AODA Website Requirements: What Ontario Businesses Must Do in 2026

Last updated: November 8, 2026. This article is general information, not legal advice — confirm how the AODA applies to your business with a licensed Ontario lawyer.

AODA website requirements come down to one rule: since January 1, 2021, designated public-sector organizations and businesses or nonprofits with 50+ Ontario employees must make public websites conform to WCAG 2.0 Level AA, excluding only live captioning and pre-recorded audio description. Ontario's next accessibility compliance report is due December 31, 2026 — weeks after this guide publishes.

Key numbers: Since January 1, 2021, Ontario's Integrated Accessibility Standards Regulation has required designated public-sector organizations and businesses or nonprofits with 50 or more Ontario employees to conform public websites to WCAG 2.0 Level AA (ontario.ca). Organizations with 20 or more Ontario employees must file their next accessibility compliance report by December 31, 2026, on the Act's three-year filing cycle (ontario.ca). Administrative penalties under the AODA can reach up to $100,000 per day for corporations and up to $50,000 per day for individuals, unincorporated organizations, directors, and officers — stated maximums, not typical amounts actually imposed. As of 2026, TestParty has remediated 35 million+ accessibility issues across 100+ brands, with compliance programs spanning ADA, WCAG 2.2 AA, EN 301 549, EAA, CIPA, and GDPR.

What does the AODA require of websites in 2026?

The AODA's Integrated Accessibility Standards Regulation (O. Reg. 191/11) requires designated public-sector organizations and businesses or nonprofits with 50 or more Ontario employees to make public websites and web content posted after January 1, 2012 conform to WCAG 2.0 Level AA, with two named exclusions.

The obligation phased in over a decade: Level A conformance was due by January 1, 2014, and the full Level AA bar took effect January 1, 2021 — the date most guides now cite as "when AODA website rules kicked in." Two success criteria are excluded outright: 1.2.4 (live captions for synchronized media) and 1.2.5 (audio description for pre-recorded video), reflecting the technical difficulty of real-time captioning when the regulation was drafted. The regulation still names WCAG 2.0 as its reference version as of this writing — it has not been amended to point to WCAG 2.1 or 2.2, unlike the EU's parallel EAA framework, which is drafting a move to 2.2 AA. The 2012 cutoff technically limits scope to newer content, but in practice, older pages get tested the same way everything else does the moment a visitor or an auditor lands on them.

Does it apply to your business?

The website standard applies once an organization counts 50 or more employees working in Ontario specifically — full-time, part-time, and contract staff all count, but employees outside the province do not, regardless of total company headcount.

That distinction trips up more businesses than any other part of the rule. In TestParty's compliance work with cross-border retailers, the most common misread is assuming "50 employees" means the whole company; Ontario counts only staff working in the province, so a 200-person US retailer with a 12-person Ontario fulfillment team sits under the threshold, while a 60-person Toronto-based brand sits well over it. A seller with no Ontario operations at all falls outside this employer-based duty even if Ontario shoppers drive real traffic — a real difference from the EAA and ADA, which key off where the customer sits, not the staff.

Falling under 50 doesn't mean no obligations. Every organization, regardless of size, still owes accessible customer service, Human Rights Code training, and accessible recruitment practices. Cross 20 employees and a compliance-reporting duty attaches. Only at 50 or more do the heavier duties layer on: a published multi-year accessibility plan, written training records, individual accommodation processes — and the website standard itself.

How is AODA different from WCAG 2.2 or the ADA?

AODA is one entry in a much larger map of global accessibility regulations, and what actually varies across them is enforcement model and named standard, not the underlying engineering: AODA names WCAG 2.0 AA, a standard published in 2008, while WCAG 2.2 AA is the newer, broader bar most current programs build to instead.

WCAG 2.2 AA — 55 success criteria across Level A and AA — adds requirements 2.0 never addressed, including larger touch targets that matter on mobile checkout flows. Because 2.2 is fully backward-compatible with 2.0, meeting it satisfies the AODA automatically. The table below lines up the three regimes a Shopify brand selling into Ontario, the US, and the EU is likeliest to face at once — see our full WCAG 2.2 AA breakdown for what each criterion requires.

A store selling on both sides of the Atlantic doesn't need three remediation projects. Building once to WCAG 2.2 AA covers the technical bar every row references; only the paperwork — an AODA plan, an EAA statement — stays regime-specific.

What are the reporting obligations?

Every organization with 20 or more Ontario employees must file an accessibility compliance report every three years; the next deadline for businesses and nonprofits is December 31, 2026, filed online through Ontario's Accessibility Compliance Reporting Portal.

