European Accessibility Act for non-EU companies: who's in scope, what to fix and what B2B SaaS can skip

The short answer

The European Accessibility Act, Directive (EU) 2019/882, has applied since 28 June 2025 through each EU country's national law. It covers a fixed list of consumer products and services, and it reaches companies outside the EU: a covered service is in scope when it is provided or offered to consumers in the Union, wherever the company is based. For most US and Latin American companies, the category that matters is e-commerce services, meaning any website or app where an EU consumer can buy something.

Two groups can largely relax. B2B SaaS sold only to businesses is generally outside the Act, because it protects consumers. And microenterprises that provide services, those with fewer than 10 people and annual turnover or balance sheet total of EUR 2 million or less, are exempt from its accessibility requirements.

If you are in scope, the practical target is WCAG 2.2 Level AA plus the parts of the European standard EN 301 549 that go beyond WCAG, and a description of your service's accessibility in your terms and conditions. Penalties are set by each country: in Germany, offering a non-compliant service can bring a fine of up to EUR 100,000.

We checked this guide against EUR-Lex, ETSI, the European Commission and national official journals on 17 October 2026. It is a planning summary, not legal advice: a lawyer in the countries you sell to confirms what applies to you.

What the EAA is, and when it started

The Act is a directive, adopted on 17 April 2019. Under its Article 31, EU countries had to pass national laws by 28 June 2022 and apply them from 28 June 2025. Because it's a directive, you don't comply with the EU text directly: you comply with the national law of each country where you sell. Three examples:

• Germany: the Barrierefreiheitsstärkungsgesetz (BFSG).
• Spain: Title I of Ley 11/2023.
• Portugal: Decreto-Lei n.º 82/2022.

National laws mostly copy the directive, but not always. Spain's law adds the websites and apps of electricity, water and gas suppliers, travel agencies and tour operators, and social networks to the list of services, and shortens one transition period. Check the law of each market you serve.

Why it reaches companies outside the EU

Article 3 of the directive defines a service provider as "any natural or legal person who provides a service on the Union market or makes offers to provide such a service to consumers in the Union." Nothing in that definition requires an EU office. Article 2(2) applies the Act to covered services "provided to consumers after 28 June 2025."

The e-commerce definition is broad. Article 3(30) defines e-commerce services as services provided at a distance, through websites and mobile apps, by electronic means and at a consumer's individual request, "with a view to concluding a consumer contract." Recital 43 adds that these obligations apply to the online sale of any product or service.

The directive doesn't list the facts that make a non-EU website an offer to EU consumers. In our reading, prices in euros, shipping to EU addresses, EU-language versions and checkouts that accept EU customers are the obvious things a regulator would look at. If none of those apply and you don't sell to EU consumers, the Act is unlikely to be your problem.

What the Act covers

Article 2 lists the products and services. These are the services, the part that matters for most websites and apps:

The products are consumer computers and their operating systems, payment terminals, ATMs, ticketing and check-in machines, interactive information kiosks, smartphones and other consumer terminal equipment for communications and audiovisual media, and e-readers.

Article 2(4) excludes some website and app content: pre-recorded video and audio and office files published before 28 June 2025, online maps if the essential information is provided accessibly, third-party content you don't fund, develop or control, and archives not updated after 28 June 2025.

Does the EAA apply to your SaaS?

The directive defines a consumer, in Article 3(22), as a natural person acting for purposes outside their trade, business, craft or profession. That definition decides most SaaS cases:

Two nuances. First, for a product that isn't itself on the list, the obligation attaches to the e-commerce service: the online journey in which the consumer buys. Annex I adds specific requirements for that journey: accessible identification, security and payment functions, and information about the accessibility of what's sold where the responsible economic operator provides it. That is our reading of Article 2 and recital 43, not a ruling.

Second, being out of scope for consumers doesn't mean out of scope for buyers. Under Article 24, the Act's accessibility requirements count as mandatory requirements in EU public procurement for the products and services it covers, and public buyers may ask you for evidence such as an Accessibility Conformance Report. Our VPAT and ACR guide explains that document.

The microenterprise exemption

Article 3(23) defines a microenterprise as an enterprise that employs fewer than 10 persons and has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million. Both conditions apply: the headcount test and one of the two financial tests. At the European Central Bank's reference rate for 16 October 2026 (USD 1.1253 per euro), EUR 2 million is about USD 2.25 million.

What the exemption covers:

• Services: Article 4(5) exempts microenterprises providing services from the accessibility requirements and from any obligation relating to compliance with them.
• Products: there is no exemption, only lighter paperwork.

Count the whole group. Recital 53 says companies must genuinely meet the definition in Commission Recommendation 2003/361/EC, and Article 6 of that recommendation's annex adds 100% of the data of linked enterprises and a proportional share of partner enterprises. A five-person EU sales subsidiary of a 200-person company is not a microenterprise.

