Blog
One Year of EAA Enforcement: What Has Actually Happened
The European Accessibility Act became legally enforceable on 28 June 2025. A year is a short time in regulatory terms, but it is long enough to answer the question I have been asked most often by clients since: is anyone actually being held to account, or is this another directive with no teeth?
Twelve months in, no regulator fine under a national EAA law has been publicly reported anywhere in the bloc. Austria, the member state publishing the most detailed enforcement figures, confirms it has imposed none. Some businesses have taken that as proof the Act carries no real risk. That reading does not survive contact with what has actually happened since June 2025.
Enforcement rarely begins with a fine
Regulators do not open with penalties. They open with complaints, information requests and formal notices, and escalate only when those are ignored. Austria has written that principle into its explanatory notes: for a first or minor breach, "advise before penalize" is given particular weight. A year on, several member states are already past that first stage. Where each country sits on that path tells you more than waiting for a headline fine.
France: two rulings
France has moved furthest, and it has produced the two decisions everyone in this field is currently reading. Both come from the same campaign. Both orders are public, and it is worth reading the orders not just the commentaries.
In July 2025 the disability rights organizations apiDV and Droit Pluriel, supported by the lawyers' association Intérêt à Agir, sent formal notice to four of the country's largest retailers (Auchan, Carrefour, E.Leclerc and Picard) over the accessibility of their online grocery services. Proceedings followed in late November 2025.
Lille, 5 May 2026 (Auchan). The Tribunal judiciaire de Lille dismissed the claim (RG 25/01796, dated 5 May per the signed order), though not because the site was accessible. The order records that across the 19 sections of Auchan's own accessibility declaration, 13 were rated "strong to major" impact and one "strong". That is 14 of 19 at the top of the scale, where the order notes such an impact prevents or may prevent access to all or part of the site's content and functions. The mobile app carried no accessibility statement at all, and an audit Auchan itself commissioned in October 2023 had found a generally low level of accessibility. The judge described the company's limited interest in accessibility as manifest, given its standing as a leading player in online commerce (translated from the French, as with the quotations below).
The case turned instead on a drafting question. Article L.412-13 of the Consumer Code, which transposes the 2019 directive and catches online sellers above €2 million, opens with the words "without prejudice to Articles 47 and 48" of the law of 11 February 2005, whose implementing decree sets a €250 million threshold. The judge read "without prejudice" as meaning the 2005 regime is not displaced, and therefore that its €250 million threshold "must be taken into consideration". Auchan E-Commerce France's three-year average French turnover falls below that figure, so no obvious breach was established. A separate non-discrimination limb, argued under French anti-discrimination law and the UN Convention on the Rights of Persons with Disabilities, failed for the same reason. The judge acknowledged the gap between the stated ambition of these texts and what disabled users actually get, but held that this was not a reason to set the texts aside. The associations have appealed to the Cour d'appel de Douai.
Caen, 4 June 2026 (Carrefour). A month later the Tribunal judiciaire de Caen ordered Carrefour France (RG 25/00691) to bring carrefour.fr and the Carrefour app into conformance, with a penalty of €500 per day beginning six months after the order. Carrefour's own accessibility declaration put it at 71.21% against the RGAA. The court's answer is the line that has traveled widely since: "the e-commerce site in question cannot be only a little accessible, it must be totally accessible."
Three findings in that order matter more than the headline. First, the mechanism: conformity with EN 301 549 raises a presumption of compliance, so demonstrated non-conformity raises a rebuttable presumption of breach, and Carrefour failed to rebut it. Second, Carrefour argued disproportionate burden and the court rejected it flatly, calling the statutory criteria very restrictive and unjustified on these facts. (See my article on disproportionate burden.) Third, the court refused to order the site suspended, since that would have penalized every other customer, and awarded €10,000 provisional damages against the €50,000 claimed, plus €3,000 in costs. The order is immediately enforceable.
Why these are not actually opposite rulings. It is tempting to read Lille and Caen as a split. They are better read as distinguishable on their facts. Carrefour France turns over more than €250 million, so it was caught by the 2005 law and the Consumer Code alike, and the Caen judge never had to decide whether L.412-13 bites on its own below that threshold. Only Lille reached that question. So the live issue for every French online seller between €2 million and €250 million in revenue is still open, and Douai will decide it. If you are in that band, you are not in the clear. You are in an unresolved case. The E.Leclerc and Picard matters remain outstanding.
Austria: enforcement measured in open cases
Austria gives the clearest picture of day-to-day enforcement. A year after the BaFG took effect, the market surveillance authority had opened 84 formal proceedings and assessed 48 reports, according to figures published by the Social Affairs Ministry. Seventy-four were still pending and ten had been discontinued. Thirty-six were started by the authority itself rather than prompted by a complaint, and 22 of those 36 concerned banking services. Worth noting if that is your sector.
Two features of the Austrian regime deserve attention. The authority, the Sozialministeriumservice's Upper Austria state office, must examine any report it receives and tell the consumer or organization in writing, in an accessible format, within eight weeks whether it is opening proceedings. That is a short, published clock, and it means a single complaint produces a documented decision rather than disappearing into a queue. And where conformity is not achieved, an operator can be required to withdraw or recall a product, or a service provider ordered to stop offering the service altogether, with administrative penalties on top.
Those penalties reach €80,000 for large companies, with lower maxima for SMEs and micro-enterprises. No administrative penalty has been imposed yet, and that is the point I keep coming back to with clients. It is not evidence of inactivity. It is a regulator working through its first year of casework in a jurisdiction that has said explicitly, in the law's own explanatory notes, that for a first or minor breach it will advise before it penalizes.
