EAA Fines and Penalties: What Businesses Selling Into the EU Actually Face
If you have been searching for "the EAA fine" - a single number you can put in a risk register - you will not find one. That number does not exist. The European Accessibility Act deliberately leaves penalties to each member state, which means the real picture is a patchwork of 27 national regimes, some of them surprisingly steep.
This post explains how enforcement works, what the penalty ranges look like country by country, and what multi-market sellers should do about it. It is guidance, not legal advice - confirm specifics against the relevant national transposition law or a qualified adviser.
Why there is no single EU-wide fine
The EAA (Directive (EU) 2019/882) became enforceable on 28 June 2025. As a directive rather than a regulation, it required each of the 27 member states to transpose its requirements into national law. The directive itself does not specify fine amounts. The Directive itself does not specify fine amounts. Article 30 requires only that penalties be "effective, proportionate and dissuasive." That language is intentional - it gives regulators room to calibrate, but it also means the gap between the cheapest and most expensive national regime is enormous.
Each member state must appoint one or more market surveillance authorities to monitor compliance of products on their national market. There is no "one stop shop" for enforcement. Many member states have appointed more than one authority to enforce the law in their jurisdiction.
The result, as multiple legal analyses put it plainly: each EU member state transposed the EAA into national law with its own fine ranges, enforcement agencies, and procedural rules. The result is a patchwork that businesses operating across multiple EU markets must navigate carefully.
What "penalties" actually means
Fines are the most visible consequence, but they are not the only one. The EAA makes clear that penalties should not stand alone. Under Article 30, they must be paired with effective remedial action. In practice, this means businesses may be required to fix accessibility issues, not just pay a fine.
Beyond fines, the enforcement toolkit includes:
- Orders to bring a product or service into conformity - a formal deadline to fix the problem
- Market withdrawal - if accessibility requirements are not met, authorities must first require corrective action within a reasonable timeframe. If the product is not brought into compliance, Article 20 allows authorities to remove the product from the market.
- Suspension of the right to operate - several countries, including Spain, can ban a business from operating in their market for up to two or three years
- Public naming - some regulators publish lists of non-compliant businesses, which carries reputational cost beyond any fine
- Criminal liability - in one member state (Ireland), serious and sustained non-compliance can result in imprisonment
In some countries, national law allows daily fines when accessibility issues are not fixed within the required timeframe. These fines can continue until compliance is achieved and are typically around €1,000 per day, depending on the country and the case.
A note on figures in this post. The numbers below reflect maximum penalties set out in national law as understood from primary legislation and independent legal analyses as of mid-2026. Actual penalties depend on severity, duration, company size, and intent. Fine ranges and enforcement rules change as national laws are updated. Always verify against the current national transposition law.
Country-by-country penalty overview
The table below covers the markets most relevant to cross-border sellers. The fines listed represent maximum amounts. Actual penalties depend on severity, duration of non-compliance, company size, and whether the violation was intentional.
| Country | Max Fine (approx.) | Daily / Periodic Penalty | Other Sanctions | Primary Authority |
|---|---|---|---|---|
| Germany | €100,000 per violation | Yes (~€1,000/day) | Market withdrawal; disclosure orders | Bundesnetzagentur / BAuA |
| France | Up to €250,000 (systemic); €50,000 per service | €20,000/year per non-compliant site | Separate fine for missing accessibility statement; public exposure | DGCCRF / ARCOM / ARCEP |
| Spain | Up to €1,000,000 (very serious) | — | Operating ban up to 2–3 years; public naming | Ministry of Inclusion |
| Hungary | ~€1,261,164 or 5% annual turnover | — | Market suspension | National market surveillance body |
| Italy | €40,000 (general); 5% turnover (Stanca Law companies) | — | 90-day cure period before fine; AgID oversight | AgID |
| Netherlands | Up to ~€900,000 or 10% turnover | Yes | Mandatory compliance reporting; service suspension | ACM |
| Sweden | ~€900,000 (SEK 10,000,000) | — | Market surveillance active from Oct 2025 | PTS / Konsumentverket |
| Ireland | €60,000 | — | Up to 18 months imprisonment (criminal, serious cases only) | Split: ComReg, broadcasting, consumer regulators |
| Slovakia | Up to €200,000 | — | Corrective measures | National market surveillance body |
| Belgium | Up to €200,000 | — | Business suspension possible | National market surveillance body |
Germany
Germany transposed the EAA through the Barrierefreiheitsstärkungsgesetz (BFSG), which came into force on June 28, 2025. The Bundesnetzagentur can impose fines up to €100,000 for each individual accessibility violation. That per-violation structure matters. A website with multiple distinct failures could face compounding exposure.