Larger companies have a narrower way out. Article 14 lets an economic operator skip a requirement that would fundamentally alter the service or impose a disproportionate burden, judged against the criteria in Annex VI. The assessment must be documented and kept for five years, renewed for services at least every five years or when the service changes, and reported to the authorities. And a company that receives outside funding to improve accessibility can't claim a disproportionate burden.

Dates and transition periods

The transitions are about contracts and equipment, not websites. In our reading, an online shop that takes an EU consumer's order today is providing the service after 28 June 2025, whenever the site was built.

Which standard to test against: EN 301 549 and WCAG

Under Article 15, products and services that conform to a harmonised standard whose reference is published in the Official Journal of the EU are presumed to meet the Act's requirements. That standard is EN 301 549, and its status changed this autumn:

On 17 October 2026, the Commission's list of harmonised standards showed accessibility references only for public-sector websites and apps, so no standard yet gives a presumption of conformity under the Act. ETSI's foreword sets 31 May 2027 as the latest date for national standards bodies to publish V4.1.1.

What to test against, then:

• WCAG 2.2 Level AA. It's what V4.1.1 follows, and the W3C states in WCAG 2.2 that conforming content also conforms to 2.1, which is what V3.2.1 follows. Our article on what changed in WCAG 2.2 lists the nine new criteria.
• The EN 301 549 clauses beyond WCAG that fit your service: clause 7 for video players (captions and audio description), clause 12 for documentation and support services, clause 5.2 on activating accessibility features, and in V4.1.1 a new clause 9.7 on user preferences for web pages.

Our free WCAG 2.2 checklist covers the 55 Level A and AA criteria, the bulk of the work for a website or web app.

What you must publish

The directive doesn't use the term "accessibility statement". What Article 13(2) and Annex V require from a service provider is information about how the service meets the accessibility requirements:

• included in your general terms and conditions, or an equivalent document;
• with a general description of the service in accessible formats, the explanations needed to understand how it works, and a description of how it meets the Annex I requirements;
• made public in written and oral form, accessible to people with disabilities, and kept for as long as the service runs.

Annex V also asks for information showing that your service delivery process and its monitoring keep the service compliant. Many companies publish this as an accessibility page linked from their terms; that works if it contains these elements.

Article 13 adds two duties people miss. You need procedures to keep the service compliant as it changes. And if the service doesn't comply, you must take corrective measures and inform the competent authorities of the countries where you provide it.

Enforcement and penalties

Article 30 leaves penalties to each country, requiring them to be "effective, proportionate and dissuasive." Article 29 also lets consumers and organizations with a legitimate interest go to court or to administrative bodies. Three national laws and the first court cases show what that means in practice:

Private enforcement has started. According to a press release from Intérêt à Agir, one of the associations involved, the court in Caen ordered Carrefour France on 4 June 2026 to make its online grocery website and app fully accessible within six months, under a daily penalty, after Carrefour argued it already met 71% of the criteria. A month earlier, on 5 May 2026, the court in Lille had dismissed a similar claim against Auchan's e-commerce arm, which the associations have appealed. Courts are still settling how far the obligations reach; they are not waiting for regulators.

What to do: a checklist

1. Map your EU exposure. List every website and app where EU consumers can buy, sign up or pay, by country.
2. Classify each one against the service list and the SaaS table above. Note the journeys that are business-only.
3. Run the microenterprise test with group data, not just the entity that sells into the EU.
4. Audit the in-scope journeys against WCAG 2.2 AA and the EN 301 549 clauses that apply: product and pricing pages, search, cart, sign-up, sign-in, checkout and payment, order confirmations, account settings and support channels.
5. Fix in code, content and the design system, and check third-party checkout, payment and identity widgets. Annex I covers identification, security and payment; if a vendor's component fails, it's still your service.
6. Publish the Annex V information in your terms or an equivalent page linked from them, in the languages you sell in.
7. Set up the process: accessibility checks in every release, a channel to report barriers, corrective action and, where needed, notice to authorities.
8. Document any disproportionate-burden claim against Annex VI, keep it five years and renew it.
9. Keep evidence: dated audit reports, fix logs and retest results.

What to do next

Start with our free WCAG 2.2 checklist on your checkout and sign-up flows: it shows where you stand on each Level A and AA criterion. To budget a professional audit, our guide to website accessibility audit costs compares published prices; if you also sell in the US, read our guide to ADA website compliance.

If you want Dardo to test and fix your store or app, our web accessibility audit covers WCAG 2.2 AA and starts at USD 690, and our e-commerce development team builds checkouts that meet it from the start.