Germany: a regulator still standing up
Germany's Barrierefreiheitsstärkungsgesetz (BFSG) has applied since 28 June 2025. Enforcement sits with the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF AöR), a joint body of the sixteen federal states based in Magdeburg, established on 26 September 2025. It is still visibly building: it announced its constituted advisory board and its formal launch events during 2026.
Four things in the MLBF's own description of its powers are worth knowing before you assume a young regulator is a harmless one.
It escalates in stages. First a demand to correct the non-conformity within a reasonable deadline; then restriction of market availability; then a full ban, recall, or prohibition of the service (§§22, 23, 29, 30 BFSG). Fines come on top: up to €10,000, rising to €100,000 for certain breaches (§37 BFSG).
Its targeting is risk-based, not random. The surveillance strategy is built on risk assessment and expressly takes account of consumer applications and emerging technologies (§§20(2), 21(2) BFSG with Articles 11(3) and 13 of Regulation (EU) 2019/1020).
Consumers and recognized associations can formally trigger it. Under §32 BFSG, they may apply for market surveillance measures where an operator has breached the BFSG and the consumer is restricted in, or prevented from, using the service. Under §31, a consumer can ask the MLBF what it knows about whether a specific operator complies. That is a considerably lower barrier than litigation.
And it audits your exemption claims. If you assert a "fundamental alteration" (§16) or a "disproportionate burden" (§17), the MLBF checks whether the assessment criteria were properly applied and whether you met every other requirement anyway. Filing the assessment is not the same as winning the argument.
The second channel. Roughly six weeks after the BFSG took effect, the first cease-and-desist letters landed, and the law firm Heuking's account of them is worth reading in full before anyone panics. They were sent on behalf of a website operator, alleging unfair competition under §§3, 3a and 7(9) UWG by reference to §14(1) BFSG. The letter contained a blanket assertion of inaccessibility evidenced by a screenshot, no specifics on what was wrong, a settlement figure with no visible basis, and an offer from the warning party to sell the recipient its own accessibility services.
My advice to German clients is the same as Heuking's. Do not ignore one, because deadlines are short and an injunction is possible. But do not pay quickly either. Whether a BFSG breach is actionable under §3a UWG at all is unsettled, and whether the sender is genuinely a competitor within the meaning of the UWG is often the weakest link in the letter. There is a real compliance obligation here and a partly opportunistic enforcement industry growing around it. They should not be confused with one another.
Sweden and the Netherlands: surveillance turning into casework
Sweden's Post and Telecom Authority is running a planned supervision program over e-commerce services and has opened 28 cases, the most recent eleven added in March 2026. The list is not obscure: ICA, Coop, Willys, Hemköp, Apotea, Åhléns, Stadium, H&M, IKEA, Adlibris and Systembolaget among them. PTS says the program runs through 2025 and 2026, cases will be opened in stages, and it has not yet decided which companies come next.
The Netherlands has moved from measuring to naming. In March 2026 its Consumer and Market Authority published results from testing around 100 of the largest Dutch webshops plus the biggest telecom and energy providers: 61% were not digitally accessible, meaning it was impossible to place an order using assistive technology. An order button that cannot be reached by keyboard, say, or a CAPTCHA that locks the user out entirely. A further 33% had "serious problems" where ordering was possible but took considerably more effort. The ACM is putting improvement points to the worst-performing large companies, and has said that those which do not improve sufficiently risk enforcement. The ACM involves disabled people in its supervisory work and, with Stichting Accessibility, surveyed them directly to establish which barriers matter most in practice. That is the right way round, and a useful counter to the idea that automated scanning is enough.
Penalties vary by country, and the headline number misleads
Article 30 of the EAA leaves penalties to each member state, and the ceilings differ considerably. Austria's ceiling is €80,000; Germany's is €100,000 for certain breaches and €10,000 otherwise; others sit well above and below both. But the ceiling is rarely the number that matters. In every case mentioned above, the expensive part was never a fine. It was the remediation the organization was always going to have to do, now compressed into someone else's timetable, plus legal costs, plus in Carrefour's case a daily penalty running against a court-imposed deadline.
Regulators are scaling up, not standing down
The direction of travel in year two is toward more scrutiny. Sweden has more cases coming and has said so. The Netherlands has finished measuring and started warning. Germany's national market surveillance body did not exist until September 2025 and was still formally constituting itself through 2026. Austria has 74 live investigations. And the Douai appeal will decide a threshold question affecting every online seller in France between €2 million and €250 million in revenue. None of this reads like regulators treating the EAA as a formality.
Conclusion
Twelve months into EAA enforcement, no regulator has issued a fine. That is a snapshot of where the enforcement clock stands, not a verdict on whether the law has teeth. A French court has ordered a major retailer to remediate under threat of a daily penalty, rejected its disproportionate-burden defense, and told it that 71.21% is not a defense either. Austria has 74 open investigations. In Germany, private parties are enforcing the law in places the regulator has not yet reached. And the authorities that spent year one building capacity are only now moving into active casework.
For organizations still selling into the EU without a current conformance audit on file, the lesson of this first year is that enforcement rarely announces itself in advance. It arrives as a legal notice, an information request, or a court date, usually after a complaint has been sitting with a regulator for months. None of the cases above started with a fine. They started with someone asking a question the organization could not answer.
The businesses in the strongest position this time next year will be the ones that treated year one as a warning rather than a false alarm, and used it to get their documentation, their accessibility statement and their remediation record in order before anyone came asking. And beneath the case numbers sits the reason the Act exists at all. Behind the 61% of Dutch webshops where an order cannot be placed with a screen reader are real people who could not complete a purchase that everyone else completed without thinking about it. That is what year two needs to fix.