What a Website Accessibility Audit Actually Costs in 2026 - And Why the Remediation Bill Is the One That Hurts

Ask three vendors what a website accessibility audit costs and you will get three numbers that differ by an order of magnitude. All three can be honest.

Published 2026 pricing runs from roughly $1,500 for a small-site review to $50,000 and beyond for a large enterprise estate, with per-page pricing commonly quoted at $100 to $250 per page or screen and $25 to $100 for light pages. A small business typically lands between $2,000 and $7,000, a mid-sized business between $7,000 and $25,000.

Those ranges are not vendor greed or vendor generosity. They are the visible shadow of decisions about scope, method and depth that most buyers never make explicit in the brief. This post makes them explicit, then deals with the number that actually breaks budgets: what happens after the audit report lands.

The audit is not the expensive part

Here is the single most important line in any accessibility budget, and the one most often missing from the first version of it.

An audit tells you what is broken. It does not fix anything. Remediation is a separate line item, on a separate timeline, usually drawing on a separate team, and it is routinely larger than the audit that triggered it.

Published figures give the shape. A small business paying $1,500 to $5,000 for an audit should expect $2,000 to $15,000 to remediate what that audit finds. That is a multiplier of roughly 1x to 3x on the audit fee at the small end, and the ratio tends to worsen with codebase age rather than with site size.

A finance team that approves the audit and stops there has not approved an accessibility programme. It has approved the production of a document listing its own legal exposure, which is materially worse than doing nothing if the findings then sit unactioned. Under the EAA, a dated audit report showing known, unremediated failures is exactly the kind of evidence a market surveillance authority is pleased to receive.

Budget both, or budget neither.

What you are actually paying for

Four variables drive nearly all the spread between quotes.

1. Automated, manual, or both

This is the biggest single cost lever and the most common place for quotes to diverge without the buyer noticing.

Automated scanning is cheap because it is machine time. It also catches only a limited share of real failures. Industry estimates commonly put automated coverage around 30 to 40 percent of issues, and coverage measured by success criteria rather than by raw error volume is lower still, because the criteria automation cannot evaluate are disproportionately the ones that block users outright.

What automation cannot assess: whether alternative text is correct rather than merely present, whether focus order is logical, whether a custom component's ARIA actually conveys its behaviour, whether an error message is comprehensible, whether a journey can be completed end to end with a screen reader.

A quote built on automated scanning plus a light manual pass is a genuinely different product from a quote built on expert manual review plus assistive-technology testing. Both may be appropriate. They should never be compared on price alone.

2. Sample size and page selection

Nobody audits every page of a large site. The question is how the sample is chosen and how large it is.

A credible audit follows a structured sampling methodology, of the kind set out in the W3C's WCAG-EM evaluation methodology: identify the target journeys, select a representative sample across page types and templates, add a randomised sample to catch what structured selection misses, and document the basis for both. Ten well-chosen pages covering every distinct template and the full purchase journey will surface more actionable defect classes than fifty homepage-adjacent marketing pages.

When a quote is priced per page, the sampling strategy is the price. Make the vendor write it down.

3. Journey complexity and authenticated areas

Public marketing pages are the cheap part. Cost concentrates in:

• Checkout and payment flows, including third-party payment iframes.
• Authenticated account areas, which require test credentials, test data and often a test environment.
• Multi-step forms with conditional logic and error recovery.
• Custom interactive components: date pickers, combo boxes, data grids, carousels, modals.
• Anything rendered by a third party you do not control, from consent banners to chat widgets.

Under the EAA it is precisely these journeys that matter, because the obligation attaches to the service a consumer actually uses, not to the pages that are easiest to test.

4. Deliverable quality

A spreadsheet of WCAG violations mapped to URLs is cheap to produce and expensive to act on. A useful audit deliverable includes, for each finding: the success criterion, the user impact in plain language, reproduction steps, the specific code location, a recommended fix, and a severity rating that a product owner can prioritise against.

The second costs more and saves more, because it removes an entire round of engineering investigation that would otherwise be billed internally at a higher rate than the auditor's.

Building a budget that survives contact with a regulator

Work through these lines in order.

1. Discovery and scoping. Usually free, sometimes a small fixed fee on complex estates. Its output should be a written scope: page sample, journeys, platforms, browsers and assistive technology combinations, standard and level, and deliverable format.

2. The audit itself. Priced per the four variables above. Insist that the quote names the standard and version explicitly: for EAA purposes that is EN 301 549 and WCAG 2.1 AA as the legal floor, though testing to WCAG 2.2 AA is the sensible target since it subsumes 2.1 AA.

