using a screen reader.

We build every site to WCAG AA as standard rather than as an upsell, because retrofitting it later costs several times more than doing it during the build. If you are commissioning a new site, put "WCAG 2.2 AA" in the scope document. If a developer is unsure what that means, that tells you something useful before you have paid them anything.

Second deadline: June 2030

The 2025 deadline covers new products and services. A second deadline in June 2028 to 2030, depending on category, extends to existing content and legacy service infrastructure. Treating 2025 as the finish line rather than the starting line is the mistake to avoid — the direction of travel is one way.