Skip to main content

WCAG 2.2.3 — No Timing

AAA

The AAA position: no time limits, full stop. The only exceptions are real-time events that genuinely depend on timing — and even there, the standard wants you to remove the dependency where you can.

What this requires

Timing is not an essential part of the event or activity presented by the content, except for non-interactive synchronised media and real-time events. In practical terms, AAA-targeting content removes session timeouts, response-window timers, "you have 30 seconds to verify" patterns, and any other clock the user must beat.

How AI coding tools fail this

AI tools that ship default authentication flows often include OTP expiry, password-reset-link expiry, and session-inactivity timeouts — all of them defensible security defaults that fail AAA. The failure mode isn't malicious; it's that secure-by-default and AAA-by-default don't always coincide.

The second pattern: e-commerce funnels with cart timeouts ("Items in your cart will be released in 15 minutes"). AAA bans these unless the timing is genuinely essential to the activity.

The third: timed quizzes and time-bound assessments where the timing isn't essential pedagogically but has been added to discourage cheating. AAA says: find another way.

Edge cases

  • Real-time events are exempt. A live auction with a 30-second bid window depends on timing; the criterion accepts that.
  • Synchronised media (a video that plays at its natural rate) is exempt from the timing criterion — the user can pause and rewind.
  • Security timeouts for authentication remain a reasonable default; AAA may not be the right target if you can't remove them.
  • AAA isn't the right target for every product. Pick the compliance level that matches the audience.
  • 2.2.1 vs 2.2.3: 2.2.1 lets timers exist if they can be extended; 2.2.3 wants them gone.

How Jeikin handles this

The same scanner that flags timing for 2.2.1 records the findings against 2.2.3 too for projects that target AAA. The dashboard shows both criterion mappings for each finding and lets the reviewer record the AAA exception status (essential, real-time, or remediated).

References