Germany also introduced a private enforcement mechanism. Within weeks of the BFSG taking effect in August 2025, e-commerce operators in Germany began receiving private warning letters (Abmahnungen) citing accessibility violations. These letters were not sent by regulators or disability organisations. Competitors and commercial legal actors have found the law a useful tool - a dynamic that anyone familiar with German competition law will recognise.
France
France has one of the more complex enforcement structures in the EU. The base penalty for a single EAA violation is a fifth-class fine: €1,500 per offence for individuals, €7,500 for legal entities. For repeat offenders, these double to €3,000 and €15,000 respectively. But the real risk comes from aggregate penalties for systemic non-compliance, which can reach €250,000.
France also requires a published accessibility statement. France applies fines ranging from €5,000 to €250,000, with additional penalties of €25,000 per year for missing accessibility statements.
Enforcement in France has been driven by civil society rather than regulators. France filed the first EAA lawsuits in November 2025 against Auchan, Carrefour, E.Leclerc, and Picard. The cases established an important precedent: enforcement action in France is being driven by civil society, not regulators.
Spain
Spain has the steepest confirmed penalties in the EU. Fines are tiered: minor infractions range from EUR 301 to EUR 30,000, serious infractions from EUR 30,001 to EUR 90,000, and very serious infractions from EUR 90,001 to EUR 1,000,000. Authorities can also suspend business activity for up to three years.
Spain also has a track record of enforcement before the EAA deadline. In April 2024, Spanish airline Vueling was fined €90,000 for failing to make its website accessible. The case shows how enforcement was already underway, even before the EAA's June 2025 deadline.
Italy
Italy's situation is layered. Italy's transposition of the EAA, Decreto Legislativo n.82/2022, makes digital accessibility a legal obligation for a broader group of businesses. Companies that provide products or services covered by the EAA must ensure these offerings are accessible, even if their annual turnover is less than €500 million. Companies already under the Stanca Law are given a 90-day notice to meet accessibility requirements, and may be fined up to 5% of their annual turnover if they fail to comply. Other companies are given the same 90-day notice period, and may face fines of up to €40,000 for non-compliance.
The 90-day cure period is a genuine window - but it only opens once a complaint or investigation has started.
Hungary
Hungary's EAA penalty ceiling is approximately €1,261,164 or 5% of annual net turnover, whichever is higher - among the highest fixed maximums in the EU. Hungary has the highest potential fine at approximately 1,260,000 EUR or 5% of annual turnover. Spain has the highest published fixed maximum at 1,000,000 EUR for very serious violations, plus operational bans up to 2 years.
Ireland
Ireland is the only confirmed EU member state where EAA violations can carry criminal liability. The maximum penalty is EUR 60,000 in fines and/or 18 months imprisonment. Ireland is the sole EU member state with criminal sanctions for EAA violations, including up to 18 months imprisonment on indictment. This is reserved for deliberate and sustained refusal to comply after formal enforcement action.
The multi-market problem: parallel enforcement
This is the point that most penalty guides understate. Businesses that serve consumers in the EU must comply with the EAA transposition for each country in which they operate, regardless of where they are headquartered.
There is no single-country opt-in. The EAA applies where the service is offered, not where the company is headquartered. A US company selling to French consumers is subject to French EAA enforcement. This mirrors GDPR's extraterritorial reach.
The practical consequence: a single non-compliant website or app that serves customers in Germany, France, and Spain can face simultaneous enforcement from all three national authorities. The fines do not cancel each other out - they stack. Failing to comply with the EAA could mean fines as high as €500,000, marketplace removal, and even jail time. Given that each country can separately fine you for digital inaccessibility, you could end up paying fines per country.
France splits responsibility between ARCOM, ARCEP, and the DGCCRF depending on the type of service. Italy relies on AgID. This fragmentation means businesses operating across multiple EU markets face multiple regulators with different expectations and timelines.
Microenterprise exemption — read the small print. Microenterprises (fewer than 10 employees AND annual turnover under €2 million) are exempt from service requirements only. Product requirements still apply. Both conditions must be met simultaneously — a company with 8 employees but €3 million turnover does not qualify.
