EAA Enforcement: What Has Actually Happened in Year One (July 2026 Review)

When the European Accessibility Act deadline passed on 28 June 2025, many compliance teams exhaled and moved on. One year later, the picture looks very different. Courts have issued orders. Regulators have opened cases. Private law firms have sent warning letters. And a re-test of 100 EU websites found that accessibility is, in some measurable ways, getting worse - not better.

This is a state-of-enforcement review as of July 2026. It is not a list of fine amounts (we cover those separately in our EAA fines and penalties guide). It is a factual account of what enforcement machinery has actually moved, country by country, and what compliance leads, legal teams, and product owners should do about it right now.

How EAA enforcement is structured: decentralised by design

Before the country-by-country picture, it helps to understand why enforcement looks so uneven. The EAA is a directive, not a regulation. Each of the 27 EU member states transposed it into national law and designated its own market surveillance authorities. There is no single EU-wide enforcement body.

The practical result: enforcement pace, style, and priority differ significantly across borders. France's enforcement has been driven by civil society litigation. Sweden's regulator launched proactive inspections. Germany saw private law firms move before any regulator did. The Netherlands built a structured reporting and escalation pipeline.

What is consistent across all member states is the escalation path authorities follow:

Early enforcement has concentrated on the first two stages: complaints, formal notices, information requests, and market-surveillance inspections. Fines under EAA-transposed national law have not yet been confirmed anywhere in the EU as of July 2026 - but the machinery that issues them is now fully operational.

Country by country: what has actually happened

France - civil society leads, courts follow

France has seen the most significant early enforcement activity in the EU. It has been driven not by regulators but by disability rights organisations acting through the courts.

On 7 July 2025 - just nine days after the EAA deadline - four disability organisations issued formal legal notices to Auchan, Carrefour, E.Leclerc, and Picard Surgelés, demanding that their websites and mobile applications be made accessible. When the retailers' responses were considered insufficient, the organisations filed emergency injunctions before the French Commercial Court on 12 November 2025 - the first EAA-related lawsuits anywhere in Europe.

The cases then diverged in a legally significant way. In May 2026, the Tribunal judiciaire de Lille dismissed the case against Auchan's e-commerce subsidiary - not because the site was accessible (the court acknowledged it met only 41% of the RGAA criteria), but on a procedural question about which legal entity bore the obligation. The associations have appealed to the Cour d'appel de Douai.

The Carrefour case produced a different outcome. On 4 June 2026, the Tribunal judiciaire de Caen ordered Carrefour France to make both its website, carrefour.fr, and its mobile app fully accessible within six months, with a coercive daily penalty of €500 for each day it misses the December 2026 deadline.

The ruling carries two lessons that extend well beyond France. First, the court held that accessibility is an obligation of result, not an obligation of means. Carrefour argued it had already reached 71% conformity with the RGAA - the court was not persuaded. Partial compliance is not compliance. Second, the order explicitly covers the mobile app alongside the website, establishing that the two are a single obligation with a single deadline. If your accessibility work has focused on the web and left the app for later, that is no longer a defensible position.

As Deque's Matthew Luken noted, the Caen ruling "illustrates how national courts can become the primary enforcement mechanism for rights that regulators have yet to guarantee." Disability rights associations now have a proven methodology and a court decision to cite. The next proceedings will be faster to bring.

Sweden - proactive regulatory inspection

Sweden's Post and Telecom Authority (PTS) took a different approach: proactive market surveillance rather than waiting for complaints.

In October 2025, PTS opened its first regulatory cases related to e-commerce accessibility, targeting larger retailers established in Sweden. The initial review examined three elements of each company's website: the homepage, a product page, and the search function. Mobile apps were out of scope for this first round, but the review of e-commerce services is continuing into 2026.

PTS has also received 124 public complaints - 110 concerning services (predominantly e-retail websites) and 14 concerning products such as ATMs. The volume of complaints signals that Swedish consumers are aware of their rights and willing to use them. Sweden's strong disability rights culture, shaped by decades of progressive legislation, means consumer expectations are high and complaints arrive quickly.

Swedish enforcement carries a further dimension beyond fines: PTS can prohibit the sale or distribution of non-compliant products and services within Sweden. For many companies, losing access to the Swedish market - even temporarily - represents a more severe consequence than the financial penalty itself.

Netherlands - structured escalation, global reach

The Dutch Authority for Consumers and Markets (ACM) built the most structured enforcement pipeline of any member state in year one.

The ACM allowed voluntary self-reporting until 15 October 2025, after which reporting became mandatory. The ACM then sent information requests to e-commerce operators worldwide - including companies headquartered outside the EU that sell to Dutch consumers. Companies that failed to respond are now under active monitoring, with formal enforcement expected in the second half of 2026.

Hanneke van Rooijen, project leader and senior supervisory officer at the ACM, was direct about the compliance gap at AbilityNet's TechShare Pro conference: "There is a very big gap between the status of the industry and the compliance with EAA." She added that fines and penalties are "absolutely not the goal" - the authority is "mission and value driven," aiming to contribute to equal access rather than to collect penalties. But she was equally clear that companies which failed to report or submitted incomplete reports should expect to be prioritised for audits.

The ACM's enforcement infrastructure is not new. It has substantial experience enforcing GDPR, the Digital Services Act, and consumer protection rules, with dedicated teams and a track record of imposing significant fines. EAA enforcement fits neatly into that existing capability.

The reach point matters for non-EU companies. If you sell to Dutch consumers, the ACM can and does contact you directly. An information request from the ACM is not optional correspondence.