3. Remediation. Budget 1x to 3x the audit fee as a planning assumption, then refine it once the findings are in and severity-weighted. Split it explicitly into design-side fixes, front-end fixes, backend or CMS fixes, and third-party escalations, because those four draw on different teams with different lead times.

4. Third-party and vendor remediation. The line everyone forgets. If your consent banner, chat widget, review platform or payment iframe fails, the fix may be contractual rather than technical. Budget time, not just money, and start those conversations the day the audit lands rather than after your own fixes are complete.

5. Verification retest. Confirming the fixes actually landed, typically 20 to 40 percent of the original audit fee. Without it you cannot truthfully claim conformance in an accessibility statement, which means you cannot safely publish one.

6. The accessibility statement. Cheap to produce, legally required under the EAA, and only credible if lines 2 through 5 are genuinely complete. A statement that overclaims is a written admission if a regulator tests it.

7. Ongoing capability. Automated checks in CI, design-system fixes that stop defect classes recurring, and training. This is the line that determines whether you are buying an audit every year forever or converging on something sustainable.

Why the cheap quote is often the expensive one

Three failure modes recur.

The scan dressed as an audit. A four-figure quote that turns out to be an automated scan with a cover page. It will report the contrast failures and missing alt attributes, miss the keyboard trap in your checkout, and leave you with a document that says "audited" while your highest-risk journey remains unexamined.

The overlay bundled as remediation. Some vendors quote an audit and then propose a JavaScript overlay as the fix. Overlays do not deliver WCAG conformance, courts and regulators on both sides of the Atlantic have declined to accept them as a compliance defence, and buying one converts a remediation budget into a subscription that leaves the underlying failures in place.

The audit with no remediation plan. Findings arrive with no severity ranking, no code locations and no recommended fixes. The engineering effort to reconstruct all three typically exceeds the discount you negotiated.

Against these, the correct evaluation question is not "what does the audit cost" but "what will it cost me, in total, to be able to publish a truthful accessibility statement."

What the regulatory backdrop does to the maths

Two facts should sit in the business case.

First, accessibility is getting worse, not better. The 2026 WebAIM Million found 95.9 percent of the top one million home pages had detectable WCAG failures, up from 94.8 percent the previous year, with detected errors averaging 56.1 per page, a 10.1 percent rise. The driver appears to be complexity: average page elements reached 1,437, up 22.5 percent in a single year. Sites that are not actively maintained for accessibility regress by default, which is an argument for the ongoing-capability line rather than a one-off audit.

Second, EAA enforcement is no longer hypothetical. Sweden's PTS has opened supervisory cases and published a programme of e-commerce audits. France's DGCCRF issued formal notices to major retailers in late 2025 and escalated to court. Italy's AgID published private-sector guidance in March 2026. Member-state penalty ceilings range from roughly EUR 60,000 in Ireland to around EUR 900,000 in Sweden, and because the EAA is enforced nationally, a single non-compliant service can attract parallel proceedings in several markets at once.

Put the audit-plus-remediation figure next to that exposure and the budget conversation usually resolves itself. It resolves faster if you also price the alternative honestly: the cost of the same remediation done under a regulatory deadline, with legal counsel involved and no ability to sequence the work sensibly, is materially higher than the same work done voluntarily.

Questions to put in the RFP

Send these to every vendor and compare the answers rather than the totals:

• Which standard and version will you test against, and will you report against EN 301 549 as well as WCAG?
• What proportion of the assessment is automated versus expert manual review?
• Which assistive technology and browser combinations will you test, and how many?
• How many pages or screens, and how will the sample be selected? Will you follow WCAG-EM or an equivalent documented methodology?
• Are authenticated areas, checkout and third-party components in scope?
• Will each finding include a code location, reproduction steps, a recommended fix and a severity rating?
• Does the price include a verification retest? On what timescale?
• Will the deliverable support an accessibility statement and, where relevant, an Annex IV technical file?
• Will you testify to or stand behind the findings if a market surveillance authority asks?

That last question changes the tone of a sales conversation quickly, and it is a fair question to ask of anyone selling assurance.

The short version

A defensible 2026 budget for a mid-sized EU-facing service looks roughly like this: audit in the $7,000 to $25,000 band, remediation at one to three times that, a retest at 20 to 40 percent of the audit fee, plus an ongoing capability line for CI checks, design-system work and training.

The organisations that spend least over three years are not the ones that bought the cheapest audit. They are the ones that fixed the defect classes at source and stopped re-buying the same findings.