How enforcement actually starts
The enforcement tone so far has been graduated rather than punitive. Good-faith evidence can mitigate penalties and help during appeals. Regulators are publishing checklists and notices before issuing heavy penalties.
The typical sequence looks like this:
A user, disability organisation, competitor, or regulator's own monitoring programme identifies a potential violation. In Germany, private commercial actors have also used the Abmahnung mechanism.
The market surveillance authority contacts the business and sets a remediation deadline — typically 30 to 90 days depending on the country.
The authority evaluates whether the business has taken adequate corrective action. Good-faith evidence of remediation work matters here.
If the business has not remediated, the authority can impose fines, order market withdrawal, or — in Spain and the Netherlands — impose immediate penalties for serious violations.
In countries that allow periodic fines, the meter keeps running until compliance is achieved. At ~€1,000/day, six months of inaction adds €180,000 before any base fine.
No fines have been issued yet under any EAA-transposed law as of early 2026. But enforcement machinery is running, legal notices have been filed, and private actors in Germany started sending warning letters within weeks of the law taking effect. The window between "enforcement starts" and "fines land" is narrowing.
Use this tool to estimate your exposure
The widget below lets you select the markets you sell into and see a rough picture of your combined maximum fine exposure. It is illustrative - actual penalties depend on severity, company size, and regulator discretion - but it makes the multi-market stacking effect concrete.
What to do now
The cheapest way to avoid any of this is genuine conformance - not a checkbox exercise, not an overlay, but real WCAG 2.1 AA / EN 301 549 compliance backed by a published accessibility statement. Remediation costs a fraction of the combined fine, legal, and market-withdrawal exposure.
Here is a practical starting list:
1. Confirm your scope. Are you providing a covered service (e-commerce, banking, e-books, transport, electronic communications) or a covered product to EU consumers? If yes, the EAA applies in every member state where you have customers.
2. Run a baseline audit. Automated scanning catches roughly 30-40% of issues. You need keyboard testing and screen reader testing on top. Our free WCAG 2.2 AA checklist lists every Level A and AA criterion in plain English with how to test each one.
3. Publish an accessibility statement. Several countries - including France and Germany - treat a missing or inaccurate accessibility statement as a separate, independently finable offence. This is a quick win: publish one, keep it current, and include a working feedback mechanism.
4. Document your remediation work. Good-faith evidence can mitigate penalties and help during appeals. A dated audit trail showing you identified issues and fixed them is worth more than a clean-looking site with no paper trail.
5. Map your market exposure. If you sell into multiple EU countries, list the relevant national authorities and fine ceilings for each. The widget above gives you a starting point. Then prioritise by market size and enforcement activity - France, Germany, and Spain are the most active right now.
6. Do not rely on overlays. An accessibility overlay does not produce EN 301 549 conformance and will not protect you from enforcement. For the full reasoning, see our post on whether overlays make you compliant.
The honest summary
The EAA does not set a single fine. It sets a floor - penalties must be effective, proportionate, and dissuasive - and leaves the ceiling to each member state. Those ceilings range from €40,000 in Italy (for companies not previously under the Stanca Law) to over €1 million in Spain and Hungary.
The multi-market exposure is the real story. A non-compliant website serving five EU countries is not facing one fine - it is facing five separate enforcement regimes simultaneously. Add daily penalties, market withdrawal orders, and the reputational cost of being publicly named, and the business case for genuine accessibility work is straightforward.
The enforcement machinery is running. The first lawsuits have been filed. The first warning letters have landed. The question is no longer whether enforcement will happen - it is whether your organisation will be ready when it does.
This post is guidance, not legal advice. Fine ranges and enforcement rules change as national laws are updated. Always verify figures against the current national transposition law or a qualified legal adviser in the relevant jurisdiction.
Related reading
WCAG 2.2 vs 2.1: what changed, and why AA is still the target
WCAG 2.2 added nine success criteria and is backwards-compatible with 2.1. What changed, the four new Level AA criteria explained, and why meeting 2.2 AA covers 2.1 AA too.
Do accessibility overlays make you compliant? The honest answer
Overlay widgets promise instant accessibility. They can't deliver it. Why automated overlays don't equal WCAG, ADA or EAA compliance - and what actually works.
The European Accessibility Act is now in force: what it actually requires
The EAA has applied since 28 June 2025. Who it covers, what "accessible" means in practice (WCAG 2.1 AA via EN 301 549), the micro-enterprise carve-out, the 2030 transition, and what to do now.