The European Accessibility Act, one year in: what enforcement actually looks like, country by country
The European Accessibility Act has applied across the EU since June 28, 2025. A year on, the common story is that the fines have arrived. The verified record tells a quieter and more useful story: the law has teeth on paper, year one was mostly notices and lawsuits, and as of mid-2026 no confirmed monetary fine has been collected from a private business in any member state.
That gap between the statutory maximums you read about and what regulators have actually done is the whole story. This post lays out the per-country reality, with the figures checked against primary sources rather than repeated from secondary summaries.
A note on the numbers below: every penalty is a stated statutory maximum under national law, not an amount anyone has been ordered to pay. The two are very different, and conflating them is how a lot of misinformation spreads.
The one conviction that actually happened
The clearest enforcement event of year one came from France. On June 4, 2026, the Tribunal de Caen convicted the retailer Carrefour over its e-commerce accessibility. The court imposed €500 per day until the site is brought into conformance, plus €10,000 in damages, with a six-month remediation deadline. It found that 71% RGAA conformance was not enough to meet the obligation.
That case did not arrive out of nowhere. In November 2025, the disability rights organizations ApiDV and Droit Pluriel filed emergency injunctions against four of France's largest grocery retailers: Auchan, Carrefour, E.Leclerc, and Picard. The outcomes have varied. The Carrefour matter produced a conviction; an Auchan case was dismissed in May 2026 despite acknowledged non-conformance. France runs its enforcement through both sector regulators and the civil courts, and the courts have moved fastest.
Elsewhere, the activity has been preparatory rather than punitive:
- Sweden opened its first market-surveillance cases through the Post and Telecom Authority in October 2025 and had logged 124 public complaints by mid-2026.
- Ireland's ComReg lodged a complaint against Three, its largest mobile operator.
- Italy launched its citizen complaint platform, segnalazioni.agid.gov.it, on March 11, 2026, with the first inspection still pending as of late spring.
- Norway, outside the EU but running a parallel regime, is the one place fines have actually bitten. Its health portal HelsaMi, used by roughly 500,000 people, accrued daily penalties of NOK 50,000, totalling more than NOK 3.5 million by December 2025.
The pattern across the EU is consistent. Regulators spent year one standing up the machinery: complaint platforms, reporting deadlines, market-surveillance bodies. The penalties exist in statute and are starting to surface through courts. They have not yet shown up as collected fines.
Enforcement by country: the verified table
Here is what each major market's transposition actually says, checked against primary legislation where available. Penalties are statutory maximums per violation unless noted.
| Country | Statutory maximum | Enforcement authority | Transposition |
|---|---|---|---|
| Italy | €2,500–€40,000 per violation (SMEs); up to 5% of turnover for large firms under the Stanca Law | AgID, via the Digital Civil Defender | D.Lgs. 82/2022, with sanctioning rules in Determinazione 84/2026 (May 16, 2026) |
| France | EAA contravention: €1,500 / €7,500 (€3,000 / €15,000 on repeat). Disability Law: €50,000, plus €25,000 for a missing accessibility statement or plan | DGCCRF (lead), plus ARCOM, ARCEP, AMF, ACPR; civil courts | Law 2005-102 and the EAA transposition decree |
| Germany | €100,000 for serious offenses; €10,000 for lesser ones. Per violation, no turnover cap | Marktüberwachungsstelle der Länder (Magdeburg) | BFSG, §37 |
| Spain | Minor €301–€30,000; serious €30,001–€90,000; very serious €90,001–€1,000,000 | Ministry of Social Rights (national) and the regions; OADIS handles complaints only | Ley 11/2023, with amounts set via RDL 1/2013, Arts. 83 and 96 |
| Netherlands | Up to €900,000 per violation, or 10% of turnover if higher | ACM | Implementatiewet toegankelijkheidsvoorschriften (Stb. 2024/87) |
| Ireland | Up to €60,000 plus up to 18 months' imprisonment on indictment; lesser fines and up to 6 months on summary conviction | CCPC, ComReg, and sector regulators | S.I. 636/2023, Reg. 32 |
Two things stand out. Ireland is unusual in attaching criminal liability, reaching both the company and its officers, where most states treat non-conformance as an administrative matter. And the maximums vary by more than an order of magnitude, from Italy's €40,000 SME ceiling to the Netherlands' €900,000, which matters a great deal if you ship one product into several markets at once.
Many other member states have transposed the directive but produced no verifiable enforcement activity in year one. We have left them out of the table rather than fill it with rows that say "no data". An honest blank is more useful than a confident guess.
Why the numbers online are a mess
If you search for EAA penalties, you will find figures that contradict each other, including in our own writing. Our April roundup of the 2026 deadlines cited France at "up to €250,000" and Spain at "up to €600,000". Checking those against primary legislation, both are off. The corrected figures are in the table above. Here is why this happens so often.
France looks contradictory because there are two regimes, not one. The EAA transposition creates fifth-class contravention fines (€1,500 / €7,500, doubled on repeat). Separately, the older Disability Law of 2005 carries administrative penalties of €50,000, plus €25,000 for failing to publish an accessibility statement or multi-year plan. A source that quotes one regime and a source that quotes the other will appear to disagree, and a source that adds them or inflates them produces the "€250,000" figure that has no statutory basis.
Ireland looks contradictory because of how criminal sentencing works. The "6 months versus 18 months" you see quoted are not in conflict. Six months applies to summary conviction; 18 months applies to conviction on indictment. They are two routes through the same law.
Germany looks contradictory because of which authority you name. The Bundesnetzagentur enforces the public-sector regime (BGG and BITV). Private-sector EAA scope under the BFSG is enforced by a different body entirely, the federal states' market-surveillance office in Magdeburg. Cite the wrong one and the whole picture shifts.
The lesson for anyone tracking this is to go to the national statute, identify which regime and which authority govern your specific product or service, and treat vendor summaries as a starting point rather than an answer.
What this means if you ship into the EU
The practical takeaway is calmer than the headline numbers suggest. Year one was about regulators building the apparatus and a handful of civil cases testing the waters. The enforcement curve points upward from here, but it points there gradually.
What carries across every one of these regimes is the same underlying question: when an authority or a buyer asks, can you show your work? The complaint platforms now live in Italy and Sweden, the reporting deadlines in the Netherlands, and the court cases in France all converge on evidence. Not a policy statement, but a record of what you tested, what you found, and what you did about it, refreshed recently enough to be credible.
That record is worth holding per market, because the obligations and the bodies you answer to differ by country. A single VPAT mapped to WCAG and cross-referenced to each national framework is the artefact most procurement teams and regulators are actually asking for. Keeping it current, as findings are raised and fixed, is the part that turns a point-in-time document into ongoing proof. Jeikin exists to make that record accumulate as a side-effect of normal development rather than as a separate compliance project, but the principle holds whatever tooling you use: build the system that produces the evidence before someone asks for it.
The shift, in one line
A year in, the EAA's enforcement is real but early, its penalties are large on paper and unlevied in practice, and its through-line is evidence. The teams that come out of year two well are the ones treating that as a prompt to get their record in order, not a reason to panic.
Figures in this post are stated statutory maximums verified against national legislation as of June 2026, not amounts levied. Where a country had no verifiable year-one enforcement activity, we left it out rather than guess.