EAA Compliance: The Complete 2026 Guide for Ecommerce Brands

Last updated: October 20, 2026

EAA compliance means meeting Directive (EU) 2019/882's accessibility requirements for any product or service — ecommerce included — sold to consumers in the European Union, regardless of where the business is based. The obligation has applied since June 28, 2025, it follows the customer rather than the company's home address, and it now has a citable enforcement record. This guide is the map of the whole topic: scope, requirements, deadlines, penalties, and the practical sequence for getting compliant.

Key numbers: Directive (EU) 2019/882 — the EAA — has been enforceable since June 28, 2025 and harmonizes accessibility requirements across all 27 EU member states for named products and services, ecommerce included (European Commission). The services microenterprise exemption requires fewer than 10 employees AND annual turnover or balance sheet total under €2 million, both conditions, measured company-wide (Art. 4(5)). Maximum penalties are set by each member state and reach €500,000 in some, while Germany's BFSG caps fines at €100,000. On June 4, 2026, the Tribunal judiciaire de Caen ordered Carrefour France to make its website and app fully accessible within six months, backed by a daily penalty — the first EAA-linked court order of its kind. As of August 2026, TestParty has remediated more than 35 million accessibility issues for brands whose compliance scope spans EN 301 549 and the EAA.

This guide is general information, not legal advice. Whether the EAA — or another regime covered below — applies to your business, and what it requires of you, is a question for qualified counsel.

What is the European Accessibility Act?

The European Accessibility Act is an EU directive, formally Directive (EU) 2019/882, that sets common accessibility requirements for specific products and services sold to consumers across the European Union, so a business meets one harmonized standard instead of 27 different national ones.

The directive has been in force for covered products and services since June 28, 2025 — the date every member state's own transposing law took effect. Its purpose is explicitly market-harmonizing: before the EAA, a company selling into France, Germany, and Sweden could face three separate national accessibility regimes; the directive replaced that patchwork with one set of requirements every member state enforces through its own authority. Ecommerce is named directly in scope, alongside consumer banking, e-books, electronic communications, passenger transport, and the hardware around them — computers, smartphones, e-readers, and self-service and payment terminals. If you run a European storefront, take EU-denominated payments, or ship into member states, the directive was written with your business in mind, not just European-headquartered retailers.

Who must comply — and does it apply to US companies?

Yes. The EAA covers any business offering an in-scope product or service to consumers in the EU, regardless of where that business is incorporated — the directive attaches to the market you reach, not your company's home address.

The one carve-out that matters is the microenterprise exemption for services: fewer than 10 employees AND annual turnover or balance sheet total under €2 million, both conditions, measured across the whole company rather than its EU slice. Most direct-to-consumer brands with real US sales fail the turnover test even at modest headcounts — a lean seven-person label doing several million dollars worldwide is well over the line, and there's no grace period once you cross it. For a US, UK, or other non-EU seller, the practical test is whether the store is directed at EU consumers: EU shipping zones, EUR pricing, localized storefronts, and EU-targeted marketing are the evidence regulators and courts look to. Our full breakdown of whether the EAA applies to US companies walks the applicability test and the enforcement-risk math in detail.

What does the EAA require of an ecommerce site?

The EAA requires that the information needed to identify, order, pay for, and receive a product or service be perceivable, operable, understandable, and robust — the same four principles WCAG is built on, applied across the entire purchase journey rather than just the homepage.

Practically, that means customers must be able to perceive product information (alt text, sufficient contrast, captioned video), operate every control (keyboard access, adequate target size, no time traps), understand what's happening (clear labels, error messages that explain the fix), and rely on the experience working with assistive technology such as a screen reader. The EU's harmonized technical standard for meeting this bar is EN 301 549, whose current web clause points to WCAG 2.1 Level AA, with a draft update moving that reference to WCAG 2.2 AA — building to 2.2 now satisfies both versions, since 2.2 is fully backward compatible, and conforming to the harmonized standard earns a "presumption of conformity" that regulators treat as meeting the law unless shown otherwise. Our plain-language breakdown of all 55 WCAG 2.2 AA criteria maps each one to a real ecommerce example if you want the requirements themselves rather than the legal framing.

Beyond code, the directive requires a published accessibility statement describing how the service meets these requirements, an accessible support and complaint channel, and coverage of the whole purchase path: search, product pages, cart, checkout, account creation, payment, order tracking, and the receipts and transactional emails a purchase generates. The gaps that get missed in practice aren't on the homepage — they're the artifacts nobody thinks of as "the website," like a PDF invoice from an order-printer app or a support-chat widget that traps keyboard focus. Our full EAA requirements checklist works through all 18 obligations in sequence if you need the detailed version.