The prior filing window closed December 31, 2023; designated public-sector organizations had their own December 31, 2025 deadline. Filing itself is a self-certification, not a document upload: an organization creates an account at the province's reporting portal, then submits its legal name, nine-digit business number, employee count, and the name and contact details of a senior officer certifying that current requirements have been met. Ontario states plainly that not filing "could result in enforcement measures which can include financial penalties" independent of any penalty tied to the underlying accessibility work itself — which makes the certification only as good as the paper trail behind it. Our guide to accessibility compliance documentation covers the records worth having on file before a senior officer signs anything.

What are the penalties — and what does enforcement actually look like?

AODA administrative penalties can reach up to $100,000 per day for corporations and up to $50,000 per day for individuals, unincorporated organizations, directors, and officers — statutory ceilings, not the amounts most organizations end up paying.

Enforcement runs a ladder rather than jumping to the maximum: self-certified reports first, then audits from the Ministry for Seniors and Accessibility's Accessibility Directorate, then a compliance order with a deadline, and only then escalating penalties if an organization stays unresponsive. Reported penalties historically cluster far below the ceiling — a few hundred to a few thousand dollars for a first violation, not a headline figure. Director and officer exposure is worth flagging to leadership specifically: it's personal liability layered on the corporate penalty, a feature the ADA's private-lawsuit model doesn't have. In the history of the company, fewer than 1% of TestParty customers have been named in an accessibility lawsuit while on the platform — a documented remediation record is what regulators weigh most once an inquiry starts.

How do you get compliant?

Getting compliant is a four-step build: audit the site against WCAG 2.0 AA (or 2.2 AA, which covers both), remediate in source code rather than with a runtime overlay, document the required policies, and monitor continuously so the next theme or app update doesn't quietly reopen what you fixed.

Audit. Automated scanning catches roughly 60–70% of issues in TestParty's detection data; manual keyboard and screen-reader testing finds the rest. Run a baseline against our WCAG 2.2 AA checklist — it's a superset of what AODA names. Remediate. Fix theme, app, and checkout markup directly; an overlay running after page load doesn't change what a screen reader parses, which is what an auditor tests against. Our remediation playbook covers that decision in full, and TestParty's own initial cycle typically completes within 14 days. Document. Organizations at 50+ employees need a published multi-year plan and written training records on file, not just a working site. Monitor. Conformance degrades with every deploy; daily automated scans plus monthly manual audits keep a site from drifting out of compliance between report cycles. The strategy tying all four together: build to WCAG 2.2 AA once, and the 2011-era AODA floor comes along for free.

Frequently Asked Questions

Does the AODA apply to my business if it isn't based in Ontario? Only if you have 50 or more employees actually working in Ontario. The standard is triggered by provincial headcount, not head-office location or where customers shop — a retailer with no Ontario staff falls outside this threshold, though Ontario's Human Rights Code can still touch how you serve Ontario customers.

Do we have to fix web content posted before January 1, 2012? The regulation's duty technically reaches only content posted on or after that date. In practice, treat the whole site the same way — visitors don't check publish dates before testing a page, and parallel ADA or EAA exposure doesn't recognize a 2012 cutoff at all.

Is WCAG 2.0 Level AA still enough, or should we build to 2.2? Legally, 2.0 AA remains the named floor — the IASR hasn't been amended to reference a newer version. Building to 2.2 AA is the safer move anyway: it's backward-compatible, satisfies AODA automatically, and matches what US courts and EU regulators increasingly expect.

What happens if we miss the December 31, 2026 reporting deadline? Ontario states that not filing can trigger enforcement action, including financial penalties, separate from any penalty tied to the underlying website requirements. Filing late still beats not filing — the form only needs your legal name, business number, employee count, and a certifying senior officer.

Can Ontario audit a business without a prior complaint? Yes. Compliance reports, audits, and inspections proceed independent of any individual complaint, and a report an organization files is itself a statement regulators can act on if it doesn't match reality.

Does building to AODA's standard also cover our US ADA or EU EAA exposure? Largely, for the technical work. WCAG 2.2 AA in source code satisfies AODA's floor and is what US settlements import for ADA matters, though each regime still layers its own paperwork — an AODA plan, an EAA statement — that engineering alone doesn't produce.

Like everything at TestParty, this article reflects our cyborg philosophy: AI handles the heavy lifting, humans bring the expertise. The data and opinions here are based on publicly available sources as of publication. TestParty is a participant in the accessibility market — we believe in transparency, so we encourage you to cross-reference our claims and evaluate all options for your business.