Skip to main content
Promotional banner ad for the Penetration Testing Report Kit
EAA Compliance Checklist: Private Sector EditionWCAG Principles and Conformance
5 min readFor Risk Managers

EAA Compliance Checklist: Private Sector Edition

The European Accessibility Act (EAA) became enforceable in June 2025, changing how private companies must handle accessibility across the EU. Unlike the Web Accessibility Directive, which focuses on the public sector, the EAA extends compliance obligations to commercial operators offering consumer products and services in EU markets. This checklist translates those obligations into actionable compliance steps.

What This Checklist Covers

This checklist is for private companies offering digital products and services to EU consumers. It focuses on e-commerce, banking, electronic communications, and other digital customer touchpoints covered by the Act. If your organization serves EU consumers through websites, mobile apps, or digital interfaces, these requirements apply regardless of your location.

Prerequisites

Before starting the checklist, confirm:

  • Your products or services fall within EAA scope. The Act covers consumer hardware and software with interactive computing capability, banking and financial services, e-commerce platforms, electronic communications services, audiovisual media services, transport-related services, and self-service terminals.
  • You don't qualify for the microenterprise exemption. Organizations with fewer than 10 employees and annual turnover below €2 million may be exempt from most obligations, but this doesn't override other applicable EU or national laws.
  • You understand your national transposition. Each Member State enforces the EAA through its own legal framework. Germany uses the Barrierefreiheitsstärkungsgesetz (BFSG), Italy enforces through Decreto Legislativo n.82/2022, and Spain through Ley 11/2023. Know which national authority oversees your compliance.

Compliance Checklist

1. Verify EN 301 549 Conformance

Action: Conduct conformance testing against EN 301 549, the harmonized standard incorporating WCAG 2.1 Level AA.

What good looks like: You have documented test results showing your digital products and services meet EN 301 549 requirements across all functional accessibility principles. Testing covers websites, mobile applications, software interfaces, and any customer-facing digital touchpoints. You can produce this documentation within 48 hours if requested by a market surveillance authority.

2. Implement Perceivability Requirements

Action: Ensure all content and interfaces can be perceived by users with sensory disabilities.

What good looks like: Images include accurate alternative text. Videos include synchronized captions and audio descriptions. Color isn't the sole means of conveying information. Text contrast meets minimum ratios. Forms and interactive elements have programmatically determinable labels. You've tested with actual screen readers, not just automated tools.

3. Ensure Operability Without Pointer Input

Action: Make all functionality available through keyboard navigation and support non-pointer interaction methods.

What good looks like: Users can complete every customer journey using only a keyboard. Focus indicators are visible and logical. There are no keyboard traps. Time limits can be extended or disabled. Content doesn't flash in ways that could trigger seizures. Your checkout process, account management, and support channels all work without a mouse.

4. Establish Understandability Standards

Action: Design interfaces with clear language, predictable behavior, and consistent navigation patterns.

What good looks like: Error messages explain what went wrong and how to fix it. Forms include clear instructions before users need them. Navigation patterns remain consistent across your digital properties. Page titles are descriptive. Language is identified programmatically. Input assistance prevents errors rather than just flagging them after submission.

5. Build for Robustness

Action: Ensure compatibility with current and future assistive technologies through valid markup and proper ARIA implementation.

What good looks like: Your HTML validates against specifications. Custom components use appropriate ARIA roles, states, and properties. Name, role, and value are programmatically determinable for all UI components. Status messages use aria-live regions. Your code doesn't break when assistive technology updates.

6. Publish an Accessibility Statement

Action: Create and maintain a public accessibility statement explaining your conformance status, known issues, and feedback mechanisms.

What good looks like: Your statement identifies which version of EN 301 549 you conform to. It lists known accessibility barriers with workarounds where possible. It provides a clear process for users to report accessibility issues and request accommodations. The statement includes a contact method that's itself accessible. You update it when your conformance status changes.

7. Document Technical Conformance

Action: Maintain internal documentation demonstrating how your products and services meet EAA requirements.

What good looks like: You have test reports, remediation logs, and design documentation showing accessibility consideration Assistive Technology each development stage. Your documentation maps specific EN 301 549 requirements to implementation decisions. You can demonstrate conformance to a market surveillance authority without scrambling to gather evidence. This documentation is version-controlled and updated with each release.

8. Establish Accessible Support Channels

Action: Ensure customer support services, including helpdesks and chatbots, are accessible to users with disabilities.

What good looks like: Your support chat widget works with screen readers. Phone support includes text-based alternatives. Self-service knowledge bases meet the same accessibility standards as your main products. Support staff are trained to assist customers using assistive technologies. You've tested your support channels with users who have disabilities.

9. Assess Disproportionate Burden Claims

Action: If claiming exemptions based on disproportionate burden, document your assessment and maintain supporting evidence.

What good looks like: You have written documentation explaining why specific requirements would impose disproportionate burden, including financial analysis and consideration of your organization's size and resources. You've identified alternative measures to improve accessibility where full compliance isn't feasible. This documentation is reviewed annually and updated when circumstances change. You understand that burden claims may be challenged by enforcement authorities.

10. Monitor Country-Specific Requirements

Action: Track enforcement procedures and penalties in each Member State where you operate.

What good looks like: You know which national authority oversees EAA enforcement in your markets. You're aware of country-specific penalties (Germany allows fines up to €100,000 for non-compliant products, Italy may fine up to 5% of annual turnover under existing laws). You monitor regulatory guidance from each relevant authority. Your compliance program adapts to differences in national implementation.

Common Mistakes

Treating accessibility as a launch checklist item. Accessibility must be maintained across the full customer journey and throughout product lifecycles. A site that tested compliant Assistive Technology launch can drift into non-conformance with each update.

Relying solely on automated testing. Automated tools catch roughly 30% of accessibility issues. Manual testing with assistive technologies is required for meaningful conformance.

Assuming WCAG 2.1 Level AA equals full compliance. While EN 301 549 incorporates WCAG 2.1 Level AA, it extends requirements beyond web content to software, mobile applications, and hardware interfaces. Your conformance testing must cover the full scope of EN 301 549.

Publishing vague accessibility statements. Statements like "we're committed to accessibility" don't meet EAA requirements. Your statement must identify specific conformance status and known barriers.

Ignoring non-digital touchpoints. If your service includes self-service terminals, phone systems, or physical interfaces, those fall under EAA scope and must meet accessibility requirements.

Next Steps

Start with conformance testing against EN 301 549 if you haven't already. This establishes your baseline and identifies gaps requiring remediation. Prioritize issues affecting core customer journeys: account creation, purchasing, payment, and support access.

Draft your accessibility statement while remediation is underway. Don't wait for perfect conformance; transparency about known issues and remediation timelines demonstrates good faith compliance efforts.

Establish monitoring processes for ongoing conformance. Enforcement intensified across EU countries during 2026 as market surveillance authorities expanded auditing capacity. Your conformance status today matters less than your ability to maintain and demonstrate it continuously.

Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide

You Might Also Like