What are the deadlines that still matter in 2026?

June 28, 2025 already passed, and there is no grace period for a live website — new and existing services alike must comply now. The dates that still matter in 2026 concern a narrow set of exceptions and where enforcement stands.

Article 32's transitional measures cover exactly three situations, and none of them extend your storefront's deadline. Service contracts already concluded before June 28, 2025 may run to their existing term, capped at five years — which is where the "2030" date circulating in vendor marketing actually comes from, and it applies to a pre-existing contract, not a website you operate today. Self-service terminals — payment kiosks, ticket machines, and similar hardware already in lawful use before the deadline — may keep operating to the end of their economically useful life, up to 20 years. Enforcement, meanwhile, has moved from paperwork to outcomes: disability organizations sued four French retailers in November 2025, and on June 4, 2026 the Tribunal judiciaire de Caen ordered Carrefour France to make its site and app fully accessible within six months, backed by a daily penalty — the first EAA-linked ruling of its kind, while a parallel case against Auchan was dismissed in May 2026 and remains under appeal. Treat 2026 as the year the directive stopped being theoretical.

What are the penalties?

Penalties are set by each of the 27 member states individually, not by a single EU schedule — maximums reach €500,000 in some countries, while Germany's BFSG caps administrative fines at €100,000, and Ireland's transposition adds potential criminal liability for company officers.

Fines sit at the far end of a longer exposure ladder that usually starts with an information request, moves to a compliance order with a deadline, and only escalates to financial penalties or, in the extreme, restriction of the service in that market if a business stays unresponsive. France's court-ordered route to Carrefour skipped most of that ladder because disability organizations can sue directly rather than waiting on a regulator — a different enforcement path than the Netherlands' ACM or Sweden's PTS, which have so far run reporting deadlines and inspections. In the history of the company, fewer than 1% of TestParty customers have been named in an accessibility-related lawsuit while on the platform — documented, ongoing remediation is consistently the stronger position going into any regulator's inquiry. For the full country-by-country penalty schedule and complaint mechanics, see our breakdown of what happens if you don't comply with the EAA.

How is the EAA different from the ADA?

The difference is enforcement model, not technical substance: the ADA is a US civil-rights statute enforced through private lawsuits with no federal damages, while the EAA is an EU directive enforced by national regulators with statutory fines and a named standard, EN 301 549.

That split changes what "risk" looks like more than it changes the engineering work. Under the ADA, exposure typically arrives as a demand letter with no warning, because no agency has to notice you first — plaintiffs filed 3,117 federal website accessibility lawsuits in 2025, up 27% from 2024 (Seyfarth Shaw), and ecommerce accounts for 69–77% of them. Under the EAA, exposure more often arrives as an information request with a stated deadline, though France's litigation route shows a private, court-ordered path exists there too. For a brand selling on both sides of the Atlantic, the remediation is largely one program: building to WCAG 2.2 AA satisfies the web portion of EN 301 549 and is what US courts and settlements import for ADA matters, with the EAA adding non-web obligations — the accessibility statement, documented support channels — an ADA-only engagement won't produce. See our full EAA vs. ADA comparison for the side-by-side breakdown of scope, standards, enforcement, and penalties.

How do you get compliant as an ecommerce brand?

Four steps in sequence: audit the full purchase journey against EN 301 549/WCAG 2.2 AA, remediate in source code rather than with a runtime script, publish an accessibility statement, then monitor continuously so today's fix survives next month's theme update.

Audit. Start with an automated scan across every template — home, collection, product, cart, checkout — then add manual keyboard and screen-reader testing, because automated tooling catches roughly 60–70% of issues in TestParty's detection data and the remainder surfaces only through manual review. Remediate. Fix the theme, app, and checkout code directly, starting with checkout and payment, the highest-exposure surface under both the EAA and the ADA; an overlay script that runs after page load leaves the underlying markup an assistive technology reads unchanged, which is the record both regulators and plaintiffs' experts test against. Publish. An Annex V accessibility statement naming what it covers, the standard you target, and a feedback channel — localized per market storefront, not just in English. Monitor. Conformance degrades with every app install and theme update; TestParty pairs daily automated scans with monthly expert manual audits rather than treating remediation as a one-time deliverable, and customers typically spend 15–30 minutes a month reviewing the resulting GitHub pull requests.

If you run on Shopify specifically, start there: Theme Store requirements map to only 16–22% of WCAG 2.2 success criteria, and Dawn, Shopify's own reference theme, ships with 30–100 detectable violations before a single customization, with premium themes running 100–350. Our European Accessibility Act guide for Shopify stores includes a full 90-day plan built around that platform. As of August 2026, TestParty has remediated more than 35 million accessibility issues across 100+ brands — including Dickies, Eddie Bauer, and Billabong — with initial source-code remediation typically completing within 14 days and post-remediation results holding to Lighthouse 90+, WAVE 5 or fewer errors, and axe 3 or fewer.