Germany - private enforcement before regulators

Germany's enforcement dynamic is unlike any other member state. Within weeks of the Barrierefreiheitsstärkungsgesetz (BFSG) - Germany's EAA transposition - taking effect in June 2025, e-commerce operators began receiving private warning letters (Abmahnungen) from law firms citing accessibility violations. These letters did not come from regulators or disability organisations. They came from law firms using Germany's competition law framework (UWG), which allows private parties to pursue non-compliance as an unfair competition claim.

As Taylor Wessing noted in their June 2026 update, the first period after entry into force was "characterised more by soft enforcement and awareness-raising than by fines." That is now changing. Germany's new market surveillance authority (MLBF) is fully operational, its enforcement strategies are published, and businesses are beginning to see concrete supervisory activity. Service providers that notified the MLBF about partial non-compliance in 2025 are now receiving follow-up correspondence.

Other member states: the picture is widening

France, Sweden, and the Netherlands are the clearest examples of early enforcement, but they are not alone. According to Level Access, Sweden, the Netherlands, France, Finland, Luxembourg, and Italy have all established direct channels for EAA non-compliance notifications. Italy has also published comprehensive national guidelines. Denmark's monitoring agency began contacting companies about compliance in late 2025. Ireland's Commission for Communications Regulation (ComReg) has started processing consumer complaints.

The Czech Republic's supervisory authority has announced plans to publish lists of non-compliant products and services. The direction across the EU is consistent: authorities that spent the second half of 2025 building capacity are now using it.

The compliance gap: why the numbers are moving in the wrong direction

If enforcement is accelerating, you might expect compliance to be improving. The data suggests otherwise.

An independent 2026 re-test of 100 EU websites by WebYes found that the proportion of sites with missing alt text rose from 33% to 53% year over year - suggesting that new content is being shipped without accessibility review. Missing page language declarations rose from 9% to 33% over the same period. Overall, 93% of the websites assessed failed at least one automated WCAG 2.1 Level AA check.

These are automated checks - they catch only 20-30% of real accessibility issues. The actual compliance gap is larger than these numbers show.

The pattern is consistent with what the ACM observed in the Netherlands: organisations made some initial improvements around the June 2025 deadline, then reverted to shipping new content without accessibility gates in place. Accessibility treated as a one-time project degrades over time. The EAA requires ongoing conformance, not a point-in-time snapshot.

What to do now: six actions that reduce exposure

The enforcement picture points to a clear set of priorities. These are not theoretical best practices - they are the specific gaps that have triggered enforcement action in year one.

1. Get a current, formal audit

If your last accessibility audit predates June 2025, your conformance picture is out of date. Regulators and courts will ask what your organisation has done since the law took effect. An audit against EN 301 549 v3.2.1 (WCAG 2.1 AA) is the minimum starting point; begin planning for WCAG 2.2 as EN 301 549 v4.1.1 is expected to publish in Q3 2026. Automated scans are a useful baseline but catch only a fraction of real issues - the Carrefour case was built on testing with actual blind users, not scanners.

Our step-by-step WCAG-EM audit guide walks through how to structure a conformance evaluation that will hold up to regulatory scrutiny.

2. Publish and maintain your accessibility statement

An accessibility statement is a baseline EAA requirement, and its absence is an easy enforcement trigger. In France, failure to publish a conformity declaration is itself a separately finable offence. In Germany, the BFSG requires the statement to include details of the competent market surveillance authority. There is no harmonised EU-wide template - national requirements differ. Our EAA accessibility statement guide covers what each statement must contain.

3. Fix the priority journeys first

Enforcement has focused on e-commerce checkouts, product pages, search functions, and mobile apps. These are the journeys where inaccessibility causes the most concrete harm to users - and where courts and regulators look first. If you have a long remediation backlog, prioritise these over lower-traffic pages.

4. Respond immediately to any information request

The ACM has sent information requests to companies globally, including those headquartered outside the EU. If you receive a letter from any EU market surveillance authority, a disability organisation, or a law firm citing accessibility obligations, treat it as urgent. The escalation path from information request to formal investigation is short. Document your response and your remediation plan. Silence or delay is the worst possible answer.

5. Gate new content and releases

The alt-text data tells a clear story: organisations are shipping new content without accessibility review. Add accessibility acceptance criteria to your definition of done. Integrate automated checks into your CI/CD pipeline as a regression safety net. Assign ownership so that new features do not undo existing remediation work.

6. Prepare for cross-border spillover

A finding in one EU country can prompt investigations in others. The EU's market surveillance framework includes information-sharing mechanisms between national authorities. If you are active in France, Sweden, and Germany, an enforcement action in one market is not contained to that market.

The year-two outlook

The first year of EAA enforcement confirmed what most compliance leads expected: pace has varied by country, but the direction is consistent. Sweden, the Netherlands, France, Finland, Luxembourg, and Italy have all established direct channels for EAA non-compliance notifications. Authorities that spent 2025 building capacity are now using it.

The Carrefour ruling is the clearest signal of what year two looks like. Disability rights associations have a proven legal methodology. Courts are interpreting the accessibility obligation strictly. The ACM is moving from information-gathering to formal enforcement in the second half of 2026. Germany's MLBF is operational. And the compliance gap - measured in missing alt text, absent accessibility statements, and untested mobile apps - remains wide.

The window for treating EAA compliance as a future project closed on 28 June 2025. The window for treating it as a low-priority backlog item is closing now.