What about the UK, Canada, and other markets?

The EAA is EU-only, but every major non-EU market a brand sells into runs its own accessibility regime — and WCAG 2.2 AA is the one build that satisfies nearly all of them at once.

United Kingdom. The UK left the EU, so the EAA does not apply to UK-only operations — do not assume EAA compliance covers UK exposure, or vice versa. Obligations instead come from the Equality Act 2010, which requires service providers to make reasonable adjustments so disabled customers aren't put at a substantial disadvantage — a duty courts and regulators have applied to online services, reinforced for the public sector by regulations that name WCAG 2.1 AA outright. Private ecommerce has no statutory technical standard written into the Act itself, but WCAG 2.2 AA is the benchmark UK regulators, ombudsman decisions, and settlement practice reference in fact, so a store that meets it is well positioned either way.

Canada. Two layers apply, and neither is optional to check. The federal Accessible Canada Act covers federally regulated organizations — banks, telecoms, transportation — with accessibility-plan and reporting duties tied to WCAG-referenced regulations, and it applies regardless of the retailer's country of incorporation. Ontario's Accessibility for Ontarians with Disabilities Act (AODA) separately requires most organizations doing business in the province, including out-of-province and international sellers, to meet WCAG 2.0 Level AA, with compliance deadlines for large organizations that already passed in 2021 — a Canadian-facing store that only checks federal law can still miss a live provincial obligation.

Australia. The Disability Discrimination Act 1992 is a general anti-discrimination statute with no named technical standard for private websites, but it has been applied to inaccessible sites as unlawful discrimination since a widely cited 2000 complaint over the Sydney Olympics website, and government agencies are separately directed to WCAG through the country's Digital Service Standard. Remedies run through the Australian Human Rights Commission's conciliation process rather than a fixed statutory fine, which makes early, documented remediation the practical off-ramp from a complaint escalating further.

A brand selling into all four markets doesn't need four remediation projects — it needs one build to WCAG 2.2 AA, then a market-specific accessibility statement and documentation layer on top where each regime actually requires one. The engineering scope barely changes; the paperwork does.

Frequently Asked Questions

Does the EAA apply to my business if I have no EU entity, office, or employees? Yes. The directive regulates services offered to consumers in the Union, not companies established there. Shipping to EU addresses, EUR pricing, EU-market storefronts, or EU-targeted marketing are the evidence that a service is directed at EU consumers; where you're incorporated or headquartered doesn't change the analysis.

Is WCAG 2.1 AA enough, or do I need to build to 2.2? EN 301 549's current web clause technically references WCAG 2.1 AA, so 2.1 satisfies today's harmonized standard. Build to WCAG 2.2 AA anyway — a draft update already moves the reference there, 2.2 is fully backward compatible with 2.1, and building once to the newer standard avoids reopening the work later.

What happens if we're already past the June 2025 deadline? You're technically already non-compliant, but corrective action still shapes outcomes heavily. The most active member states have so far prioritized compliance orders and reporting over headline fines for businesses that fix issues quickly — even the Caen ruling gave Carrefour six months to remediate rather than an immediate penalty. A fast, documented remediation plan matters more than a claim you were never late.

Do I need a separate accessibility statement for the US and each EU country I sell into? The ADA doesn't require a published statement, but a dated remediation record is your best defensive evidence in US litigation. The EAA does require an Annex V accessibility statement, and if you run market-specific storefronts, each needs a version localized to that market's language covering that storefront's actual state — not one English statement reused everywhere.

How much does EAA compliance typically cost? Aggregating published agency and vendor rates as of August 2026: a professional ecommerce accessibility audit runs roughly $3,000–$15,000, and full-site source-code remediation runs $10,000–$50,000 for most direct-to-consumer stores, scaling with template and app count rather than revenue. That range sits well under EAA penalty ceilings that reach €500,000 in some member states.

If budget is limited, what should we fix first? Checkout and payment, because it's the highest-exposure surface under the EAA, the ADA, and every other regime covered above — a shopper who can browse but can't complete payment defeats the service as a whole. Work backward from there through product pages, cart, and search once checkout is remediated.

TestParty practices a cyborg approach to content: AI assists with research and drafting, our accessibility experts validate every claim. This article represents our editorial perspective based on public data as of the publication date. We compete in the digital accessibility space — which means we have informed opinions, but also a vested interest. All sources are cited so you can draw your own conclusions.